__page_cache_release() needs to check PG_lru inside the lock, because
page reclaim may have taken the page off the LRU while this CPU waits
on the lock.

That's three bugs in a single twenty-line function.  So far.