Fix possible splice() mmap_sem deadlock