I think I found a potential race in install_page/install_file_pte. The
inline function zap_pte releases pages by calling page_remove_rmap and
page_cache_release. If this was the last user of a page it can get
purged from the page cache and then get immediatly reused. But there
might still be a tlb for this page on another cpu. The tlb is removed
in the callers of zap_pte, install_page and install_file_pte, but this
is too late. I admit that its a very unlikely race but never the less..
I fixed this by using the new ptep_clear_flush function that is introduced
with the tlb flush optimization patch for s/390.