splice: fix bad unlock_page() in error case