commit 2fec4fd97cc3 ("block: take i_rwsem for the direct I/O write fallback") takes i_rwsem around blkdev_buffered_write() in the direct write fallback. commit 1b1be9ea4e34 ("block: take the inode lock for buffered write fallback") fixes the same race by taking i_rwsem inside blkdev_buffered_write(). With both applied, the fallback takes i_rwsem shared twice. Drop the outer locking in the fallback. Fixes: 1b1be9ea4e34 ("block: take the inode lock for buffered write fallback") Reported-by: syzbot+bd975ef54294bec73f0e@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=bd975ef54294bec73f0e Cc: Tal Zussman Cc: Julian Sun Assisted-by: LLM Signed-off-by: Zhenxian Ma --- block/fops.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/block/fops.c b/block/fops.c index 0e4c42c8b74f..ddab4940d76b 100644 --- a/block/fops.c +++ b/block/fops.c @@ -809,13 +809,8 @@ static ssize_t blkdev_write_iter(struct kiocb *iocb, struct iov_iter *from) else if (!blkdev_dio_fua(iocb, bdev)) need_sync = true; } else { - ssize_t ret2; - - inode_lock_shared(bd_inode); - ret2 = blkdev_buffered_write(iocb, from); - inode_unlock_shared(bd_inode); ret = direct_write_fallback(iocb, from, ret, - ret2); + blkdev_buffered_write(iocb, from)); need_sync = true; } } else if (ret > 0 && !blkdev_dio_fua(iocb, bdev)) { -- 2.39.3