2 files changed, 26 insertions, 7 deletions

diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index a5887df2cd8a..8672b9536039 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -1926,7 +1926,7 @@ static ssize_t ocfs2_file_splice_write(struct pipe_inode_info *pipe,
                    out->f_path.dentry->d_name.len,
                    out->f_path.dentry->d_name.name);
 
-        inode_double_lock(inode, pipe->inode);
+        mutex_lock_nested(&inode->i_mutex, I_MUTEX_PARENT);
 
         ret = ocfs2_rw_lock(inode, 1);
         if (ret < 0) {
@@ -1941,12 +1941,16 @@ static ssize_t ocfs2_file_splice_write(struct pipe_inode_info *pipe,
                 goto out_unlock;
         }
 
+        if (pipe->inode)
+                mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_CHILD);
         ret = generic_file_splice_write_nolock(pipe, out, ppos, len, flags);
+        if (pipe->inode)
+                mutex_unlock(&pipe->inode->i_mutex);
 
 out_unlock:
         ocfs2_rw_unlock(inode, 1);
 out:
-        inode_double_unlock(inode, pipe->inode);
+        mutex_unlock(&inode->i_mutex);
 
         mlog_exit(ret);
         return ret;
diff --git a/fs/splice.c b/fs/splice.c
index dd727d43e5b7..c18aa7e03e2b 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -737,10 +737,19 @@ ssize_t splice_from_pipe(struct pipe_inode_info *pipe, struct file *out,
          * ->write_end. Most of the time, these expect i_mutex to
          * be held. Since this may result in an ABBA deadlock with
          * pipe->inode, we have to order lock acquiry here.
+         *
+         * Outer lock must be inode->i_mutex, as pipe_wait() will
+         * release and reacquire pipe->inode->i_mutex, AND inode must
+         * never be a pipe.
          */
-        inode_double_lock(inode, pipe->inode);
+        WARN_ON(S_ISFIFO(inode->i_mode));
+        mutex_lock_nested(&inode->i_mutex, I_MUTEX_PARENT);
+        if (pipe->inode)
+                mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_CHILD);
         ret = __splice_from_pipe(pipe, &sd, actor);
-        inode_double_unlock(inode, pipe->inode);
+        if (pipe->inode)
+                mutex_unlock(&pipe->inode->i_mutex);
+        mutex_unlock(&inode->i_mutex);
 
         return ret;
 }
@@ -831,11 +840,17 @@ generic_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
         };
         ssize_t ret;
 
-        inode_double_lock(inode, pipe->inode);
+        WARN_ON(S_ISFIFO(inode->i_mode));
+        mutex_lock_nested(&inode->i_mutex, I_MUTEX_PARENT);
         ret = file_remove_suid(out);
-        if (likely(!ret))
+        if (likely(!ret)) {
+                if (pipe->inode)
+                        mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_CHILD);
                 ret = __splice_from_pipe(pipe, &sd, pipe_to_file);
-        inode_double_unlock(inode, pipe->inode);
+                if (pipe->inode)
+                        mutex_unlock(&pipe->inode->i_mutex);
+        }
+        mutex_unlock(&inode->i_mutex);
         if (ret > 0) {
                 unsigned long nr_pages;