2 files changed, 13 insertions, 4 deletions

diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 844813a7e12a..ef76ba632387 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -279,11 +279,15 @@ do_open_lookup(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, stru
                 if (open->op_createmode == NFS4_CREATE_EXCLUSIVE && status == 0)
                         open->op_bmval[1] = (FATTR4_WORD1_TIME_ACCESS |
                                                         FATTR4_WORD1_TIME_MODIFY);
-        } else {
+        } else
+                /*
+                 * Note this may exit with the parent still locked.
+                 * We will hold the lock until nfsd4_open's final
+                 * lookup, to prevent renames or unlinks until we've had
+                 * a chance to an acquire a delegation if appropriate.
+                 */
                 status = nfsd_lookup(rqstp, current_fh,
                                      open->op_fname.data, open->op_fname.len, *resfh);
-                fh_unlock(current_fh);
-        }
         if (status)
                 goto out;
         status = nfsd_check_obj_isreg(*resfh);
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index e85b463fac4a..a41302a00650 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -207,7 +207,12 @@ nfsd_lookup_dentry(struct svc_rqst *rqstp, struct svc_fh *fhp,
                                 goto out_nfserr;
                 }
         } else {
-                fh_lock(fhp);
+                /*
+                 * In the nfsd4_open() case, this may be held across
+                 * subsequent open and delegation acquisition which may
+                 * need to take the child's i_mutex:
+                 */
+                fh_lock_nested(fhp, I_MUTEX_PARENT);
                 dentry = lookup_one_len(name, dparent, len);
                 host_err = PTR_ERR(dentry);
                 if (IS_ERR(dentry))