4 files changed, 85 insertions, 13 deletions

diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index c593db047d8b..c309c881bd4e 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -658,14 +658,19 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                         return status;
                 }
         }
+        status = mnt_want_write(cstate->current_fh.fh_export->ex_path.mnt);
+        if (status)
+                return status;
         status = nfs_ok;
         if (setattr->sa_acl != NULL)
                 status = nfsd4_set_nfs4_acl(rqstp, &cstate->current_fh,
                                             setattr->sa_acl);
         if (status)
-                return status;
+                goto out;
         status = nfsd_setattr(rqstp, &cstate->current_fh, &setattr->sa_iattr,
                                 0, (time_t)0);
+out:
+        mnt_drop_write(cstate->current_fh.fh_export->ex_path.mnt);
         return status;
 }
 
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index 1ff90625860f..145b3c877a27 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -46,6 +46,7 @@
 #include <linux/scatterlist.h>
 #include <linux/crypto.h>
 #include <linux/sched.h>
+#include <linux/mount.h>
 
 #define NFSDDBG_FACILITY                NFSDDBG_PROC
 
@@ -154,7 +155,11 @@ nfsd4_create_clid_dir(struct nfs4_client *clp)
                 dprintk("NFSD: nfsd4_create_clid_dir: DIRECTORY EXISTS\n");
                 goto out_put;
         }
+        status = mnt_want_write(rec_dir.path.mnt);
+        if (status)
+                goto out_put;
         status = vfs_mkdir(rec_dir.path.dentry->d_inode, dentry, S_IRWXU);
+        mnt_drop_write(rec_dir.path.mnt);
 out_put:
         dput(dentry);
 out_unlock:
@@ -313,12 +318,17 @@ nfsd4_remove_clid_dir(struct nfs4_client *clp)
         if (!rec_dir_init || !clp->cl_firststate)
                 return;
 
+        status = mnt_want_write(rec_dir.path.mnt);
+        if (status)
+                goto out;
         clp->cl_firststate = 0;
         nfs4_save_user(&uid, &gid);
         status = nfsd4_unlink_clid_dir(clp->cl_recdir, HEXDIR_LEN-1);
         nfs4_reset_user(uid, gid);
         if (status == 0)
                 nfsd4_sync_rec_dir();
+        mnt_drop_write(rec_dir.path.mnt);
+out:
         if (status)
                 printk("NFSD: Failed to remove expired client state directory"
                                 " %.*s\n", HEXDIR_LEN, clp->cl_recdir);
@@ -347,13 +357,17 @@ nfsd4_recdir_purge_old(void) {
 
         if (!rec_dir_init)
                 return;
+        status = mnt_want_write(rec_dir.path.mnt);
+        if (status)
+                goto out;
         status = nfsd4_list_rec_dir(rec_dir.path.dentry, purge_old);
         if (status == 0)
                 nfsd4_sync_rec_dir();
+        mnt_drop_write(rec_dir.path.mnt);
+out:
         if (status)
                 printk("nfsd4: failed to purge old clients from recovery"
                         " directory %s\n", rec_dir.path.dentry->d_name.name);
-        return;
 }
 
 static int
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index bcb97d8e8b8b..81a75f3081f4 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -41,6 +41,7 @@
 #include <linux/sunrpc/svc.h>
 #include <linux/nfsd/nfsd.h>
 #include <linux/nfsd/cache.h>
+#include <linux/file.h>
 #include <linux/mount.h>
 #include <linux/workqueue.h>
 #include <linux/smp_lock.h>
@@ -1239,7 +1240,7 @@ static inline void
 nfs4_file_downgrade(struct file *filp, unsigned int share_access)
 {
         if (share_access & NFS4_SHARE_ACCESS_WRITE) {
-                put_write_access(filp->f_path.dentry->d_inode);
+                drop_file_write_access(filp);
                 filp->f_mode = (filp->f_mode | FMODE_READ) & ~FMODE_WRITE;
         }
 }
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 46f59d5365a0..304bf5f643c9 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -1255,23 +1255,35 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
         err = 0;
         switch (type) {
         case S_IFREG:
+                host_err = mnt_want_write(fhp->fh_export->ex_path.mnt);
+                if (host_err)
+                        goto out_nfserr;
                 host_err = vfs_create(dirp, dchild, iap->ia_mode, NULL);
                 break;
         case S_IFDIR:
+                host_err = mnt_want_write(fhp->fh_export->ex_path.mnt);
+                if (host_err)
+                        goto out_nfserr;
                 host_err = vfs_mkdir(dirp, dchild, iap->ia_mode);
                 break;
         case S_IFCHR:
         case S_IFBLK:
         case S_IFIFO:
         case S_IFSOCK:
+                host_err = mnt_want_write(fhp->fh_export->ex_path.mnt);
+                if (host_err)
+                        goto out_nfserr;
                 host_err = vfs_mknod(dirp, dchild, iap->ia_mode, rdev);
                 break;
         default:
                 printk("nfsd: bad file type %o in nfsd_create\n", type);
                 host_err = -EINVAL;
+                goto out_nfserr;
         }
-        if (host_err < 0)
+        if (host_err < 0) {
+                mnt_drop_write(fhp->fh_export->ex_path.mnt);
                 goto out_nfserr;
+        }
 
         if (EX_ISSYNC(fhp->fh_export)) {
                 err = nfserrno(nfsd_sync_dir(dentry));
@@ -1282,6 +1294,7 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
         err2 = nfsd_create_setattr(rqstp, resfhp, iap);
         if (err2)
                 err = err2;
+        mnt_drop_write(fhp->fh_export->ex_path.mnt);
         /*
          * Update the file handle to get the new inode info.
          */
@@ -1359,6 +1372,9 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
                 v_atime = verifier[1]&0x7fffffff;
         }
         
+        host_err = mnt_want_write(fhp->fh_export->ex_path.mnt);
+        if (host_err)
+                goto out_nfserr;
         if (dchild->d_inode) {
                 err = 0;
 
@@ -1390,12 +1406,15 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
                 case NFS3_CREATE_GUARDED:
                         err = nfserr_exist;
                 }
+                mnt_drop_write(fhp->fh_export->ex_path.mnt);
                 goto out;
         }
 
         host_err = vfs_create(dirp, dchild, iap->ia_mode, NULL);
-        if (host_err < 0)
+        if (host_err < 0) {
+                mnt_drop_write(fhp->fh_export->ex_path.mnt);
                 goto out_nfserr;
+        }
         if (created)
                 *created = 1;
 
@@ -1420,6 +1439,7 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
         if (err2)
                 err = err2;
 
+        mnt_drop_write(fhp->fh_export->ex_path.mnt);
         /*
          * Update the filehandle to get the new inode info.
          */
@@ -1522,6 +1542,10 @@ nfsd_symlink(struct svc_rqst *rqstp, struct svc_fh *fhp,
         if (iap && (iap->ia_valid & ATTR_MODE))
                 mode = iap->ia_mode & S_IALLUGO;
 
+        host_err = mnt_want_write(fhp->fh_export->ex_path.mnt);
+        if (host_err)
+                goto out_nfserr;
+
         if (unlikely(path[plen] != 0)) {
                 char *path_alloced = kmalloc(plen+1, GFP_KERNEL);
                 if (path_alloced == NULL)
@@ -1542,6 +1566,8 @@ nfsd_symlink(struct svc_rqst *rqstp, struct svc_fh *fhp,
         err = nfserrno(host_err);
         fh_unlock(fhp);
 
+        mnt_drop_write(fhp->fh_export->ex_path.mnt);
+
         cerr = fh_compose(resfhp, fhp->fh_export, dnew, fhp);
         dput(dnew);
         if (err==0) err = cerr;
@@ -1592,6 +1618,11 @@ nfsd_link(struct svc_rqst *rqstp, struct svc_fh *ffhp,
         dold = tfhp->fh_dentry;
         dest = dold->d_inode;
 
+        host_err = mnt_want_write(tfhp->fh_export->ex_path.mnt);
+        if (host_err) {
+                err = nfserrno(host_err);
+                goto out_dput;
+        }
         host_err = vfs_link(dold, dirp, dnew);
         if (!host_err) {
                 if (EX_ISSYNC(ffhp->fh_export)) {
@@ -1605,7 +1636,8 @@ nfsd_link(struct svc_rqst *rqstp, struct svc_fh *ffhp,
                 else
                         err = nfserrno(host_err);
         }
-
+        mnt_drop_write(tfhp->fh_export->ex_path.mnt);
+out_dput:
         dput(dnew);
 out_unlock:
         fh_unlock(ffhp);
@@ -1678,13 +1710,20 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen,
         if (ndentry == trap)
                 goto out_dput_new;
 
-#ifdef MSNFS
-        if ((ffhp->fh_export->ex_flags & NFSEXP_MSNFS) &&
+        if (svc_msnfs(ffhp) &&
                 ((atomic_read(&odentry->d_count) > 1)
                  || (atomic_read(&ndentry->d_count) > 1))) {
                         host_err = -EPERM;
-        } else
-#endif
+                        goto out_dput_new;
+        }
+
+        host_err = -EXDEV;
+        if (ffhp->fh_export->ex_path.mnt != tfhp->fh_export->ex_path.mnt)
+                goto out_dput_new;
+        host_err = mnt_want_write(ffhp->fh_export->ex_path.mnt);
+        if (host_err)
+                goto out_dput_new;
+
         host_err = vfs_rename(fdir, odentry, tdir, ndentry);
         if (!host_err && EX_ISSYNC(tfhp->fh_export)) {
                 host_err = nfsd_sync_dir(tdentry);
@@ -1692,6 +1731,8 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen,
                         host_err = nfsd_sync_dir(fdentry);
         }
 
+        mnt_drop_write(ffhp->fh_export->ex_path.mnt);
+
  out_dput_new:
         dput(ndentry);
  out_dput_old:
@@ -1750,6 +1791,10 @@ nfsd_unlink(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
         if (!type)
                 type = rdentry->d_inode->i_mode & S_IFMT;
 
+        host_err = mnt_want_write(fhp->fh_export->ex_path.mnt);
+        if (host_err)
+                goto out_nfserr;
+
         if (type != S_IFDIR) { /* It's UNLINK */
 #ifdef MSNFS
                 if ((fhp->fh_export->ex_flags & NFSEXP_MSNFS) &&
@@ -1765,10 +1810,12 @@ nfsd_unlink(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
         dput(rdentry);
 
         if (host_err)
-                goto out_nfserr;
+                goto out_drop;
         if (EX_ISSYNC(fhp->fh_export))
                 host_err = nfsd_sync_dir(dentry);
 
+out_drop:
+        mnt_drop_write(fhp->fh_export->ex_path.mnt);
 out_nfserr:
         err = nfserrno(host_err);
 out:
@@ -1865,7 +1912,7 @@ nfsd_permission(struct svc_rqst *rqstp, struct svc_export *exp,
                 inode->i_mode,
                 IS_IMMUTABLE(inode)?    " immut" : "",
                 IS_APPEND(inode)?       " append" : "",
-                IS_RDONLY(inode)?       " ro" : "");
+                __mnt_is_readonly(exp->ex_path.mnt)?    " ro" : "");
         dprintk("      owner %d/%d user %d/%d\n",
                 inode->i_uid, inode->i_gid, current->fsuid, current->fsgid);
 #endif
@@ -1876,7 +1923,8 @@ nfsd_permission(struct svc_rqst *rqstp, struct svc_export *exp,
          */
         if (!(acc & MAY_LOCAL_ACCESS))
                 if (acc & (MAY_WRITE | MAY_SATTR | MAY_TRUNC)) {
-                        if (exp_rdonly(rqstp, exp) || IS_RDONLY(inode))
+                        if (exp_rdonly(rqstp, exp) ||
+                            __mnt_is_readonly(exp->ex_path.mnt))
                                 return nfserr_rofs;
                         if (/* (acc & MAY_WRITE) && */ IS_IMMUTABLE(inode))
                                 return nfserr_perm;
@@ -2039,6 +2087,9 @@ nfsd_set_posix_acl(struct svc_fh *fhp, int type, struct posix_acl *acl)
         } else
                 size = 0;
 
+        error = mnt_want_write(fhp->fh_export->ex_path.mnt);
+        if (error)
+                goto getout;
         if (size)
                 error = vfs_setxattr(fhp->fh_dentry, name, value, size, 0);
         else {
@@ -2050,6 +2101,7 @@ nfsd_set_posix_acl(struct svc_fh *fhp, int type, struct posix_acl *acl)
                                 error = 0;
                 }
         }
+        mnt_drop_write(fhp->fh_export->ex_path.mnt);
 
 getout:
         kfree(value);