2 files changed, 26 insertions, 2 deletions

diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index 4e77a1a3bd73..145b3c877a27 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -155,7 +155,11 @@ nfsd4_create_clid_dir(struct nfs4_client *clp)
                 dprintk("NFSD: nfsd4_create_clid_dir: DIRECTORY EXISTS\n");
                 goto out_put;
         }
+        status = mnt_want_write(rec_dir.path.mnt);
+        if (status)
+                goto out_put;
         status = vfs_mkdir(rec_dir.path.dentry->d_inode, dentry, S_IRWXU);
+        mnt_drop_write(rec_dir.path.mnt);
 out_put:
         dput(dentry);
 out_unlock:
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index efff58a5818c..14d582467029 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -1255,23 +1255,35 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
         err = 0;
         switch (type) {
         case S_IFREG:
+                host_err = mnt_want_write(fhp->fh_export->ex_path.mnt);
+                if (host_err)
+                        goto out_nfserr;
                 host_err = vfs_create(dirp, dchild, iap->ia_mode, NULL);
                 break;
         case S_IFDIR:
+                host_err = mnt_want_write(fhp->fh_export->ex_path.mnt);
+                if (host_err)
+                        goto out_nfserr;
                 host_err = vfs_mkdir(dirp, dchild, iap->ia_mode);
                 break;
         case S_IFCHR:
         case S_IFBLK:
         case S_IFIFO:
         case S_IFSOCK:
+                host_err = mnt_want_write(fhp->fh_export->ex_path.mnt);
+                if (host_err)
+                        goto out_nfserr;
                 host_err = vfs_mknod(dirp, dchild, iap->ia_mode, rdev);
                 break;
         default:
                 printk("nfsd: bad file type %o in nfsd_create\n", type);
                 host_err = -EINVAL;
+                goto out_nfserr;
         }
-        if (host_err < 0)
+        if (host_err < 0) {
+                mnt_drop_write(fhp->fh_export->ex_path.mnt);
                 goto out_nfserr;
+        }
 
         if (EX_ISSYNC(fhp->fh_export)) {
                 err = nfserrno(nfsd_sync_dir(dentry));
@@ -1282,6 +1294,7 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
         err2 = nfsd_create_setattr(rqstp, resfhp, iap);
         if (err2)
                 err = err2;
+        mnt_drop_write(fhp->fh_export->ex_path.mnt);
         /*
          * Update the file handle to get the new inode info.
          */
@@ -1359,6 +1372,9 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
                 v_atime = verifier[1]&0x7fffffff;
         }
         
+        host_err = mnt_want_write(fhp->fh_export->ex_path.mnt);
+        if (host_err)
+                goto out_nfserr;
         if (dchild->d_inode) {
                 err = 0;
 
@@ -1390,12 +1406,15 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
                 case NFS3_CREATE_GUARDED:
                         err = nfserr_exist;
                 }
+                mnt_drop_write(fhp->fh_export->ex_path.mnt);
                 goto out;
         }
 
         host_err = vfs_create(dirp, dchild, iap->ia_mode, NULL);
-        if (host_err < 0)
+        if (host_err < 0) {
+                mnt_drop_write(fhp->fh_export->ex_path.mnt);
                 goto out_nfserr;
+        }
         if (created)
                 *created = 1;
 
@@ -1420,6 +1439,7 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
         if (err2)
                 err = err2;
 
+        mnt_drop_write(fhp->fh_export->ex_path.mnt);
         /*
          * Update the filehandle to get the new inode info.
          */