2 files changed, 18 insertions, 2 deletions

diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index 1ff90625860f..4e77a1a3bd73 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -46,6 +46,7 @@
 #include <linux/scatterlist.h>
 #include <linux/crypto.h>
 #include <linux/sched.h>
+#include <linux/mount.h>
 
 #define NFSDDBG_FACILITY                NFSDDBG_PROC
 
@@ -313,12 +314,17 @@ nfsd4_remove_clid_dir(struct nfs4_client *clp)
         if (!rec_dir_init || !clp->cl_firststate)
                 return;
 
+        status = mnt_want_write(rec_dir.path.mnt);
+        if (status)
+                goto out;
         clp->cl_firststate = 0;
         nfs4_save_user(&uid, &gid);
         status = nfsd4_unlink_clid_dir(clp->cl_recdir, HEXDIR_LEN-1);
         nfs4_reset_user(uid, gid);
         if (status == 0)
                 nfsd4_sync_rec_dir();
+        mnt_drop_write(rec_dir.path.mnt);
+out:
         if (status)
                 printk("NFSD: Failed to remove expired client state directory"
                                 " %.*s\n", HEXDIR_LEN, clp->cl_recdir);
@@ -347,13 +353,17 @@ nfsd4_recdir_purge_old(void) {
 
         if (!rec_dir_init)
                 return;
+        status = mnt_want_write(rec_dir.path.mnt);
+        if (status)
+                goto out;
         status = nfsd4_list_rec_dir(rec_dir.path.dentry, purge_old);
         if (status == 0)
                 nfsd4_sync_rec_dir();
+        mnt_drop_write(rec_dir.path.mnt);
+out:
         if (status)
                 printk("nfsd4: failed to purge old clients from recovery"
                         " directory %s\n", rec_dir.path.dentry->d_name.name);
-        return;
 }
 
 static int
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 46f59d5365a0..efff58a5818c 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -1750,6 +1750,10 @@ nfsd_unlink(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
         if (!type)
                 type = rdentry->d_inode->i_mode & S_IFMT;
 
+        host_err = mnt_want_write(fhp->fh_export->ex_path.mnt);
+        if (host_err)
+                goto out_nfserr;
+
         if (type != S_IFDIR) { /* It's UNLINK */
 #ifdef MSNFS
                 if ((fhp->fh_export->ex_flags & NFSEXP_MSNFS) &&
@@ -1765,10 +1769,12 @@ nfsd_unlink(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
         dput(rdentry);
 
         if (host_err)
-                goto out_nfserr;
+                goto out_drop;
         if (EX_ISSYNC(fhp->fh_export))
                 host_err = nfsd_sync_dir(dentry);
 
+out_drop:
+        mnt_drop_write(fhp->fh_export->ex_path.mnt);
 out_nfserr:
         err = nfserrno(host_err);
 out: