2 files changed, 22 insertions, 9 deletions

diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 60f7a27f7a9e..94fd3b08fb77 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -598,6 +598,7 @@ static struct file *do_create(struct dentry *dir, struct dentry *dentry,
                         int oflag, mode_t mode, struct mq_attr __user *u_attr)
 {
         struct mq_attr attr;
+        struct file *result;
         int ret;
 
         if (u_attr) {
@@ -612,13 +613,24 @@ static struct file *do_create(struct dentry *dir, struct dentry *dentry,
         }
 
         mode &= ~current->fs->umask;
+        ret = mnt_want_write(mqueue_mnt);
+        if (ret)
+                goto out;
         ret = vfs_create(dir->d_inode, dentry, mode, NULL);
         dentry->d_fsdata = NULL;
         if (ret)
-                goto out;
-
-        return dentry_open(dentry, mqueue_mnt, oflag);
-
+                goto out_drop_write;
+
+        result = dentry_open(dentry, mqueue_mnt, oflag);
+        /*
+         * dentry_open() took a persistent mnt_want_write(),
+         * so we can now drop this one.
+         */
+        mnt_drop_write(mqueue_mnt);
+        return result;
+
+out_drop_write:
+        mnt_drop_write(mqueue_mnt);
 out:
         dput(dentry);
         mntput(mqueue_mnt);
@@ -742,8 +754,11 @@ asmlinkage long sys_mq_unlink(const char __user *u_name)
         inode = dentry->d_inode;
         if (inode)
                 atomic_inc(&inode->i_count);
-
+        err = mnt_want_write(mqueue_mnt);
+        if (err)
+                goto out_err;
         err = vfs_unlink(dentry->d_parent->d_inode, dentry);
+        mnt_drop_write(mqueue_mnt);
 out_err:
         dput(dentry);
 
diff --git a/ipc/shm.c b/ipc/shm.c
index cc63fae02f06..e636910454a9 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -271,11 +271,9 @@ static struct mempolicy *shm_get_policy(struct vm_area_struct *vma,
 
         if (sfd->vm_ops->get_policy)
                 pol = sfd->vm_ops->get_policy(vma, addr);
-        else if (vma->vm_policy) {
+        else if (vma->vm_policy)
                 pol = vma->vm_policy;
-                mpol_get(pol);  /* get_vma_policy() expects this */
-        } else
-                pol = current->mempolicy;
+
         return pol;
 }
 #endif