From: Dave Hansen Signed-off-by: Dave Hansen Cc: Serge Hallyn Cc: Herbert Poetzl Cc: Al Viro Signed-off-by: Andrew Morton --- fs/open.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff -puN fs/open.c~ro-bind-mounts-elevate-write-count-for-do_utimes fs/open.c --- a/fs/open.c~ro-bind-mounts-elevate-write-count-for-do_utimes +++ a/fs/open.c @@ -441,16 +441,19 @@ long do_utimes(int dfd, char __user *fil goto out; inode = nd.dentry->d_inode; + error = mnt_want_write(nd.mnt); + if (error) + goto dput_and_out; error = -EROFS; if (IS_RDONLY(inode)) - goto dput_and_out; + goto mnt_drop_write_and_out; /* Don't worry, the checks are done in inode_change_ok() */ newattrs.ia_valid = ATTR_CTIME | ATTR_MTIME | ATTR_ATIME; if (times) { error = -EPERM; if (IS_APPEND(inode) || IS_IMMUTABLE(inode)) - goto dput_and_out; + goto mnt_drop_write_and_out; newattrs.ia_atime.tv_sec = times[0].tv_sec; newattrs.ia_atime.tv_nsec = times[0].tv_usec * 1000; @@ -460,15 +463,17 @@ long do_utimes(int dfd, char __user *fil } else { error = -EACCES; if (IS_IMMUTABLE(inode)) - goto dput_and_out; + goto mnt_drop_write_and_out; if (current->fsuid != inode->i_uid && (error = vfs_permission(&nd, MAY_WRITE)) != 0) - goto dput_and_out; + goto mnt_drop_write_and_out; } mutex_lock(&inode->i_mutex); error = notify_change(nd.dentry, &newattrs); mutex_unlock(&inode->i_mutex); +mnt_drop_write_and_out: + mnt_drop_write(nd.mnt); dput_and_out: path_release(&nd); out: _