From: Valdis.Kletnieks@vt.edu "never let a libc developer write your kernel code" - hch "nor, apparently, a kernel developer" - akpm Cc: Christoph Hellwig Cc: Valdis Kletnieks Cc: Balbir Singh Cc: Dave Hansen Signed-off-by: Andrew Morton --- fs/utimes.c | 7 +++++-- 1 files changed, 5 insertions(+), 2 deletions(-) diff -puN fs/utimes.c~r-o-bind-mounts-elevate-write-count-for-do_utimes-touch-command-causes-oops fs/utimes.c --- a/fs/utimes.c~r-o-bind-mounts-elevate-write-count-for-do_utimes-touch-command-causes-oops +++ a/fs/utimes.c @@ -59,6 +59,7 @@ long do_utimes(int dfd, char __user *fil struct inode *inode; struct iattr newattrs; struct file *f = NULL; + struct vfsmount *mnt; error = -EINVAL; if (times && (!nsec_valid(times[0].tv_nsec) || @@ -79,17 +80,19 @@ long do_utimes(int dfd, char __user *fil if (!f) goto out; dentry = f->f_path.dentry; + mnt = f->f_path.mnt; } else { error = __user_walk_fd(dfd, filename, (flags & AT_SYMLINK_NOFOLLOW) ? 0 : LOOKUP_FOLLOW, &nd); if (error) goto out; dentry = nd.dentry; + mnt = nd.mnt; } inode = dentry->d_inode; - error = mnt_want_write(nd.mnt); + error = mnt_want_write(mnt); if (error) goto dput_and_out; @@ -135,7 +138,7 @@ long do_utimes(int dfd, char __user *fil error = notify_change(dentry, &newattrs); mutex_unlock(&inode->i_mutex); mnt_drop_write_and_out: - mnt_drop_write(nd.mnt); + mnt_drop_write(mnt); dput_and_out: if (f) fput(f); _