From: Dave Hansen This takes care of all of the direct callers of vfs_mknod(). Since a few of these cases also handle normal file creation as well, this also covers some calls to vfs_create(). So that we don't have to make three mnt_want/drop_write() calls inside of the switch statement, we move some of its logic outside of the switch. Acked-by: Christoph Hellwig Signed-off-by: Dave Hansen Signed-off-by: Andrew Morton --- fs/namei.c | 32 +++++++++++++++++++++----------- fs/nfsd/vfs.c | 4 ++++ net/unix/af_unix.c | 4 ++++ 3 files changed, 29 insertions(+), 11 deletions(-) diff -puN fs/namei.c~r-o-bind-mounts-sys_mknodat-elevate-write-count-for-vfs_mknod-create fs/namei.c --- a/fs/namei.c~r-o-bind-mounts-sys_mknodat-elevate-write-count-for-vfs_mknod-create +++ a/fs/namei.c @@ -1971,12 +1971,25 @@ asmlinkage long sys_mknodat(int dfd, con if (error) goto out; dentry = lookup_create(&nd, 0); - error = PTR_ERR(dentry); - + if (IS_ERR(dentry)) { + error = PTR_ERR(dentry); + goto out_unlock; + } if (!IS_POSIXACL(nd.dentry->d_inode)) mode &= ~current->fs->umask; - if (!IS_ERR(dentry)) { - switch (mode & S_IFMT) { + if (S_ISDIR(mode)) { + error = -EPERM; + goto out_dput; + } + if (!S_ISREG(mode) && !S_ISCHR(mode) && !S_ISBLK(mode) && + !S_ISFIFO(mode) && !S_ISSOCK(mode) && mode != 0) { + error = -EINVAL; + goto out_dput; + } + error = mnt_want_write(nd.mnt); + if (error) + goto out_dput; + switch (mode & S_IFMT) { case 0: case S_IFREG: error = vfs_create(nd.dentry->d_inode,dentry,mode,&nd); break; @@ -1987,14 +2000,11 @@ asmlinkage long sys_mknodat(int dfd, con case S_IFIFO: case S_IFSOCK: error = vfs_mknod(nd.dentry->d_inode,dentry,mode,0); break; - case S_IFDIR: - error = -EPERM; - break; - default: - error = -EINVAL; - } - dput(dentry); } + mnt_drop_write(nd.mnt); +out_dput: + dput(dentry); +out_unlock: mutex_unlock(&nd.dentry->d_inode->i_mutex); path_release(&nd); out: diff -puN fs/nfsd/vfs.c~r-o-bind-mounts-sys_mknodat-elevate-write-count-for-vfs_mknod-create fs/nfsd/vfs.c --- a/fs/nfsd/vfs.c~r-o-bind-mounts-sys_mknodat-elevate-write-count-for-vfs_mknod-create +++ a/fs/nfsd/vfs.c @@ -1243,7 +1243,11 @@ nfsd_create(struct svc_rqst *rqstp, stru case S_IFBLK: case S_IFIFO: case S_IFSOCK: + host_err = mnt_want_write(fhp->fh_export->ex_mnt); + if (host_err) + break; host_err = vfs_mknod(dirp, dchild, iap->ia_mode, rdev); + mnt_drop_write(fhp->fh_export->ex_mnt); break; default: printk("nfsd: bad file type %o in nfsd_create\n", type); diff -puN net/unix/af_unix.c~r-o-bind-mounts-sys_mknodat-elevate-write-count-for-vfs_mknod-create net/unix/af_unix.c --- a/net/unix/af_unix.c~r-o-bind-mounts-sys_mknodat-elevate-write-count-for-vfs_mknod-create +++ a/net/unix/af_unix.c @@ -846,7 +846,11 @@ static int unix_bind(struct socket *sock */ mode = S_IFSOCK | (SOCK_INODE(sock)->i_mode & ~current->fs->umask); + err = mnt_want_write(nd.mnt); + if (err) + goto out_mknod_dput; err = vfs_mknod(nd.dentry->d_inode, dentry, mode, 0); + mnt_drop_write(nd.mnt); if (err) goto out_mknod_dput; mutex_unlock(&nd.dentry->d_inode->i_mutex); _