--- fs/nfsd/vfs.c

+++ fs/nfsd/vfs.c

@@ -1379,7 +1379,7 @@ nfsd_create_v3(struct svc_rqst *rqstp, s

goto out;

if (!(iap->ia_valid & ATTR_MODE))

iap->ia_mode = 0;

- err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE);

+ err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_EXEC);

if (err)

goto out;

@@ -1401,6 +1401,13 @@ nfsd_create_v3(struct svc_rqst *rqstp, s

if (IS_ERR(dchild))

goto out_nfserr;

+ /* If file doesn't exist, check for permissions to create one */

+ if (!dchild->d_inode) {

+ err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE);

+ if (err)

+ goto out;

+ }

+

err = fh_compose(resfhp, fhp->fh_export, dchild, fhp);

if (err)

goto out;