Add a minimal fix that no longer passes NULL nameidata to vfs_create. May not actually work yet, and it's quite an ugly hack.

kernel-patches/for-mainline/nameidata-never-NULL.diff

@@ -0,0 +1,111 @@
+---
+ fs/namei.c    |    2 +-
+ fs/nfsd/vfs.c |   23 +++++++++++++++++++----
+ ipc/mqueue.c  |    6 +++++-
+ 3 files changed, 25 insertions(+), 6 deletions(-)
+
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -1503,7 +1503,7 @@ int vfs_create(struct inode *dir, struct
+ 		return -EACCES;	/* shouldn't it be ENOSYS? */
+ 	mode &= S_IALLUGO;
+ 	mode |= S_IFREG;
+-	error = security_inode_create(dir, dentry, nd ? nd->mnt : NULL, mode);
++	error = security_inode_create(dir, dentry, nd->mnt, mode);
+ 	if (error)
+ 		return error;
+ 	DQUOT_INIT(dir);
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -1108,6 +1108,18 @@ nfsd_commit(struct svc_rqst *rqstp, stru
+ }
+ #endif /* CONFIG_NFSD_V3 */
+ 
++static int
++nfsd_do_create(struct inode *dir, struct dentry *child, struct vfsmount *mnt,
++	       int mode)
++{
++	struct nameidata nd = {
++		.dentry = child,
++		.mnt = mnt,
++	};
++
++	return vfs_create(dir, child, mode, &nd);
++}
++
+ /*
+  * Create a file (regular, directory, device, fifo); UNIX sockets 
+  * not yet implemented.
+@@ -1192,7 +1204,8 @@ nfsd_create(struct svc_rqst *rqstp, stru
+ 	err = 0;
+ 	switch (type) {
+ 	case S_IFREG:
+-		host_err = vfs_create(dirp, dchild, iap->ia_mode, NULL);
++		host_err = nfsd_do_create(dirp, dchild, exp->ex_mnt,
++					  iap->ia_mode);
+ 		break;
+ 	case S_IFDIR:
+ 		host_err = vfs_mkdir(dirp, dchild, exp->ex_mnt, iap->ia_mode);
+@@ -1253,6 +1266,7 @@ nfsd_create_v3(struct svc_rqst *rqstp, s
+ 	        int *truncp, int *created)
+ {
+ 	struct dentry	*dentry, *dchild = NULL;
++	struct svc_export *exp;
+ 	struct inode	*dirp;
+ 	__be32		err;
+ 	int		host_err;
+@@ -1271,6 +1285,7 @@ nfsd_create_v3(struct svc_rqst *rqstp, s
+ 		goto out;
+ 
+ 	dentry = fhp->fh_dentry;
++	exp = fhp->fh_export;
+ 	dirp = dentry->d_inode;
+ 
+ 	/* Get all the sanity checks out of the way before
+@@ -1288,7 +1303,7 @@ nfsd_create_v3(struct svc_rqst *rqstp, s
+ 	if (IS_ERR(dchild))
+ 		goto out_nfserr;
+ 
+-	err = fh_compose(resfhp, fhp->fh_export, dchild, fhp);
++	err = fh_compose(resfhp, exp, dchild, fhp);
+ 	if (err)
+ 		goto out;
+ 
+@@ -1334,13 +1349,13 @@ nfsd_create_v3(struct svc_rqst *rqstp, s
+ 		goto out;
+ 	}
+ 
+-	host_err = vfs_create(dirp, dchild, iap->ia_mode, NULL);
++	host_err = nfsd_do_create(dirp, dchild, exp->ex_mnt, iap->ia_mode);
+ 	if (host_err < 0)
+ 		goto out_nfserr;
+ 	if (created)
+ 		*created = 1;
+ 
+-	if (EX_ISSYNC(fhp->fh_export)) {
++	if (EX_ISSYNC(exp)) {
+ 		err = nfserrno(nfsd_sync_dir(dentry));
+ 		/* setattr will sync the child (or not) */
+ 	}
+--- a/ipc/mqueue.c
++++ b/ipc/mqueue.c
+@@ -604,6 +604,10 @@ static int mq_attr_ok(struct mq_attr *at
+ static struct file *do_create(struct dentry *dir, struct dentry *dentry,
+ 			int oflag, mode_t mode, struct mq_attr __user *u_attr)
+ {
++	struct nameidata nd = {
++		.dentry = dentry,
++		.mnt = mqueue_mnt,
++	};
+ 	struct mq_attr attr;
+ 	int ret;
+ 
+@@ -619,7 +623,7 @@ static struct file *do_create(struct den
+ 	}
+ 
+ 	mode &= ~current->fs->umask;
+-	ret = vfs_create(dir->d_inode, dentry, mode, NULL);
++	ret = vfs_create(dir->d_inode, dentry, mode, &nd);
+ 	dentry->d_fsdata = NULL;
+ 	if (ret)
+ 		goto out;

kernel-patches/for-mainline/series

@@ -43,3 +43,4 @@ apparmor-module_interface.diff
 apparmor-module_interface-2.diff
 apparmor-misc.diff
 apparmor-intree.diff
+nameidata-never-NULL.diff