--- y/fs/namespace.c
+++ x/fs/namespace.c
@@ -4034,6 +4034,7 @@ static int mount_setattr_prepare(struct
 {
 	struct mount *m;
 	int err;
+	int undo_m = 0;
 
 	for (m = mnt; m; m = next_mnt(m, mnt)) {
 		if (!can_change_locked_flags(m, recalc_flags(kattr, m))) {
@@ -4047,8 +4048,10 @@ static int mount_setattr_prepare(struct
 
 		if (!mnt_allow_writers(kattr, m)) {
 			err = mnt_hold_writers(m);
-			if (err)
+			if (err) {
+				undo_m = 1;
 				break;
+			}
 		}
 
 		if (!kattr->recurse)
@@ -4063,6 +4066,9 @@ static int mount_setattr_prepare(struct
 			if (p->mnt.mnt_flags & MNT_WRITE_HOLD)
 				mnt_unhold_writers(p);
 		}
+		if (undo_m)
+			if (m->mnt.mnt_flags & MNT_WRITE_HOLD)
+				mnt_unhold_writers(m);
 	}
 	return err;
 }