--- e/fs/ext4/mmp.c	2023-04-30 08:36:23.427464300 +0800
+++ f/fs/ext4/mmp.c	2023-04-30 08:46:07.666111800 +0800
@@ -47,14 +47,12 @@ static int write_mmp_block(struct super_
 	 * We protect against freezing so that we don't create dirty buffers
 	 * on frozen filesystem.
 	 */
-	sb_start_write(sb);
 	ext4_mmp_csum_set(sb, mmp);
 	lock_buffer(bh);
 	bh->b_end_io = end_buffer_write_sync;
 	get_bh(bh);
 	submit_bh(REQ_OP_WRITE | REQ_SYNC | REQ_META | REQ_PRIO, bh);
 	wait_on_buffer(bh);
-	sb_end_write(sb);
 	if (unlikely(!buffer_uptodate(bh)))
 		return -EIO;
 
--- e/fs/ext4/super.c	2023-04-30 08:41:25.878184900 +0800
+++ f/fs/ext4/super.c	2023-04-30 08:49:46.672403500 +0800
@@ -5266,9 +5266,14 @@ static int __ext4_fill_super(struct fs_c
 			  ext4_has_feature_orphan_present(sb) ||
 			  ext4_has_feature_journal_needs_recovery(sb));
 
-	if (ext4_has_feature_mmp(sb) && !sb_rdonly(sb))
-		if (ext4_multi_mount_protect(sb, le64_to_cpu(es->s_mmp_block)))
+	if (ext4_has_feature_mmp(sb) && !sb_rdonly(sb)) {
+		sb_start_write(sb);
+		if (ext4_multi_mount_protect(sb, le64_to_cpu(es->s_mmp_block))) {
+			sb_end_write(sb);
 			goto failed_mount3a;
+		}
+		sb_end_write(sb);
+	}
 
 	/*
 	 * The first inode we look at is the journal inode.  Don't try
--- e/fs/namespace.c	2023-04-30 08:34:17.573937100 +0800
+++ f/fs/namespace.c	2023-04-30 09:14:21.947358000 +0800
@@ -2698,6 +2698,7 @@ static int do_remount(struct path *path,
 	fc->oldapi = true;
 	err = parse_monolithic_mount_data(fc, data);
 	if (!err) {
+		sb_start_write(sb);
 		down_write(&sb->s_umount);
 		err = -EPERM;
 		if (ns_capable(sb->s_user_ns, CAP_SYS_ADMIN)) {
@@ -2709,6 +2710,7 @@ static int do_remount(struct path *path,
 			}
 		}
 		up_write(&sb->s_umount);
+		sb_end_write(sb);
 	}
 
 	mnt_warn_timestamp_expiry(path, &mnt->mnt);