diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c
index dbfb35fb0ff7..5b5b4410c0f4 100644
--- a/fs/overlayfs/file.c
+++ b/fs/overlayfs/file.c
@@ -422,6 +422,7 @@ static int ovl_mmap(struct file *file, struct vm_area_struct *vma)
 {
 	struct file *realfile = file->private_data;
 	const struct cred *old_cred;
+	vm_flags_t vm_flags = vma->vm_flags;
 	int ret;
 
 	if (!realfile->f_op->mmap)
@@ -430,6 +431,15 @@ static int ovl_mmap(struct file *file, struct vm_area_struct *vma)
 	if (WARN_ON(file != vma->vm_file))
 		return -EIO;
 
+	/* Get temporary denial counts on realfile */
+	if (vm_flags & VM_DENYWRITE &&
+	    (ret = deny_write_access(realfile)))
+		goto out;
+
+	if (vm_flags & VM_SHARED &&
+	    (ret = mapping_map_writable(file->f_mapping)))
+		goto allow_write;
+
 	vma->vm_file = get_file(realfile);
 
 	old_cred = ovl_override_creds(file_inode(file)->i_sb);
@@ -446,6 +456,13 @@ static int ovl_mmap(struct file *file, struct vm_area_struct *vma)
 
 	ovl_file_accessed(file);
 
+	/* Undo temporary denial counts */
+	if (vm_flags & VM_SHARED)
+		mapping_unmap_writable(realfile->f_mapping);
+allow_write:
+	if (vm_flags & VM_DENYWRITE)
+		allow_write_access(realfile);
+out:
 	return ret;
 }
 
diff --git a/mm/mmap.c b/mm/mmap.c
index 3f287599a7a3..15b082c701c7 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -659,11 +659,18 @@ static void __vma_link_file(struct vm_area_struct *vma)
 	file = vma->vm_file;
 	if (file) {
 		struct address_space *mapping = file->f_mapping;
+		struct inode *inode = file_inode(file);
 
-		if (vma->vm_flags & VM_DENYWRITE)
-			put_write_access(file_inode(file));
-		if (vma->vm_flags & VM_SHARED)
+		if (vma->vm_flags & VM_DENYWRITE) {
+			/* This is an unconditional deny_write_access() */
+			WARN_ON(atomic_read(&inode->i_writecount) > 0);
+			put_write_access(inode);
+		}
+		if (vma->vm_flags & VM_SHARED) {
+			/* This is an unconditional mapping_map_writable() */
+			WARN_ON(atomic_read(&mapping->i_mmap_writable) < 0);
 			mapping_allow_writable(mapping);
+		}
 
 		flush_dcache_mmap_lock(mapping);
 		vma_interval_tree_insert(vma, &mapping->i_mmap);