Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security

Pull security subsystem updates from James Morris:
 "In this release:

   - PKCS#7 parser for the key management subsystem from David Howells
   - appoint Kees Cook as seccomp maintainer
   - bugfixes and general maintenance across the subsystem"

* 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (94 commits)
  X.509: Need to export x509_request_asymmetric_key()
  netlabel: shorter names for the NetLabel catmap funcs/structs
  netlabel: fix the catmap walking functions
  netlabel: fix the horribly broken catmap functions
  netlabel: fix a problem when setting bits below the previously lowest bit
  PKCS#7: X.509 certificate issuer and subject are mandatory fields in the ASN.1
  tpm: simplify code by using %*phN specifier
  tpm: Provide a generic means to override the chip returned timeouts
  tpm: missing tpm_chip_put in tpm_get_random()
  tpm: Properly clean sysfs entries in error path
  tpm: Add missing tpm_do_selftest to ST33 I2C driver
  PKCS#7: Use x509_request_asymmetric_key()
  Revert "selinux: fix the default socket labeling in sock_graft()"
  X.509: x509_request_asymmetric_keys() doesn't need string length arguments
  PKCS#7: fix sparse non static symbol warning
  KEYS: revert encrypted key change
  ima: add support for measuring and appraising firmware
  firmware_class: perform new LSM checks
  security: introduce kernel_fw_from_file hook
  PKCS#7: Missing inclusion of linux/err.h
  ...

34 files changed, 781 insertions, 377 deletions

diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index 452567d3a08e..d97cba3e3849 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -621,7 +621,7 @@ int aa_change_hat(const char *hats[], int count, u64 token, bool permtest)
          * There is no exception for unconfined as change_hat is not
          * available.
          */
-        if (current->no_new_privs)
+        if (task_no_new_privs(current))
                 return -EPERM;
 
         /* released below */
@@ -776,7 +776,7 @@ int aa_change_profile(const char *ns_name, const char *hname, bool onexec,
          * no_new_privs is set because this aways results in a reduction
          * of permissions.
          */
-        if (current->no_new_privs && !unconfined(profile)) {
+        if (task_no_new_privs(current) && !unconfined(profile)) {
                 put_cred(cred);
                 return -EPERM;
         }
diff --git a/security/capability.c b/security/capability.c
index e76373de3129..a74fde6a7468 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -401,6 +401,11 @@ static int cap_kernel_create_files_as(struct cred *new, struct inode *inode)
         return 0;
 }
 
+static int cap_kernel_fw_from_file(struct file *file, char *buf, size_t size)
+{
+        return 0;
+}
+
 static int cap_kernel_module_request(char *kmod_name)
 {
         return 0;
@@ -1015,6 +1020,7 @@ void __init security_fixup_ops(struct security_operations *ops)
         set_to_cap_if_null(ops, cred_transfer);
         set_to_cap_if_null(ops, kernel_act_as);
         set_to_cap_if_null(ops, kernel_create_files_as);
+        set_to_cap_if_null(ops, kernel_fw_from_file);
         set_to_cap_if_null(ops, kernel_module_request);
         set_to_cap_if_null(ops, kernel_module_from_file);
         set_to_cap_if_null(ops, task_fix_setuid);
diff --git a/security/commoncap.c b/security/commoncap.c
index b9d613e0ef14..bab0611afc1e 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -421,6 +421,9 @@ int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data
                 cpu_caps->inheritable.cap[i] = le32_to_cpu(caps.data[i].inheritable);
         }
 
+        cpu_caps->permitted.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;
+        cpu_caps->inheritable.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;
+
         return 0;
 }
 
@@ -822,15 +825,20 @@ int cap_task_setnice(struct task_struct *p, int nice)
  * Implement PR_CAPBSET_DROP.  Attempt to remove the specified capability from
  * the current task's bounding set.  Returns 0 on success, -ve on error.
  */
-static long cap_prctl_drop(struct cred *new, unsigned long cap)
+static int cap_prctl_drop(unsigned long cap)
 {
+        struct cred *new;
+
         if (!ns_capable(current_user_ns(), CAP_SETPCAP))
                 return -EPERM;
         if (!cap_valid(cap))
                 return -EINVAL;
 
+        new = prepare_creds();
+        if (!new)
+                return -ENOMEM;
         cap_lower(new->cap_bset, cap);
-        return 0;
+        return commit_creds(new);
 }
 
 /**
@@ -848,26 +856,17 @@ static long cap_prctl_drop(struct cred *new, unsigned long cap)
 int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
                    unsigned long arg4, unsigned long arg5)
 {
+        const struct cred *old = current_cred();
         struct cred *new;
-        long error = 0;
-
-        new = prepare_creds();
-        if (!new)
-                return -ENOMEM;
 
         switch (option) {
         case PR_CAPBSET_READ:
-                error = -EINVAL;
                 if (!cap_valid(arg2))
-                        goto error;
-                error = !!cap_raised(new->cap_bset, arg2);
-                goto no_change;
+                        return -EINVAL;
+                return !!cap_raised(old->cap_bset, arg2);
 
         case PR_CAPBSET_DROP:
-                error = cap_prctl_drop(new, arg2);
-                if (error < 0)
-                        goto error;
-                goto changed;
+                return cap_prctl_drop(arg2);
 
         /*
          * The next four prctl's remain to assist with transitioning a
@@ -889,10 +888,9 @@ int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
          * capability-based-privilege environment.
          */
         case PR_SET_SECUREBITS:
-                error = -EPERM;
-                if ((((new->securebits & SECURE_ALL_LOCKS) >> 1)
-                     & (new->securebits ^ arg2))                        /*[1]*/
-                    || ((new->securebits & SECURE_ALL_LOCKS & ~arg2))   /*[2]*/
+                if ((((old->securebits & SECURE_ALL_LOCKS) >> 1)
+                     & (old->securebits ^ arg2))                        /*[1]*/
+                    || ((old->securebits & SECURE_ALL_LOCKS & ~arg2))   /*[2]*/
                     || (arg2 & ~(SECURE_ALL_LOCKS | SECURE_ALL_BITS))   /*[3]*/
                     || (cap_capable(current_cred(),
                                     current_cred()->user_ns, CAP_SETPCAP,
@@ -906,46 +904,39 @@ int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
                          */
                     )
                         /* cannot change a locked bit */
-                        goto error;
+                        return -EPERM;
+
+                new = prepare_creds();
+                if (!new)
+                        return -ENOMEM;
                 new->securebits = arg2;
-                goto changed;
+                return commit_creds(new);
 
         case PR_GET_SECUREBITS:
-                error = new->securebits;
-                goto no_change;
+                return old->securebits;
 
         case PR_GET_KEEPCAPS:
-                if (issecure(SECURE_KEEP_CAPS))
-                        error = 1;
-                goto no_change;
+                return !!issecure(SECURE_KEEP_CAPS);
 
         case PR_SET_KEEPCAPS:
-                error = -EINVAL;
                 if (arg2 > 1) /* Note, we rely on arg2 being unsigned here */
-                        goto error;
-                error = -EPERM;
+                        return -EINVAL;
                 if (issecure(SECURE_KEEP_CAPS_LOCKED))
-                        goto error;
+                        return -EPERM;
+
+                new = prepare_creds();
+                if (!new)
+                        return -ENOMEM;
                 if (arg2)
                         new->securebits |= issecure_mask(SECURE_KEEP_CAPS);
                 else
                         new->securebits &= ~issecure_mask(SECURE_KEEP_CAPS);
-                goto changed;
+                return commit_creds(new);
 
         default:
                 /* No functionality available - continue with default */
-                error = -ENOSYS;
-                goto error;
+                return -ENOSYS;
         }
-
-        /* Functionality provided */
-changed:
-        return commit_creds(new);
-
-no_change:
-error:
-        abort_creds(new);
-        return error;
 }
 
 /**
diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index b4af4ebc5be2..8d4fbff8b87c 100644
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -13,7 +13,9 @@
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #include <linux/err.h>
+#include <linux/sched.h>
 #include <linux/rbtree.h>
+#include <linux/cred.h>
 #include <linux/key-type.h>
 #include <linux/digsig.h>
 
@@ -24,7 +26,11 @@ static struct key *keyring[INTEGRITY_KEYRING_MAX];
 static const char *keyring_name[INTEGRITY_KEYRING_MAX] = {
         "_evm",
         "_module",
+#ifndef CONFIG_IMA_TRUSTED_KEYRING
         "_ima",
+#else
+        ".ima",
+#endif
 };
 
 int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
@@ -56,3 +62,25 @@ int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
 
         return -EOPNOTSUPP;
 }
+
+int integrity_init_keyring(const unsigned int id)
+{
+        const struct cred *cred = current_cred();
+        int err = 0;
+
+        keyring[id] = keyring_alloc(keyring_name[id], KUIDT_INIT(0),
+                                    KGIDT_INIT(0), cred,
+                                    ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
+                                     KEY_USR_VIEW | KEY_USR_READ |
+                                     KEY_USR_WRITE | KEY_USR_SEARCH),
+                                    KEY_ALLOC_NOT_IN_QUOTA, NULL);
+        if (!IS_ERR(keyring[id]))
+                set_bit(KEY_FLAG_TRUSTED_ONLY, &keyring[id]->flags);
+        else {
+                err = PTR_ERR(keyring[id]);
+                pr_info("Can't allocate %s keyring (%d)\n",
+                        keyring_name[id], err);
+                keyring[id] = NULL;
+        }
+        return err;
+}
diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig
index 81a27971d884..08758fbd496f 100644
--- a/security/integrity/ima/Kconfig
+++ b/security/integrity/ima/Kconfig
@@ -123,3 +123,13 @@ config IMA_APPRAISE
           For more information on integrity appraisal refer to:
           <http://linux-ima.sourceforge.net>
           If unsure, say N.
+
+config IMA_TRUSTED_KEYRING
+        bool "Require all keys on the .ima keyring be signed"
+        depends on IMA_APPRAISE && SYSTEM_TRUSTED_KEYRING
+        depends on INTEGRITY_ASYMMETRIC_KEYS
+        select KEYS_DEBUG_PROC_KEYS
+        default y
+        help
+           This option requires that all keys added to the .ima
+           keyring be signed by a key on the system trusted keyring.
diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index f79fa8be203c..57da4bd7ba0c 100644
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -158,7 +158,7 @@ struct integrity_iint_cache *integrity_iint_insert(struct inode *inode);
 struct integrity_iint_cache *integrity_iint_find(struct inode *inode);
 
 /* IMA policy related functions */
-enum ima_hooks { FILE_CHECK = 1, MMAP_CHECK, BPRM_CHECK, MODULE_CHECK, POST_SETATTR };
+enum ima_hooks { FILE_CHECK = 1, MMAP_CHECK, BPRM_CHECK, MODULE_CHECK, FIRMWARE_CHECK, POST_SETATTR };
 
 int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask,
                      int flags);
@@ -171,6 +171,7 @@ void ima_delete_rules(void);
 #define IMA_APPRAISE_ENFORCE    0x01
 #define IMA_APPRAISE_FIX        0x02
 #define IMA_APPRAISE_MODULES    0x04
+#define IMA_APPRAISE_FIRMWARE   0x08
 
 #ifdef CONFIG_IMA_APPRAISE
 int ima_appraise_measurement(int func, struct integrity_iint_cache *iint,
@@ -249,4 +250,16 @@ static inline int security_filter_rule_match(u32 secid, u32 field, u32 op,
         return -EINVAL;
 }
 #endif /* CONFIG_IMA_LSM_RULES */
+
+#ifdef CONFIG_IMA_TRUSTED_KEYRING
+static inline int ima_init_keyring(const unsigned int id)
+{
+        return integrity_init_keyring(id);
+}
+#else
+static inline int ima_init_keyring(const unsigned int id)
+{
+        return 0;
+}
+#endif /* CONFIG_IMA_TRUSTED_KEYRING */
 #endif
diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index d3113d4aaa3c..86bfd5c5df85 100644
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -75,6 +75,8 @@ enum integrity_status ima_get_cache_status(struct integrity_iint_cache *iint,
                 return iint->ima_bprm_status;
         case MODULE_CHECK:
                 return iint->ima_module_status;
+        case FIRMWARE_CHECK:
+                return iint->ima_firmware_status;
         case FILE_CHECK:
         default:
                 return iint->ima_file_status;
@@ -94,6 +96,9 @@ static void ima_set_cache_status(struct integrity_iint_cache *iint,
         case MODULE_CHECK:
                 iint->ima_module_status = status;
                 break;
+        case FIRMWARE_CHECK:
+                iint->ima_firmware_status = status;
+                break;
         case FILE_CHECK:
         default:
                 iint->ima_file_status = status;
@@ -113,6 +118,9 @@ static void ima_cache_flags(struct integrity_iint_cache *iint, int func)
         case MODULE_CHECK:
                 iint->flags |= (IMA_MODULE_APPRAISED | IMA_APPRAISED);
                 break;
+        case FIRMWARE_CHECK:
+                iint->flags |= (IMA_FIRMWARE_APPRAISED | IMA_APPRAISED);
+                break;
         case FILE_CHECK:
         default:
                 iint->flags |= (IMA_FILE_APPRAISED | IMA_APPRAISED);
@@ -214,7 +222,7 @@ int ima_appraise_measurement(int func, struct integrity_iint_cache *iint,
                 hash_start = 1;
         case IMA_XATTR_DIGEST:
                 if (iint->flags & IMA_DIGSIG_REQUIRED) {
-                        cause = "IMA signature required";
+                        cause = "IMA-signature-required";
                         status = INTEGRITY_FAIL;
                         break;
                 }
diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
index ccd0ac8fa9a0..0bd732843fe7 100644
--- a/security/integrity/ima/ima_crypto.c
+++ b/security/integrity/ima/ima_crypto.c
@@ -16,6 +16,8 @@
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #include <linux/kernel.h>
+#include <linux/moduleparam.h>
+#include <linux/ratelimit.h>
 #include <linux/file.h>
 #include <linux/crypto.h>
 #include <linux/scatterlist.h>
@@ -25,7 +27,45 @@
 #include <crypto/hash_info.h>
 #include "ima.h"
 
+struct ahash_completion {
+        struct completion completion;
+        int err;
+};
+
+/* minimum file size for ahash use */
+static unsigned long ima_ahash_minsize;
+module_param_named(ahash_minsize, ima_ahash_minsize, ulong, 0644);
+MODULE_PARM_DESC(ahash_minsize, "Minimum file size for ahash use");
+
+/* default is 0 - 1 page. */
+static int ima_maxorder;
+static unsigned int ima_bufsize = PAGE_SIZE;
+
+static int param_set_bufsize(const char *val, const struct kernel_param *kp)
+{
+        unsigned long long size;
+        int order;
+
+        size = memparse(val, NULL);
+        order = get_order(size);
+        if (order >= MAX_ORDER)
+                return -EINVAL;
+        ima_maxorder = order;
+        ima_bufsize = PAGE_SIZE << order;
+        return 0;
+}
+
+static struct kernel_param_ops param_ops_bufsize = {
+        .set = param_set_bufsize,
+        .get = param_get_uint,
+};
+#define param_check_bufsize(name, p) __param_check(name, p, unsigned int)
+
+module_param_named(ahash_bufsize, ima_bufsize, bufsize, 0644);
+MODULE_PARM_DESC(ahash_bufsize, "Maximum ahash buffer size");
+
 static struct crypto_shash *ima_shash_tfm;
+static struct crypto_ahash *ima_ahash_tfm;
 
 /**
  * ima_kernel_read - read file content
@@ -93,9 +133,246 @@ static void ima_free_tfm(struct crypto_shash *tfm)
                 crypto_free_shash(tfm);
 }
 
-/*
- * Calculate the MD5/SHA1 file digest
+/**
+ * ima_alloc_pages() - Allocate contiguous pages.
+ * @max_size:       Maximum amount of memory to allocate.
+ * @allocated_size: Returned size of actual allocation.
+ * @last_warn:      Should the min_size allocation warn or not.
+ *
+ * Tries to do opportunistic allocation for memory first trying to allocate
+ * max_size amount of memory and then splitting that until zero order is
+ * reached. Allocation is tried without generating allocation warnings unless
+ * last_warn is set. Last_warn set affects only last allocation of zero order.
+ *
+ * By default, ima_maxorder is 0 and it is equivalent to kmalloc(GFP_KERNEL)
+ *
+ * Return pointer to allocated memory, or NULL on failure.
+ */
+static void *ima_alloc_pages(loff_t max_size, size_t *allocated_size,
+                             int last_warn)
+{
+        void *ptr;
+        int order = ima_maxorder;
+        gfp_t gfp_mask = __GFP_WAIT | __GFP_NOWARN | __GFP_NORETRY;
+
+        if (order)
+                order = min(get_order(max_size), order);
+
+        for (; order; order--) {
+                ptr = (void *)__get_free_pages(gfp_mask, order);
+                if (ptr) {
+                        *allocated_size = PAGE_SIZE << order;
+                        return ptr;
+                }
+        }
+
+        /* order is zero - one page */
+
+        gfp_mask = GFP_KERNEL;
+
+        if (!last_warn)
+                gfp_mask |= __GFP_NOWARN;
+
+        ptr = (void *)__get_free_pages(gfp_mask, 0);
+        if (ptr) {
+                *allocated_size = PAGE_SIZE;
+                return ptr;
+        }
+
+        *allocated_size = 0;
+        return NULL;
+}
+
+/**
+ * ima_free_pages() - Free pages allocated by ima_alloc_pages().
+ * @ptr:  Pointer to allocated pages.
+ * @size: Size of allocated buffer.
  */
+static void ima_free_pages(void *ptr, size_t size)
+{
+        if (!ptr)
+                return;
+        free_pages((unsigned long)ptr, get_order(size));
+}
+
+static struct crypto_ahash *ima_alloc_atfm(enum hash_algo algo)
+{
+        struct crypto_ahash *tfm = ima_ahash_tfm;
+        int rc;
+
+        if ((algo != ima_hash_algo && algo < HASH_ALGO__LAST) || !tfm) {
+                tfm = crypto_alloc_ahash(hash_algo_name[algo], 0, 0);
+                if (!IS_ERR(tfm)) {
+                        if (algo == ima_hash_algo)
+                                ima_ahash_tfm = tfm;
+                } else {
+                        rc = PTR_ERR(tfm);
+                        pr_err("Can not allocate %s (reason: %d)\n",
+                               hash_algo_name[algo], rc);
+                }
+        }
+        return tfm;
+}
+
+static void ima_free_atfm(struct crypto_ahash *tfm)
+{
+        if (tfm != ima_ahash_tfm)
+                crypto_free_ahash(tfm);
+}
+
+static void ahash_complete(struct crypto_async_request *req, int err)
+{
+        struct ahash_completion *res = req->data;
+
+        if (err == -EINPROGRESS)
+                return;
+        res->err = err;
+        complete(&res->completion);
+}
+
+static int ahash_wait(int err, struct ahash_completion *res)
+{
+        switch (err) {
+        case 0:
+                break;
+        case -EINPROGRESS:
+        case -EBUSY:
+                wait_for_completion(&res->completion);
+                reinit_completion(&res->completion);
+                err = res->err;
+                /* fall through */
+        default:
+                pr_crit_ratelimited("ahash calculation failed: err: %d\n", err);
+        }
+
+        return err;
+}
+
+static int ima_calc_file_hash_atfm(struct file *file,
+                                   struct ima_digest_data *hash,
+                                   struct crypto_ahash *tfm)
+{
+        loff_t i_size, offset;
+        char *rbuf[2] = { NULL, };
+        int rc, read = 0, rbuf_len, active = 0, ahash_rc = 0;
+        struct ahash_request *req;
+        struct scatterlist sg[1];
+        struct ahash_completion res;
+        size_t rbuf_size[2];
+
+        hash->length = crypto_ahash_digestsize(tfm);
+
+        req = ahash_request_alloc(tfm, GFP_KERNEL);
+        if (!req)
+                return -ENOMEM;
+
+        init_completion(&res.completion);
+        ahash_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG |
+                                   CRYPTO_TFM_REQ_MAY_SLEEP,
+                                   ahash_complete, &res);
+
+        rc = ahash_wait(crypto_ahash_init(req), &res);
+        if (rc)
+                goto out1;
+
+        i_size = i_size_read(file_inode(file));
+
+        if (i_size == 0)
+                goto out2;
+
+        /*
+         * Try to allocate maximum size of memory.
+         * Fail if even a single page cannot be allocated.
+         */
+        rbuf[0] = ima_alloc_pages(i_size, &rbuf_size[0], 1);
+        if (!rbuf[0]) {
+                rc = -ENOMEM;
+                goto out1;
+        }
+
+        /* Only allocate one buffer if that is enough. */
+        if (i_size > rbuf_size[0]) {
+                /*
+                 * Try to allocate secondary buffer. If that fails fallback to
+                 * using single buffering. Use previous memory allocation size
+                 * as baseline for possible allocation size.
+                 */
+                rbuf[1] = ima_alloc_pages(i_size - rbuf_size[0],
+                                          &rbuf_size[1], 0);
+        }
+
+        if (!(file->f_mode & FMODE_READ)) {
+                file->f_mode |= FMODE_READ;
+                read = 1;
+        }
+
+        for (offset = 0; offset < i_size; offset += rbuf_len) {
+                if (!rbuf[1] && offset) {
+                        /* Not using two buffers, and it is not the first
+                         * read/request, wait for the completion of the
+                         * previous ahash_update() request.
+                         */
+                        rc = ahash_wait(ahash_rc, &res);
+                        if (rc)
+                                goto out3;
+                }
+                /* read buffer */
+                rbuf_len = min_t(loff_t, i_size - offset, rbuf_size[active]);
+                rc = ima_kernel_read(file, offset, rbuf[active], rbuf_len);
+                if (rc != rbuf_len)
+                        goto out3;
+
+                if (rbuf[1] && offset) {
+                        /* Using two buffers, and it is not the first
+                         * read/request, wait for the completion of the
+                         * previous ahash_update() request.
+                         */
+                        rc = ahash_wait(ahash_rc, &res);
+                        if (rc)
+                                goto out3;
+                }
+
+                sg_init_one(&sg[0], rbuf[active], rbuf_len);
+                ahash_request_set_crypt(req, sg, NULL, rbuf_len);
+
+                ahash_rc = crypto_ahash_update(req);
+
+                if (rbuf[1])
+                        active = !active; /* swap buffers, if we use two */
+        }
+        /* wait for the last update request to complete */
+        rc = ahash_wait(ahash_rc, &res);
+out3:
+        if (read)
+                file->f_mode &= ~FMODE_READ;
+        ima_free_pages(rbuf[0], rbuf_size[0]);
+        ima_free_pages(rbuf[1], rbuf_size[1]);
+out2:
+        if (!rc) {
+                ahash_request_set_crypt(req, NULL, hash->digest, 0);
+                rc = ahash_wait(crypto_ahash_final(req), &res);
+        }
+out1:
+        ahash_request_free(req);
+        return rc;
+}
+
+static int ima_calc_file_ahash(struct file *file, struct ima_digest_data *hash)
+{
+        struct crypto_ahash *tfm;
+        int rc;
+
+        tfm = ima_alloc_atfm(hash->algo);
+        if (IS_ERR(tfm))
+                return PTR_ERR(tfm);
+
+        rc = ima_calc_file_hash_atfm(file, hash, tfm);
+
+        ima_free_atfm(tfm);
+
+        return rc;
+}
+
 static int ima_calc_file_hash_tfm(struct file *file,
                                   struct ima_digest_data *hash,
                                   struct crypto_shash *tfm)
@@ -156,7 +433,7 @@ out:
         return rc;
 }
 
-int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
+static int ima_calc_file_shash(struct file *file, struct ima_digest_data *hash)
 {
         struct crypto_shash *tfm;
         int rc;
@@ -173,6 +450,35 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
 }
 
 /*
+ * ima_calc_file_hash - calculate file hash
+ *
+ * Asynchronous hash (ahash) allows using HW acceleration for calculating
+ * a hash. ahash performance varies for different data sizes on different
+ * crypto accelerators. shash performance might be better for smaller files.
+ * The 'ima.ahash_minsize' module parameter allows specifying the best
+ * minimum file size for using ahash on the system.
+ *
+ * If the ima.ahash_minsize parameter is not specified, this function uses
+ * shash for the hash calculation.  If ahash fails, it falls back to using
+ * shash.
+ */
+int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
+{
+        loff_t i_size;
+        int rc;
+
+        i_size = i_size_read(file_inode(file));
+
+        if (ima_ahash_minsize && i_size >= ima_ahash_minsize) {
+                rc = ima_calc_file_ahash(file, hash);
+                if (!rc)
+                        return 0;
+        }
+
+        return ima_calc_file_shash(file, hash);
+}
+
+/*
  * Calculate the hash of template data
  */
 static int ima_calc_field_array_hash_tfm(struct ima_field_data *field_data,
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 09baa335ebc7..2917f980bf30 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -88,8 +88,6 @@ static void ima_rdwr_violation_check(struct file *file)
         if (!S_ISREG(inode->i_mode) || !ima_initialized)
                 return;
 
-        mutex_lock(&inode->i_mutex);    /* file metadata: permissions, xattr */
-
         if (mode & FMODE_WRITE) {
                 if (atomic_read(&inode->i_readcount) && IS_IMA(inode)) {
                         struct integrity_iint_cache *iint;
@@ -104,8 +102,6 @@ static void ima_rdwr_violation_check(struct file *file)
                         send_writers = true;
         }
 
-        mutex_unlock(&inode->i_mutex);
-
         if (!send_tomtou && !send_writers)
                 return;
 
@@ -163,7 +159,7 @@ static int process_measurement(struct file *file, const char *filename,
 {
         struct inode *inode = file_inode(file);
         struct integrity_iint_cache *iint;
-        struct ima_template_desc *template_desc = ima_template_desc_current();
+        struct ima_template_desc *template_desc;
         char *pathbuf = NULL;
         const char *pathname = NULL;
         int rc = -ENOMEM, action, must_appraise, _func;
@@ -207,6 +203,7 @@ static int process_measurement(struct file *file, const char *filename,
                 goto out_digsig;
         }
 
+        template_desc = ima_template_desc_current();
         if (strcmp(template_desc->name, IMA_TEMPLATE_IMA_NAME) == 0) {
                 if (action & IMA_APPRAISE_SUBMASK)
                         xattr_ptr = &xattr_value;
@@ -322,14 +319,31 @@ int ima_module_check(struct file *file)
         return process_measurement(file, NULL, MAY_EXEC, MODULE_CHECK);
 }
 
+int ima_fw_from_file(struct file *file, char *buf, size_t size)
+{
+        if (!file) {
+                if ((ima_appraise & IMA_APPRAISE_FIRMWARE) &&
+                    (ima_appraise & IMA_APPRAISE_ENFORCE))
+                        return -EACCES; /* INTEGRITY_UNKNOWN */
+                return 0;
+        }
+        return process_measurement(file, NULL, MAY_EXEC, FIRMWARE_CHECK);
+}
+
 static int __init init_ima(void)
 {
         int error;
 
         hash_setup(CONFIG_IMA_DEFAULT_HASH);
         error = ima_init();
-        if (!error)
-                ima_initialized = 1;
+        if (error)
+                goto out;
+
+        error = ima_init_keyring(INTEGRITY_KEYRING_IMA);
+        if (error)
+                goto out;
+        ima_initialized = 1;
+out:
         return error;
 }
 
diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index 40a7488f6721..07099a8bc283 100644
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -84,6 +84,7 @@ static struct ima_rule_entry default_rules[] = {
         {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ, .uid = GLOBAL_ROOT_UID,
          .flags = IMA_FUNC | IMA_MASK | IMA_UID},
         {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
+        {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
 };
 
 static struct ima_rule_entry default_appraise_rules[] = {
@@ -241,6 +242,8 @@ static int get_subaction(struct ima_rule_entry *rule, int func)
                 return IMA_BPRM_APPRAISE;
         case MODULE_CHECK:
                 return IMA_MODULE_APPRAISE;
+        case FIRMWARE_CHECK:
+                return IMA_FIRMWARE_APPRAISE;
         case FILE_CHECK:
         default:
                 return IMA_FILE_APPRAISE;
@@ -332,7 +335,7 @@ void __init ima_init_policy(void)
 void ima_update_policy(void)
 {
         static const char op[] = "policy_update";
-        const char *cause = "already exists";
+        const char *cause = "already-exists";
         int result = 1;
         int audit_info = 0;
 
@@ -486,6 +489,8 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
                                 entry->func = FILE_CHECK;
                         else if (strcmp(args[0].from, "MODULE_CHECK") == 0)
                                 entry->func = MODULE_CHECK;
+                        else if (strcmp(args[0].from, "FIRMWARE_CHECK") == 0)
+                                entry->func = FIRMWARE_CHECK;
                         else if ((strcmp(args[0].from, "FILE_MMAP") == 0)
                                 || (strcmp(args[0].from, "MMAP_CHECK") == 0))
                                 entry->func = MMAP_CHECK;
@@ -636,6 +641,8 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
                 result = -EINVAL;
         else if (entry->func == MODULE_CHECK)
                 ima_appraise |= IMA_APPRAISE_MODULES;
+        else if (entry->func == FIRMWARE_CHECK)
+                ima_appraise |= IMA_APPRAISE_FIRMWARE;
         audit_log_format(ab, "res=%d", !result);
         audit_log_end(ab);
         return result;
@@ -659,7 +666,7 @@ ssize_t ima_parse_add_rule(char *rule)
         /* Prevent installed policy from changing */
         if (ima_rules != &ima_default_rules) {
                 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
-                                    NULL, op, "already exists",
+                                    NULL, op, "already-exists",
                                     -EACCES, audit_info);
                 return -EACCES;
         }
@@ -685,7 +692,7 @@ ssize_t ima_parse_add_rule(char *rule)
         if (result) {
                 kfree(entry);
                 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
-                                    NULL, op, "invalid policy", result,
+                                    NULL, op, "invalid-policy", result,
                                     audit_info);
                 return result;
         }
diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index 33c0a70f6b15..19b8e314ca96 100644
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -46,10 +46,14 @@
 #define IMA_BPRM_APPRAISED      0x00002000
 #define IMA_MODULE_APPRAISE     0x00004000
 #define IMA_MODULE_APPRAISED    0x00008000
+#define IMA_FIRMWARE_APPRAISE   0x00010000
+#define IMA_FIRMWARE_APPRAISED  0x00020000
 #define IMA_APPRAISE_SUBMASK    (IMA_FILE_APPRAISE | IMA_MMAP_APPRAISE | \
-                                 IMA_BPRM_APPRAISE | IMA_MODULE_APPRAISE)
+                                 IMA_BPRM_APPRAISE | IMA_MODULE_APPRAISE | \
+                                 IMA_FIRMWARE_APPRAISE)
 #define IMA_APPRAISED_SUBMASK   (IMA_FILE_APPRAISED | IMA_MMAP_APPRAISED | \
-                                 IMA_BPRM_APPRAISED | IMA_MODULE_APPRAISED)
+                                 IMA_BPRM_APPRAISED | IMA_MODULE_APPRAISED | \
+                                 IMA_FIRMWARE_APPRAISED)
 
 enum evm_ima_xattr_type {
         IMA_XATTR_DIGEST = 0x01,
@@ -104,6 +108,7 @@ struct integrity_iint_cache {
         enum integrity_status ima_mmap_status:4;
         enum integrity_status ima_bprm_status:4;
         enum integrity_status ima_module_status:4;
+        enum integrity_status ima_firmware_status:4;
         enum integrity_status evm_status:4;
         struct ima_digest_data *ima_hash;
 };
@@ -124,6 +129,7 @@ struct integrity_iint_cache *integrity_iint_find(struct inode *inode);
 int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
                             const char *digest, int digestlen);
 
+int integrity_init_keyring(const unsigned int id);
 #else
 
 static inline int integrity_digsig_verify(const unsigned int id,
@@ -133,6 +139,10 @@ static inline int integrity_digsig_verify(const unsigned int id,
         return -EOPNOTSUPP;
 }
 
+static inline int integrity_init_keyring(const unsigned int id)
+{
+        return 0;
+}
 #endif /* CONFIG_INTEGRITY_SIGNATURE */
 
 #ifdef CONFIG_INTEGRITY_ASYMMETRIC_KEYS
diff --git a/security/keys/big_key.c b/security/keys/big_key.c
index 8137b27d641d..c2f91a0cf889 100644
--- a/security/keys/big_key.c
+++ b/security/keys/big_key.c
@@ -34,7 +34,9 @@ MODULE_LICENSE("GPL");
 struct key_type key_type_big_key = {
         .name                   = "big_key",
         .def_lookup_type        = KEYRING_SEARCH_LOOKUP_DIRECT,
-        .instantiate            = big_key_instantiate,
+        .preparse               = big_key_preparse,
+        .free_preparse          = big_key_free_preparse,
+        .instantiate            = generic_key_instantiate,
         .match                  = user_match,
         .revoke                 = big_key_revoke,
         .destroy                = big_key_destroy,
@@ -43,11 +45,11 @@ struct key_type key_type_big_key = {
 };
 
 /*
- * Instantiate a big key
+ * Preparse a big key
  */
-int big_key_instantiate(struct key *key, struct key_preparsed_payload *prep)
+int big_key_preparse(struct key_preparsed_payload *prep)
 {
-        struct path *path = (struct path *)&key->payload.data2;
+        struct path *path = (struct path *)&prep->payload;
         struct file *file;
         ssize_t written;
         size_t datalen = prep->datalen;
@@ -58,11 +60,9 @@ int big_key_instantiate(struct key *key, struct key_preparsed_payload *prep)
                 goto error;
 
         /* Set an arbitrary quota */
-        ret = key_payload_reserve(key, 16);
-        if (ret < 0)
-                goto error;
+        prep->quotalen = 16;
 
-        key->type_data.x[1] = datalen;
+        prep->type_data[1] = (void *)(unsigned long)datalen;
 
         if (datalen > BIG_KEY_FILE_THRESHOLD) {
                 /* Create a shmem file to store the data in.  This will permit the data
@@ -73,7 +73,7 @@ int big_key_instantiate(struct key *key, struct key_preparsed_payload *prep)
                 file = shmem_kernel_file_setup("", datalen, 0);
                 if (IS_ERR(file)) {
                         ret = PTR_ERR(file);
-                        goto err_quota;
+                        goto error;
                 }
 
                 written = kernel_write(file, prep->data, prep->datalen, 0);
@@ -93,24 +93,33 @@ int big_key_instantiate(struct key *key, struct key_preparsed_payload *prep)
         } else {
                 /* Just store the data in a buffer */
                 void *data = kmalloc(datalen, GFP_KERNEL);
-                if (!data) {
-                        ret = -ENOMEM;
-                        goto err_quota;
-                }
+                if (!data)
+                        return -ENOMEM;
 
-                key->payload.data = memcpy(data, prep->data, prep->datalen);
+                prep->payload[0] = memcpy(data, prep->data, prep->datalen);
         }
         return 0;
 
 err_fput:
         fput(file);
-err_quota:
-        key_payload_reserve(key, 0);
 error:
         return ret;
 }
 
 /*
+ * Clear preparsement.
+ */
+void big_key_free_preparse(struct key_preparsed_payload *prep)
+{
+        if (prep->datalen > BIG_KEY_FILE_THRESHOLD) {
+                struct path *path = (struct path *)&prep->payload;
+                path_put(path);
+        } else {
+                kfree(prep->payload[0]);
+        }
+}
+
+/*
  * dispose of the links from a revoked keyring
  * - called with the key sem write-locked
  */
diff --git a/security/keys/key.c b/security/keys/key.c
index 2048a110e7f1..b90a68c4e2c4 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -437,6 +437,11 @@ static int __key_instantiate_and_link(struct key *key,
                         /* disable the authorisation key */
                         if (authkey)
                                 key_revoke(authkey);
+
+                        if (prep->expiry != TIME_T_MAX) {
+                                key->expiry = prep->expiry;
+                                key_schedule_gc(prep->expiry + key_gc_delay);
+                        }
                 }
         }
 
@@ -479,6 +484,7 @@ int key_instantiate_and_link(struct key *key,
         prep.data = data;
         prep.datalen = datalen;
         prep.quotalen = key->type->def_datalen;
+        prep.expiry = TIME_T_MAX;
         if (key->type->preparse) {
                 ret = key->type->preparse(&prep);
                 if (ret < 0)
@@ -488,7 +494,7 @@ int key_instantiate_and_link(struct key *key,
         if (keyring) {
                 ret = __key_link_begin(keyring, &key->index_key, &edit);
                 if (ret < 0)
-                        goto error_free_preparse;
+                        goto error;
         }
 
         ret = __key_instantiate_and_link(key, &prep, keyring, authkey, &edit);
@@ -496,10 +502,9 @@ int key_instantiate_and_link(struct key *key,
         if (keyring)
                 __key_link_end(keyring, &key->index_key, edit);
 
-error_free_preparse:
+error:
         if (key->type->preparse)
                 key->type->free_preparse(&prep);
-error:
         return ret;
 }
 
@@ -811,11 +816,12 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
         prep.datalen = plen;
         prep.quotalen = index_key.type->def_datalen;
         prep.trusted = flags & KEY_ALLOC_TRUSTED;
+        prep.expiry = TIME_T_MAX;
         if (index_key.type->preparse) {
                 ret = index_key.type->preparse(&prep);
                 if (ret < 0) {
                         key_ref = ERR_PTR(ret);
-                        goto error_put_type;
+                        goto error_free_prep;
                 }
                 if (!index_key.description)
                         index_key.description = prep.description;
@@ -941,6 +947,7 @@ int key_update(key_ref_t key_ref, const void *payload, size_t plen)
         prep.data = payload;
         prep.datalen = plen;
         prep.quotalen = key->type->def_datalen;
+        prep.expiry = TIME_T_MAX;
         if (key->type->preparse) {
                 ret = key->type->preparse(&prep);
                 if (ret < 0)
@@ -956,9 +963,9 @@ int key_update(key_ref_t key_ref, const void *payload, size_t plen)
 
         up_write(&key->sem);
 
+error:
         if (key->type->preparse)
                 key->type->free_preparse(&prep);
-error:
         return ret;
 }
 EXPORT_SYMBOL(key_update);
@@ -1024,6 +1031,38 @@ void key_invalidate(struct key *key)
 EXPORT_SYMBOL(key_invalidate);
 
 /**
+ * generic_key_instantiate - Simple instantiation of a key from preparsed data
+ * @key: The key to be instantiated
+ * @prep: The preparsed data to load.
+ *
+ * Instantiate a key from preparsed data.  We assume we can just copy the data
+ * in directly and clear the old pointers.
+ *
+ * This can be pointed to directly by the key type instantiate op pointer.
+ */
+int generic_key_instantiate(struct key *key, struct key_preparsed_payload *prep)
+{
+        int ret;
+
+        pr_devel("==>%s()\n", __func__);
+
+        ret = key_payload_reserve(key, prep->quotalen);
+        if (ret == 0) {
+                key->type_data.p[0] = prep->type_data[0];
+                key->type_data.p[1] = prep->type_data[1];
+                rcu_assign_keypointer(key, prep->payload[0]);
+                key->payload.data2[1] = prep->payload[1];
+                prep->type_data[0] = NULL;
+                prep->type_data[1] = NULL;
+                prep->payload[0] = NULL;
+                prep->payload[1] = NULL;
+        }
+        pr_devel("<==%s() = %d\n", __func__, ret);
+        return ret;
+}
+EXPORT_SYMBOL(generic_key_instantiate);
+
+/**
  * register_key_type - Register a type of key.
  * @ktype: The new key type.
  *
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index cd5bd0cef25d..e26f860e5f2e 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -37,8 +37,6 @@ static int key_get_type_from_user(char *type,
                 return ret;
         if (ret == 0 || ret >= len)
                 return -EINVAL;
-        if (type[0] == '.')
-                return -EPERM;
         type[len - 1] = '\0';
         return 0;
 }
@@ -86,6 +84,10 @@ SYSCALL_DEFINE5(add_key, const char __user *, _type,
                 if (!*description) {
                         kfree(description);
                         description = NULL;
+                } else if ((description[0] == '.') &&
+                           (strncmp(type, "keyring", 7) == 0)) {
+                        ret = -EPERM;
+                        goto error2;
                 }
         }
 
@@ -404,12 +406,25 @@ long keyctl_invalidate_key(key_serial_t id)
         key_ref = lookup_user_key(id, 0, KEY_NEED_SEARCH);
         if (IS_ERR(key_ref)) {
                 ret = PTR_ERR(key_ref);
+
+                /* Root is permitted to invalidate certain special keys */
+                if (capable(CAP_SYS_ADMIN)) {
+                        key_ref = lookup_user_key(id, 0, 0);
+                        if (IS_ERR(key_ref))
+                                goto error;
+                        if (test_bit(KEY_FLAG_ROOT_CAN_INVAL,
+                                     &key_ref_to_ptr(key_ref)->flags))
+                                goto invalidate;
+                        goto error_put;
+                }
+
                 goto error;
         }
 
+invalidate:
         key_invalidate(key_ref_to_ptr(key_ref));
         ret = 0;
-
+error_put:
         key_ref_put(key_ref);
 error:
         kleave(" = %ld", ret);
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index 9cf2575f0d97..8314a7d2104d 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -73,6 +73,8 @@ static inline unsigned keyring_hash(const char *desc)
  * can be treated as ordinary keys in addition to having their own special
  * operations.
  */
+static int keyring_preparse(struct key_preparsed_payload *prep);
+static void keyring_free_preparse(struct key_preparsed_payload *prep);
 static int keyring_instantiate(struct key *keyring,
                                struct key_preparsed_payload *prep);
 static void keyring_revoke(struct key *keyring);
@@ -84,6 +86,8 @@ static long keyring_read(const struct key *keyring,
 struct key_type key_type_keyring = {
         .name           = "keyring",
         .def_datalen    = 0,
+        .preparse       = keyring_preparse,
+        .free_preparse  = keyring_free_preparse,
         .instantiate    = keyring_instantiate,
         .match          = user_match,
         .revoke         = keyring_revoke,
@@ -123,6 +127,21 @@ static void keyring_publish_name(struct key *keyring)
 }
 
 /*
+ * Preparse a keyring payload
+ */
+static int keyring_preparse(struct key_preparsed_payload *prep)
+{
+        return prep->datalen != 0 ? -EINVAL : 0;
+}
+
+/*
+ * Free a preparse of a user defined key payload
+ */
+static void keyring_free_preparse(struct key_preparsed_payload *prep)
+{
+}
+
+/*
  * Initialise a keyring.
  *
  * Returns 0 on success, -EINVAL if given any data.
@@ -130,17 +149,10 @@ static void keyring_publish_name(struct key *keyring)
 static int keyring_instantiate(struct key *keyring,
                                struct key_preparsed_payload *prep)
 {
-        int ret;
-
-        ret = -EINVAL;
-        if (prep->datalen == 0) {
-                assoc_array_init(&keyring->keys);
-                /* make the keyring available by name if it has one */
-                keyring_publish_name(keyring);
-                ret = 0;
-        }
-
-        return ret;
+        assoc_array_init(&keyring->keys);
+        /* make the keyring available by name if it has one */
+        keyring_publish_name(keyring);
+        return 0;
 }
 
 /*
diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
index 7495a93b4b90..842e6f410d50 100644
--- a/security/keys/request_key_auth.c
+++ b/security/keys/request_key_auth.c
@@ -20,6 +20,8 @@
 #include "internal.h"
 #include <keys/user-type.h>
 
+static int request_key_auth_preparse(struct key_preparsed_payload *);
+static void request_key_auth_free_preparse(struct key_preparsed_payload *);
 static int request_key_auth_instantiate(struct key *,
                                         struct key_preparsed_payload *);
 static void request_key_auth_describe(const struct key *, struct seq_file *);
@@ -33,6 +35,8 @@ static long request_key_auth_read(const struct key *, char __user *, size_t);
 struct key_type key_type_request_key_auth = {
         .name           = ".request_key_auth",
         .def_datalen    = sizeof(struct request_key_auth),
+        .preparse       = request_key_auth_preparse,
+        .free_preparse  = request_key_auth_free_preparse,
         .instantiate    = request_key_auth_instantiate,
         .describe       = request_key_auth_describe,
         .revoke         = request_key_auth_revoke,
@@ -40,6 +44,15 @@ struct key_type key_type_request_key_auth = {
         .read           = request_key_auth_read,
 };
 
+int request_key_auth_preparse(struct key_preparsed_payload *prep)
+{
+        return 0;
+}
+
+void request_key_auth_free_preparse(struct key_preparsed_payload *prep)
+{
+}
+
 /*
  * Instantiate a request-key authorisation key.
  */
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
index faa2caeb593f..eee340011f2b 100644
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -27,7 +27,9 @@ static int logon_vet_description(const char *desc);
 struct key_type key_type_user = {
         .name                   = "user",
         .def_lookup_type        = KEYRING_SEARCH_LOOKUP_DIRECT,
-        .instantiate            = user_instantiate,
+        .preparse               = user_preparse,
+        .free_preparse          = user_free_preparse,
+        .instantiate            = generic_key_instantiate,
         .update                 = user_update,
         .match                  = user_match,
         .revoke                 = user_revoke,
@@ -47,7 +49,9 @@ EXPORT_SYMBOL_GPL(key_type_user);
 struct key_type key_type_logon = {
         .name                   = "logon",
         .def_lookup_type        = KEYRING_SEARCH_LOOKUP_DIRECT,
-        .instantiate            = user_instantiate,
+        .preparse               = user_preparse,
+        .free_preparse          = user_free_preparse,
+        .instantiate            = generic_key_instantiate,
         .update                 = user_update,
         .match                  = user_match,
         .revoke                 = user_revoke,
@@ -58,38 +62,37 @@ struct key_type key_type_logon = {
 EXPORT_SYMBOL_GPL(key_type_logon);
 
 /*
- * instantiate a user defined key
+ * Preparse a user defined key payload
  */
-int user_instantiate(struct key *key, struct key_preparsed_payload *prep)
+int user_preparse(struct key_preparsed_payload *prep)
 {
         struct user_key_payload *upayload;
         size_t datalen = prep->datalen;
-        int ret;
 
-        ret = -EINVAL;
         if (datalen <= 0 || datalen > 32767 || !prep->data)
-                goto error;
-
-        ret = key_payload_reserve(key, datalen);
-        if (ret < 0)
-                goto error;
+                return -EINVAL;
 
-        ret = -ENOMEM;
         upayload = kmalloc(sizeof(*upayload) + datalen, GFP_KERNEL);
         if (!upayload)
-                goto error;
+                return -ENOMEM;
 
         /* attach the data */
+        prep->quotalen = datalen;
+        prep->payload[0] = upayload;
         upayload->datalen = datalen;
         memcpy(upayload->data, prep->data, datalen);
-        rcu_assign_keypointer(key, upayload);
-        ret = 0;
-
-error:
-        return ret;
+        return 0;
 }
+EXPORT_SYMBOL_GPL(user_preparse);
 
-EXPORT_SYMBOL_GPL(user_instantiate);
+/*
+ * Free a preparse of a user defined key payload
+ */
+void user_free_preparse(struct key_preparsed_payload *prep)
+{
+        kfree(prep->payload[0]);
+}
+EXPORT_SYMBOL_GPL(user_free_preparse);
 
 /*
  * update a user defined key
diff --git a/security/security.c b/security/security.c
index 31614e9e96e5..e41b1a8d7644 100644
--- a/security/security.c
+++ b/security/security.c
@@ -845,6 +845,17 @@ int security_kernel_create_files_as(struct cred *new, struct inode *inode)
         return security_ops->kernel_create_files_as(new, inode);
 }
 
+int security_kernel_fw_from_file(struct file *file, char *buf, size_t size)
+{
+        int ret;
+
+        ret = security_ops->kernel_fw_from_file(file, buf, size);
+        if (ret)
+                return ret;
+        return ima_fw_from_file(file, buf, size);
+}
+EXPORT_SYMBOL_GPL(security_kernel_fw_from_file);
+
 int security_kernel_module_request(char *kmod_name)
 {
         return security_ops->kernel_module_request(kmod_name);
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 83d06db34d03..b0e940497e23 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -161,6 +161,17 @@ static int selinux_peerlbl_enabled(void)
         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 }
 
+static int selinux_netcache_avc_callback(u32 event)
+{
+        if (event == AVC_CALLBACK_RESET) {
+                sel_netif_flush();
+                sel_netnode_flush();
+                sel_netport_flush();
+                synchronize_net();
+        }
+        return 0;
+}
+
 /*
  * initialise the security for the init task
  */
@@ -5993,6 +6004,9 @@ static __init int selinux_init(void)
         if (register_security(&selinux_ops))
                 panic("SELinux: Unable to register with kernel.\n");
 
+        if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
+                panic("SELinux: Unable to register AVC netcache callback\n");
+
         if (selinux_enforcing)
                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
         else
diff --git a/security/selinux/include/netif.h b/security/selinux/include/netif.h
index 43d507242b42..57c6eae81eac 100644
--- a/security/selinux/include/netif.h
+++ b/security/selinux/include/netif.h
@@ -17,6 +17,8 @@
 #ifndef _SELINUX_NETIF_H_
 #define _SELINUX_NETIF_H_
 
+void sel_netif_flush(void);
+
 int sel_netif_sid(int ifindex, u32 *sid);
 
 #endif  /* _SELINUX_NETIF_H_ */
diff --git a/security/selinux/include/netnode.h b/security/selinux/include/netnode.h
index df7a5ed6c694..937668dd3024 100644
--- a/security/selinux/include/netnode.h
+++ b/security/selinux/include/netnode.h
@@ -27,6 +27,8 @@
 #ifndef _SELINUX_NETNODE_H
 #define _SELINUX_NETNODE_H
 
+void sel_netnode_flush(void);
+
 int sel_netnode_sid(void *addr, u16 family, u32 *sid);
 
 #endif
diff --git a/security/selinux/include/netport.h b/security/selinux/include/netport.h
index 4d965b83d735..d1ce896b2cb0 100644
--- a/security/selinux/include/netport.h
+++ b/security/selinux/include/netport.h
@@ -26,6 +26,8 @@
 #ifndef _SELINUX_NETPORT_H
 #define _SELINUX_NETPORT_H
 
+void sel_netport_flush(void);
+
 int sel_netport_sid(u8 protocol, u16 pnum, u32 *sid);
 
 #endif
diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
index ce7852cf526b..d1e0b239b602 100644
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
@@ -8,6 +8,7 @@
 #ifndef _SELINUX_SECURITY_H_
 #define _SELINUX_SECURITY_H_
 
+#include <linux/compiler.h>
 #include <linux/dcache.h>
 #include <linux/magic.h>
 #include <linux/types.h>
@@ -220,7 +221,7 @@ struct selinux_kernel_status {
         /*
          * The version > 0 supports above members.
          */
-} __attribute__((packed));
+} __packed;
 
 extern void selinux_status_update_setenforce(int enforcing);
 extern void selinux_status_update_policyload(int seqno);
diff --git a/security/selinux/netif.c b/security/selinux/netif.c
index 694e9e43855f..3c3de4ca0ebc 100644
--- a/security/selinux/netif.c
+++ b/security/selinux/netif.c
@@ -240,7 +240,7 @@ static void sel_netif_kill(int ifindex)
  * Remove all entries from the network interface table.
  *
  */
-static void sel_netif_flush(void)
+void sel_netif_flush(void)
 {
         int idx;
         struct sel_netif *netif;
@@ -252,15 +252,6 @@ static void sel_netif_flush(void)
         spin_unlock_bh(&sel_netif_lock);
 }
 
-static int sel_netif_avc_callback(u32 event)
-{
-        if (event == AVC_CALLBACK_RESET) {
-                sel_netif_flush();
-                synchronize_net();
-        }
-        return 0;
-}
-
 static int sel_netif_netdev_notifier_handler(struct notifier_block *this,
                                              unsigned long event, void *ptr)
 {
@@ -291,10 +282,6 @@ static __init int sel_netif_init(void)
 
         register_netdevice_notifier(&sel_netif_netdev_notifier);
 
-        err = avc_add_callback(sel_netif_avc_callback, AVC_CALLBACK_RESET);
-        if (err)
-                panic("avc_add_callback() failed, error %d\n", err);
-
         return err;
 }
 
diff --git a/security/selinux/netnode.c b/security/selinux/netnode.c
index 03a72c32afd7..ddf315260839 100644
--- a/security/selinux/netnode.c
+++ b/security/selinux/netnode.c
@@ -283,7 +283,7 @@ int sel_netnode_sid(void *addr, u16 family, u32 *sid)
  * Remove all entries from the network address table.
  *
  */
-static void sel_netnode_flush(void)
+void sel_netnode_flush(void)
 {
         unsigned int idx;
         struct sel_netnode *node, *node_tmp;
@@ -300,15 +300,6 @@ static void sel_netnode_flush(void)
         spin_unlock_bh(&sel_netnode_lock);
 }
 
-static int sel_netnode_avc_callback(u32 event)
-{
-        if (event == AVC_CALLBACK_RESET) {
-                sel_netnode_flush();
-                synchronize_net();
-        }
-        return 0;
-}
-
 static __init int sel_netnode_init(void)
 {
         int iter;
@@ -322,10 +313,6 @@ static __init int sel_netnode_init(void)
                 sel_netnode_hash[iter].size = 0;
         }
 
-        ret = avc_add_callback(sel_netnode_avc_callback, AVC_CALLBACK_RESET);
-        if (ret != 0)
-                panic("avc_add_callback() failed, error %d\n", ret);
-
         return ret;
 }
 
diff --git a/security/selinux/netport.c b/security/selinux/netport.c
index d35379781c2c..73ac6784d091 100644
--- a/security/selinux/netport.c
+++ b/security/selinux/netport.c
@@ -217,7 +217,7 @@ int sel_netport_sid(u8 protocol, u16 pnum, u32 *sid)
  * Remove all entries from the network address table.
  *
  */
-static void sel_netport_flush(void)
+void sel_netport_flush(void)
 {
         unsigned int idx;
         struct sel_netport *port, *port_tmp;
@@ -234,15 +234,6 @@ static void sel_netport_flush(void)
         spin_unlock_bh(&sel_netport_lock);
 }
 
-static int sel_netport_avc_callback(u32 event)
-{
-        if (event == AVC_CALLBACK_RESET) {
-                sel_netport_flush();
-                synchronize_net();
-        }
-        return 0;
-}
-
 static __init int sel_netport_init(void)
 {
         int iter;
@@ -256,10 +247,6 @@ static __init int sel_netport_init(void)
                 sel_netport_hash[iter].size = 0;
         }
 
-        ret = avc_add_callback(sel_netport_avc_callback, AVC_CALLBACK_RESET);
-        if (ret != 0)
-                panic("avc_add_callback() failed, error %d\n", ret);
-
         return ret;
 }
 
diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c
index 377d148e7157..62c6773be0b7 100644
--- a/security/selinux/ss/conditional.c
+++ b/security/selinux/ss/conditional.c
@@ -402,19 +402,14 @@ static int cond_read_node(struct policydb *p, struct cond_node *node, void *fp)
         int rc;
         struct cond_expr *expr = NULL, *last = NULL;
 
-        rc = next_entry(buf, fp, sizeof(u32));
+        rc = next_entry(buf, fp, sizeof(u32) * 2);
         if (rc)
-                return rc;
+                goto err;
 
         node->cur_state = le32_to_cpu(buf[0]);
 
-        len = 0;
-        rc = next_entry(buf, fp, sizeof(u32));
-        if (rc)
-                return rc;
-
         /* expr */
-        len = le32_to_cpu(buf[0]);
+        len = le32_to_cpu(buf[1]);
 
         for (i = 0; i < len; i++) {
                 rc = next_entry(buf, fp, sizeof(u32) * 2);
diff --git a/security/selinux/ss/ebitmap.c b/security/selinux/ss/ebitmap.c
index 820313a04d49..afe6a269ec17 100644
--- a/security/selinux/ss/ebitmap.c
+++ b/security/selinux/ss/ebitmap.c
@@ -86,51 +86,36 @@ int ebitmap_cpy(struct ebitmap *dst, struct ebitmap *src)
  *
  */
 int ebitmap_netlbl_export(struct ebitmap *ebmap,
-                          struct netlbl_lsm_secattr_catmap **catmap)
+                          struct netlbl_lsm_catmap **catmap)
 {
         struct ebitmap_node *e_iter = ebmap->node;
-        struct netlbl_lsm_secattr_catmap *c_iter;
-        u32 cmap_idx, cmap_sft;
-        int i;
-
-        /* NetLabel's NETLBL_CATMAP_MAPTYPE is defined as an array of u64,
-         * however, it is not always compatible with an array of unsigned long
-         * in ebitmap_node.
-         * In addition, you should pay attention the following implementation
-         * assumes unsigned long has a width equal with or less than 64-bit.
-         */
+        unsigned long e_map;
+        u32 offset;
+        unsigned int iter;
+        int rc;
 
         if (e_iter == NULL) {
                 *catmap = NULL;
                 return 0;
         }
 
-        c_iter = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
-        if (c_iter == NULL)
-                return -ENOMEM;
-        *catmap = c_iter;
-        c_iter->startbit = e_iter->startbit & ~(NETLBL_CATMAP_SIZE - 1);
+        if (*catmap != NULL)
+                netlbl_catmap_free(*catmap);
+        *catmap = NULL;
 
         while (e_iter) {
-                for (i = 0; i < EBITMAP_UNIT_NUMS; i++) {
-                        unsigned int delta, e_startbit, c_endbit;
-
-                        e_startbit = e_iter->startbit + i * EBITMAP_UNIT_SIZE;
-                        c_endbit = c_iter->startbit + NETLBL_CATMAP_SIZE;
-                        if (e_startbit >= c_endbit) {
-                                c_iter->next
-                                  = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
-                                if (c_iter->next == NULL)
+                offset = e_iter->startbit;
+                for (iter = 0; iter < EBITMAP_UNIT_NUMS; iter++) {
+                        e_map = e_iter->maps[iter];
+                        if (e_map != 0) {
+                                rc = netlbl_catmap_setlong(catmap,
+                                                           offset,
+                                                           e_map,
+                                                           GFP_ATOMIC);
+                                if (rc != 0)
                                         goto netlbl_export_failure;
-                                c_iter = c_iter->next;
-                                c_iter->startbit
-                                  = e_startbit & ~(NETLBL_CATMAP_SIZE - 1);
                         }
-                        delta = e_startbit - c_iter->startbit;
-                        cmap_idx = delta / NETLBL_CATMAP_MAPSIZE;
-                        cmap_sft = delta % NETLBL_CATMAP_MAPSIZE;
-                        c_iter->bitmap[cmap_idx]
-                                |= e_iter->maps[i] << cmap_sft;
+                        offset += EBITMAP_UNIT_SIZE;
                 }
                 e_iter = e_iter->next;
         }
@@ -138,7 +123,7 @@ int ebitmap_netlbl_export(struct ebitmap *ebmap,
         return 0;
 
 netlbl_export_failure:
-        netlbl_secattr_catmap_free(*catmap);
+        netlbl_catmap_free(*catmap);
         return -ENOMEM;
 }
 
@@ -153,58 +138,44 @@ netlbl_export_failure:
  *
  */
 int ebitmap_netlbl_import(struct ebitmap *ebmap,
-                          struct netlbl_lsm_secattr_catmap *catmap)
+                          struct netlbl_lsm_catmap *catmap)
 {
+        int rc;
         struct ebitmap_node *e_iter = NULL;
-        struct ebitmap_node *emap_prev = NULL;
-        struct netlbl_lsm_secattr_catmap *c_iter = catmap;
-        u32 c_idx, c_pos, e_idx, e_sft;
-
-        /* NetLabel's NETLBL_CATMAP_MAPTYPE is defined as an array of u64,
-         * however, it is not always compatible with an array of unsigned long
-         * in ebitmap_node.
-         * In addition, you should pay attention the following implementation
-         * assumes unsigned long has a width equal with or less than 64-bit.
-         */
-
-        do {
-                for (c_idx = 0; c_idx < NETLBL_CATMAP_MAPCNT; c_idx++) {
-                        unsigned int delta;
-                        u64 map = c_iter->bitmap[c_idx];
-
-                        if (!map)
-                                continue;
+        struct ebitmap_node *e_prev = NULL;
+        u32 offset = 0, idx;
+        unsigned long bitmap;
+
+        for (;;) {
+                rc = netlbl_catmap_getlong(catmap, &offset, &bitmap);
+                if (rc < 0)
+                        goto netlbl_import_failure;
+                if (offset == (u32)-1)
+                        return 0;
 
-                        c_pos = c_iter->startbit
-                                + c_idx * NETLBL_CATMAP_MAPSIZE;
-                        if (!e_iter
-                            || c_pos >= e_iter->startbit + EBITMAP_SIZE) {
-                                e_iter = kzalloc(sizeof(*e_iter), GFP_ATOMIC);
-                                if (!e_iter)
-                                        goto netlbl_import_failure;
-                                e_iter->startbit
-                                        = c_pos - (c_pos % EBITMAP_SIZE);
-                                if (emap_prev == NULL)
-                                        ebmap->node = e_iter;
-                                else
-                                        emap_prev->next = e_iter;
-                                emap_prev = e_iter;
-                        }
-                        delta = c_pos - e_iter->startbit;
-                        e_idx = delta / EBITMAP_UNIT_SIZE;
-                        e_sft = delta % EBITMAP_UNIT_SIZE;
-                        while (map) {
-                                e_iter->maps[e_idx++] |= map & (-1UL);
-                                map = EBITMAP_SHIFT_UNIT_SIZE(map);
-                        }
+                if (e_iter == NULL ||
+                    offset >= e_iter->startbit + EBITMAP_SIZE) {
+                        e_prev = e_iter;
+                        e_iter = kzalloc(sizeof(*e_iter), GFP_ATOMIC);
+                        if (e_iter == NULL)
+                                goto netlbl_import_failure;
+                        e_iter->startbit = offset & ~(EBITMAP_SIZE - 1);
+                        if (e_prev == NULL)
+                                ebmap->node = e_iter;
+                        else
+                                e_prev->next = e_iter;
+                        ebmap->highbit = e_iter->startbit + EBITMAP_SIZE;
                 }
-                c_iter = c_iter->next;
-        } while (c_iter);
-        if (e_iter != NULL)
-                ebmap->highbit = e_iter->startbit + EBITMAP_SIZE;
-        else
-                ebitmap_destroy(ebmap);
 
+                /* offset will always be aligned to an unsigned long */
+                idx = EBITMAP_NODE_INDEX(e_iter, offset);
+                e_iter->maps[idx] = bitmap;
+
+                /* next */
+                offset += EBITMAP_UNIT_SIZE;
+        }
+
+        /* NOTE: we should never reach this return */
         return 0;
 
 netlbl_import_failure:
diff --git a/security/selinux/ss/ebitmap.h b/security/selinux/ss/ebitmap.h
index 712c8a7b8e8b..9637b8c71085 100644
--- a/security/selinux/ss/ebitmap.h
+++ b/security/selinux/ss/ebitmap.h
@@ -132,17 +132,17 @@ int ebitmap_write(struct ebitmap *e, void *fp);
 
 #ifdef CONFIG_NETLABEL
 int ebitmap_netlbl_export(struct ebitmap *ebmap,
-                          struct netlbl_lsm_secattr_catmap **catmap);
+                          struct netlbl_lsm_catmap **catmap);
 int ebitmap_netlbl_import(struct ebitmap *ebmap,
-                          struct netlbl_lsm_secattr_catmap *catmap);
+                          struct netlbl_lsm_catmap *catmap);
 #else
 static inline int ebitmap_netlbl_export(struct ebitmap *ebmap,
-                                struct netlbl_lsm_secattr_catmap **catmap)
+                                        struct netlbl_lsm_catmap **catmap)
 {
         return -ENOMEM;
 }
 static inline int ebitmap_netlbl_import(struct ebitmap *ebmap,
-                                struct netlbl_lsm_secattr_catmap *catmap)
+                                        struct netlbl_lsm_catmap *catmap)
 {
         return -ENOMEM;
 }
diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index 9c5cdc2caaef..bc2a586f095c 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -1080,6 +1080,26 @@ out:
  * binary representation file.
  */
 
+static int str_read(char **strp, gfp_t flags, void *fp, u32 len)
+{
+        int rc;
+        char *str;
+
+        str = kmalloc(len + 1, flags);
+        if (!str)
+                return -ENOMEM;
+
+        /* it's expected the caller should free the str */
+        *strp = str;
+
+        rc = next_entry(str, fp, len);
+        if (rc)
+                return rc;
+
+        str[len] = '\0';
+        return 0;
+}
+
 static int perm_read(struct policydb *p, struct hashtab *h, void *fp)
 {
         char *key = NULL;
@@ -1100,15 +1120,9 @@ static int perm_read(struct policydb *p, struct hashtab *h, void *fp)
         len = le32_to_cpu(buf[0]);
         perdatum->value = le32_to_cpu(buf[1]);
 
-        rc = -ENOMEM;
-        key = kmalloc(len + 1, GFP_KERNEL);
-        if (!key)
-                goto bad;
-
-        rc = next_entry(key, fp, len);
+        rc = str_read(&key, GFP_KERNEL, fp, len);
         if (rc)
                 goto bad;
-        key[len] = '\0';
 
         rc = hashtab_insert(h, key, perdatum);
         if (rc)
@@ -1146,15 +1160,9 @@ static int common_read(struct policydb *p, struct hashtab *h, void *fp)
         comdatum->permissions.nprim = le32_to_cpu(buf[2]);
         nel = le32_to_cpu(buf[3]);
 
-        rc = -ENOMEM;
-        key = kmalloc(len + 1, GFP_KERNEL);
-        if (!key)
-                goto bad;
-
-        rc = next_entry(key, fp, len);
+        rc = str_read(&key, GFP_KERNEL, fp, len);
         if (rc)
                 goto bad;
-        key[len] = '\0';
 
         for (i = 0; i < nel; i++) {
                 rc = perm_read(p, comdatum->permissions.table, fp);
@@ -1321,25 +1329,14 @@ static int class_read(struct policydb *p, struct hashtab *h, void *fp)
 
         ncons = le32_to_cpu(buf[5]);
 
-        rc = -ENOMEM;
-        key = kmalloc(len + 1, GFP_KERNEL);
-        if (!key)
-                goto bad;
-
-        rc = next_entry(key, fp, len);
+        rc = str_read(&key, GFP_KERNEL, fp, len);
         if (rc)
                 goto bad;
-        key[len] = '\0';
 
         if (len2) {
-                rc = -ENOMEM;
-                cladatum->comkey = kmalloc(len2 + 1, GFP_KERNEL);
-                if (!cladatum->comkey)
-                        goto bad;
-                rc = next_entry(cladatum->comkey, fp, len2);
+                rc = str_read(&cladatum->comkey, GFP_KERNEL, fp, len2);
                 if (rc)
                         goto bad;
-                cladatum->comkey[len2] = '\0';
 
                 rc = -EINVAL;
                 cladatum->comdatum = hashtab_search(p->p_commons.table, cladatum->comkey);
@@ -1422,15 +1419,9 @@ static int role_read(struct policydb *p, struct hashtab *h, void *fp)
         if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)
                 role->bounds = le32_to_cpu(buf[2]);
 
-        rc = -ENOMEM;
-        key = kmalloc(len + 1, GFP_KERNEL);
-        if (!key)
-                goto bad;
-
-        rc = next_entry(key, fp, len);
+        rc = str_read(&key, GFP_KERNEL, fp, len);
         if (rc)
                 goto bad;
-        key[len] = '\0';
 
         rc = ebitmap_read(&role->dominates, fp);
         if (rc)
@@ -1495,14 +1486,9 @@ static int type_read(struct policydb *p, struct hashtab *h, void *fp)
                 typdatum->primary = le32_to_cpu(buf[2]);
         }
 
-        rc = -ENOMEM;
-        key = kmalloc(len + 1, GFP_KERNEL);
-        if (!key)
-                goto bad;
-        rc = next_entry(key, fp, len);
+        rc = str_read(&key, GFP_KERNEL, fp, len);
         if (rc)
                 goto bad;
-        key[len] = '\0';
 
         rc = hashtab_insert(h, key, typdatum);
         if (rc)
@@ -1565,14 +1551,9 @@ static int user_read(struct policydb *p, struct hashtab *h, void *fp)
         if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)
                 usrdatum->bounds = le32_to_cpu(buf[2]);
 
-        rc = -ENOMEM;
-        key = kmalloc(len + 1, GFP_KERNEL);
-        if (!key)
-                goto bad;
-        rc = next_entry(key, fp, len);
+        rc = str_read(&key, GFP_KERNEL, fp, len);
         if (rc)
                 goto bad;
-        key[len] = '\0';
 
         rc = ebitmap_read(&usrdatum->roles, fp);
         if (rc)
@@ -1616,14 +1597,9 @@ static int sens_read(struct policydb *p, struct hashtab *h, void *fp)
         len = le32_to_cpu(buf[0]);
         levdatum->isalias = le32_to_cpu(buf[1]);
 
-        rc = -ENOMEM;
-        key = kmalloc(len + 1, GFP_ATOMIC);
-        if (!key)
-                goto bad;
-        rc = next_entry(key, fp, len);
+        rc = str_read(&key, GFP_ATOMIC, fp, len);
         if (rc)
                 goto bad;
-        key[len] = '\0';
 
         rc = -ENOMEM;
         levdatum->level = kmalloc(sizeof(struct mls_level), GFP_ATOMIC);
@@ -1664,14 +1640,9 @@ static int cat_read(struct policydb *p, struct hashtab *h, void *fp)
         catdatum->value = le32_to_cpu(buf[1]);
         catdatum->isalias = le32_to_cpu(buf[2]);
 
-        rc = -ENOMEM;
-        key = kmalloc(len + 1, GFP_ATOMIC);
-        if (!key)
-                goto bad;
-        rc = next_entry(key, fp, len);
+        rc = str_read(&key, GFP_ATOMIC, fp, len);
         if (rc)
                 goto bad;
-        key[len] = '\0';
 
         rc = hashtab_insert(h, key, catdatum);
         if (rc)
@@ -1968,18 +1939,12 @@ static int filename_trans_read(struct policydb *p, void *fp)
                         goto out;
                 len = le32_to_cpu(buf[0]);
 
-                rc = -ENOMEM;
-                name = kmalloc(len + 1, GFP_KERNEL);
-                if (!name)
-                        goto out;
-
-                ft->name = name;
-
                 /* path component string */
-                rc = next_entry(name, fp, len);
+                rc = str_read(&name, GFP_KERNEL, fp, len);
                 if (rc)
                         goto out;
-                name[len] = 0;
+
+                ft->name = name;
 
                 rc = next_entry(buf, fp, sizeof(u32) * 4);
                 if (rc)
@@ -2045,17 +2010,10 @@ static int genfs_read(struct policydb *p, void *fp)
                 if (!newgenfs)
                         goto out;
 
-                rc = -ENOMEM;
-                newgenfs->fstype = kmalloc(len + 1, GFP_KERNEL);
-                if (!newgenfs->fstype)
-                        goto out;
-
-                rc = next_entry(newgenfs->fstype, fp, len);
+                rc = str_read(&newgenfs->fstype, GFP_KERNEL, fp, len);
                 if (rc)
                         goto out;
 
-                newgenfs->fstype[len] = 0;
-
                 for (genfs_p = NULL, genfs = p->genfs; genfs;
                      genfs_p = genfs, genfs = genfs->next) {
                         rc = -EINVAL;
@@ -2091,15 +2049,9 @@ static int genfs_read(struct policydb *p, void *fp)
                         if (!newc)
                                 goto out;
 
-                        rc = -ENOMEM;
-                        newc->u.name = kmalloc(len + 1, GFP_KERNEL);
-                        if (!newc->u.name)
-                                goto out;
-
-                        rc = next_entry(newc->u.name, fp, len);
+                        rc = str_read(&newc->u.name, GFP_KERNEL, fp, len);
                         if (rc)
                                 goto out;
-                        newc->u.name[len] = 0;
 
                         rc = next_entry(buf, fp, sizeof(u32));
                         if (rc)
@@ -2189,16 +2141,10 @@ static int ocontext_read(struct policydb *p, struct policydb_compat_info *info,
                                         goto out;
                                 len = le32_to_cpu(buf[0]);
 
-                                rc = -ENOMEM;
-                                c->u.name = kmalloc(len + 1, GFP_KERNEL);
-                                if (!c->u.name)
-                                        goto out;
-
-                                rc = next_entry(c->u.name, fp, len);
+                                rc = str_read(&c->u.name, GFP_KERNEL, fp, len);
                                 if (rc)
                                         goto out;
 
-                                c->u.name[len] = 0;
                                 rc = context_read_and_validate(&c->context[0], p, fp);
                                 if (rc)
                                         goto out;
@@ -2240,16 +2186,11 @@ static int ocontext_read(struct policydb *p, struct policydb_compat_info *info,
                                 if (c->v.behavior > SECURITY_FS_USE_MAX)
                                         goto out;
 
-                                rc = -ENOMEM;
                                 len = le32_to_cpu(buf[1]);
-                                c->u.name = kmalloc(len + 1, GFP_KERNEL);
-                                if (!c->u.name)
-                                        goto out;
-
-                                rc = next_entry(c->u.name, fp, len);
+                                rc = str_read(&c->u.name, GFP_KERNEL, fp, len);
                                 if (rc)
                                         goto out;
-                                c->u.name[len] = 0;
+
                                 rc = context_read_and_validate(&c->context[0], p, fp);
                                 if (rc)
                                         goto out;
@@ -2608,7 +2549,7 @@ static int mls_write_range_helper(struct mls_range *r, void *fp)
         if (!eq)
                 buf[2] = cpu_to_le32(r->level[1].sens);
 
-        BUG_ON(items > (sizeof(buf)/sizeof(buf[0])));
+        BUG_ON(items > ARRAY_SIZE(buf));
 
         rc = put_entry(buf, sizeof(u32), items, fp);
         if (rc)
@@ -2990,7 +2931,7 @@ static int role_write(void *vkey, void *datum, void *ptr)
         if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)
                 buf[items++] = cpu_to_le32(role->bounds);
 
-        BUG_ON(items > (sizeof(buf)/sizeof(buf[0])));
+        BUG_ON(items > ARRAY_SIZE(buf));
 
         rc = put_entry(buf, sizeof(u32), items, fp);
         if (rc)
@@ -3040,7 +2981,7 @@ static int type_write(void *vkey, void *datum, void *ptr)
         } else {
                 buf[items++] = cpu_to_le32(typdatum->primary);
         }
-        BUG_ON(items > (sizeof(buf) / sizeof(buf[0])));
+        BUG_ON(items > ARRAY_SIZE(buf));
         rc = put_entry(buf, sizeof(u32), items, fp);
         if (rc)
                 return rc;
@@ -3069,7 +3010,7 @@ static int user_write(void *vkey, void *datum, void *ptr)
         buf[items++] = cpu_to_le32(usrdatum->value);
         if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)
                 buf[items++] = cpu_to_le32(usrdatum->bounds);
-        BUG_ON(items > (sizeof(buf) / sizeof(buf[0])));
+        BUG_ON(items > ARRAY_SIZE(buf));
         rc = put_entry(buf, sizeof(u32), items, fp);
         if (rc)
                 return rc;
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 4bca49414a40..2aa9d172dc7e 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -2277,7 +2277,7 @@ out:
 }
 
 /**
- * security_genfs_sid - Obtain a SID for a file in a filesystem
+ * __security_genfs_sid - Helper to obtain a SID for a file in a filesystem
  * @fstype: filesystem type
  * @path: path from root of mount
  * @sclass: file security class
@@ -2286,11 +2286,13 @@ out:
  * Obtain a SID to use for a file in a filesystem that
  * cannot support xattr or use a fixed labeling behavior like
  * transition SIDs or task SIDs.
+ *
+ * The caller must acquire the policy_rwlock before calling this function.
  */
-int security_genfs_sid(const char *fstype,
-                       char *path,
-                       u16 orig_sclass,
-                       u32 *sid)
+static inline int __security_genfs_sid(const char *fstype,
+                                       char *path,
+                                       u16 orig_sclass,
+                                       u32 *sid)
 {
         int len;
         u16 sclass;
@@ -2301,8 +2303,6 @@ int security_genfs_sid(const char *fstype,
         while (path[0] == '/' && path[1] == '/')
                 path++;
 
-        read_lock(&policy_rwlock);
-
         sclass = unmap_class(orig_sclass);
         *sid = SECINITSID_UNLABELED;
 
@@ -2336,11 +2336,33 @@ int security_genfs_sid(const char *fstype,
         *sid = c->sid[0];
         rc = 0;
 out:
-        read_unlock(&policy_rwlock);
         return rc;
 }
 
 /**
+ * security_genfs_sid - Obtain a SID for a file in a filesystem
+ * @fstype: filesystem type
+ * @path: path from root of mount
+ * @sclass: file security class
+ * @sid: SID for path
+ *
+ * Acquire policy_rwlock before calling __security_genfs_sid() and release
+ * it afterward.
+ */
+int security_genfs_sid(const char *fstype,
+                       char *path,
+                       u16 orig_sclass,
+                       u32 *sid)
+{
+        int retval;
+
+        read_lock(&policy_rwlock);
+        retval = __security_genfs_sid(fstype, path, orig_sclass, sid);
+        read_unlock(&policy_rwlock);
+        return retval;
+}
+
+/**
  * security_fs_use - Determine how to handle labeling for a filesystem.
  * @sb: superblock in question
  */
@@ -2370,7 +2392,8 @@ int security_fs_use(struct super_block *sb)
                 }
                 sbsec->sid = c->sid[0];
         } else {
-                rc = security_genfs_sid(fstype, "/", SECCLASS_DIR, &sbsec->sid);
+                rc = __security_genfs_sid(fstype, "/", SECCLASS_DIR,
+                                          &sbsec->sid);
                 if (rc) {
                         sbsec->behavior = SECURITY_FS_USE_NONE;
                         rc = 0;
diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c
index c062e9467b62..f97d0842e621 100644
--- a/security/smack/smack_access.c
+++ b/security/smack/smack_access.c
@@ -457,19 +457,16 @@ int smk_netlbl_mls(int level, char *catset, struct netlbl_lsm_secattr *sap,
 
         sap->flags |= NETLBL_SECATTR_MLS_CAT;
         sap->attr.mls.lvl = level;
-        sap->attr.mls.cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
-        if (!sap->attr.mls.cat)
-                return -ENOMEM;
-        sap->attr.mls.cat->startbit = 0;
+        sap->attr.mls.cat = NULL;
 
         for (cat = 1, cp = catset, byte = 0; byte < len; cp++, byte++)
                 for (m = 0x80; m != 0; m >>= 1, cat++) {
                         if ((m & *cp) == 0)
                                 continue;
-                        rc = netlbl_secattr_catmap_setbit(sap->attr.mls.cat,
-                                                          cat, GFP_ATOMIC);
+                        rc = netlbl_catmap_setbit(&sap->attr.mls.cat,
+                                                  cat, GFP_ATOMIC);
                         if (rc < 0) {
-                                netlbl_secattr_catmap_free(sap->attr.mls.cat);
+                                netlbl_catmap_free(sap->attr.mls.cat);
                                 return rc;
                         }
                 }
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index f2c30801ce41..e6ab307ce86e 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -3209,9 +3209,9 @@ static struct smack_known *smack_from_secattr(struct netlbl_lsm_secattr *sap,
                                 break;
                         }
                         for (acat = -1, kcat = -1; acat == kcat; ) {
-                                acat = netlbl_secattr_catmap_walk(
-                                        sap->attr.mls.cat, acat + 1);
-                                kcat = netlbl_secattr_catmap_walk(
+                                acat = netlbl_catmap_walk(sap->attr.mls.cat,
+                                                          acat + 1);
+                                kcat = netlbl_catmap_walk(
                                         skp->smk_netlabel.attr.mls.cat,
                                         kcat + 1);
                                 if (acat < 0 || kcat < 0)
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index 32b248820840..3c720ff10591 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -787,7 +787,7 @@ static int cipso_seq_show(struct seq_file *s, void *v)
         struct list_head  *list = v;
         struct smack_known *skp =
                  list_entry(list, struct smack_known, list);
-        struct netlbl_lsm_secattr_catmap *cmp = skp->smk_netlabel.attr.mls.cat;
+        struct netlbl_lsm_catmap *cmp = skp->smk_netlabel.attr.mls.cat;
         char sep = '/';
         int i;
 
@@ -804,8 +804,8 @@ static int cipso_seq_show(struct seq_file *s, void *v)
 
         seq_printf(s, "%s %3d", skp->smk_known, skp->smk_netlabel.attr.mls.lvl);
 
-        for (i = netlbl_secattr_catmap_walk(cmp, 0); i >= 0;
-             i = netlbl_secattr_catmap_walk(cmp, i + 1)) {
+        for (i = netlbl_catmap_walk(cmp, 0); i >= 0;
+             i = netlbl_catmap_walk(cmp, i + 1)) {
                 seq_printf(s, "%c%d", sep, i);
                 sep = ',';
         }
@@ -926,7 +926,7 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
 
         rc = smk_netlbl_mls(maplevel, mapcatset, &ncats, SMK_CIPSOLEN);
         if (rc >= 0) {
-                netlbl_secattr_catmap_free(skp->smk_netlabel.attr.mls.cat);
+                netlbl_catmap_free(skp->smk_netlabel.attr.mls.cat);
                 skp->smk_netlabel.attr.mls.cat = ncats.attr.mls.cat;
                 skp->smk_netlabel.attr.mls.lvl = ncats.attr.mls.lvl;
                 rc = count;
@@ -976,14 +976,14 @@ static int cipso2_seq_show(struct seq_file *s, void *v)
         struct list_head  *list = v;
         struct smack_known *skp =
                  list_entry(list, struct smack_known, list);
-        struct netlbl_lsm_secattr_catmap *cmp = skp->smk_netlabel.attr.mls.cat;
+        struct netlbl_lsm_catmap *cmp = skp->smk_netlabel.attr.mls.cat;
         char sep = '/';
         int i;
 
         seq_printf(s, "%s %3d", skp->smk_known, skp->smk_netlabel.attr.mls.lvl);
 
-        for (i = netlbl_secattr_catmap_walk(cmp, 0); i >= 0;
-             i = netlbl_secattr_catmap_walk(cmp, i + 1)) {
+        for (i = netlbl_catmap_walk(cmp, 0); i >= 0;
+             i = netlbl_catmap_walk(cmp, i + 1)) {
                 seq_printf(s, "%c%d", sep, i);
                 sep = ',';
         }