6 files changed, 22 insertions, 22 deletions

diff --git a/security/capability.c b/security/capability.c
index c773635ca3a0..2a5df2b7da83 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -548,7 +548,7 @@ static int cap_sem_semop(struct sem_array *sma, struct sembuf *sops,
 }
 
 #ifdef CONFIG_SECURITY_NETWORK
-static int cap_unix_stream_connect(struct socket *sock, struct socket *other,
+static int cap_unix_stream_connect(struct sock *sock, struct sock *other,
                                    struct sock *newsk)
 {
         return 0;
diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index aef8c0a923ab..d661afbe474c 100644
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -253,6 +253,8 @@ static int ima_lsm_rule_init(struct ima_measure_rule_entry *entry,
         result = security_filter_rule_init(entry->lsm[lsm_rule].type,
                                            Audit_equal, args,
                                            &entry->lsm[lsm_rule].rule);
+        if (!entry->lsm[lsm_rule].rule)
+                return -EINVAL;
         return result;
 }
 
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 0088dd8bf68a..0ea52d25a6bd 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -403,7 +403,6 @@ link_check_failed:
         return ret;
 
 link_prealloc_failed:
-        up_write(&dest_keyring->sem);
         mutex_unlock(&user->cons_lock);
         kleave(" = %d [prelink]", ret);
         return ret;
diff --git a/security/security.c b/security/security.c
index 1b798d3df710..e5fb07a3052d 100644
--- a/security/security.c
+++ b/security/security.c
@@ -977,8 +977,7 @@ EXPORT_SYMBOL(security_inode_getsecctx);
 
 #ifdef CONFIG_SECURITY_NETWORK
 
-int security_unix_stream_connect(struct socket *sock, struct socket *other,
-                                 struct sock *newsk)
+int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk)
 {
         return security_ops->unix_stream_connect(sock, other, newsk);
 }
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 65fa8bf596f5..6f637d2678ac 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3921,18 +3921,18 @@ static int selinux_socket_shutdown(struct socket *sock, int how)
         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
 }
 
-static int selinux_socket_unix_stream_connect(struct socket *sock,
-                                              struct socket *other,
+static int selinux_socket_unix_stream_connect(struct sock *sock,
+                                              struct sock *other,
                                               struct sock *newsk)
 {
-        struct sk_security_struct *sksec_sock = sock->sk->sk_security;
-        struct sk_security_struct *sksec_other = other->sk->sk_security;
+        struct sk_security_struct *sksec_sock = sock->sk_security;
+        struct sk_security_struct *sksec_other = other->sk_security;
         struct sk_security_struct *sksec_new = newsk->sk_security;
         struct common_audit_data ad;
         int err;
 
         COMMON_AUDIT_DATA_INIT(&ad, NET);
-        ad.u.net.sk = other->sk;
+        ad.u.net.sk = other;
 
         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
                            sksec_other->sclass,
@@ -4520,11 +4520,11 @@ static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
         if (selinux_secmark_enabled())
                 if (avc_has_perm(sksec->sid, skb->secmark,
                                  SECCLASS_PACKET, PACKET__SEND, &ad))
-                        return NF_DROP;
+                        return NF_DROP_ERR(-ECONNREFUSED);
 
         if (selinux_policycap_netpeer)
                 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
-                        return NF_DROP;
+                        return NF_DROP_ERR(-ECONNREFUSED);
 
         return NF_ACCEPT;
 }
@@ -4581,7 +4581,7 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
                                 secmark_perm = PACKET__SEND;
                         break;
                 default:
-                        return NF_DROP;
+                        return NF_DROP_ERR(-ECONNREFUSED);
                 }
                 if (secmark_perm == PACKET__FORWARD_OUT) {
                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
@@ -4603,7 +4603,7 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
         if (secmark_active)
                 if (avc_has_perm(peer_sid, skb->secmark,
                                  SECCLASS_PACKET, secmark_perm, &ad))
-                        return NF_DROP;
+                        return NF_DROP_ERR(-ECONNREFUSED);
 
         if (peerlbl_active) {
                 u32 if_sid;
@@ -4613,13 +4613,13 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
                         return NF_DROP;
                 if (avc_has_perm(peer_sid, if_sid,
                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
-                        return NF_DROP;
+                        return NF_DROP_ERR(-ECONNREFUSED);
 
                 if (sel_netnode_sid(addrp, family, &node_sid))
                         return NF_DROP;
                 if (avc_has_perm(peer_sid, node_sid,
                                  SECCLASS_NODE, NODE__SENDTO, &ad))
-                        return NF_DROP;
+                        return NF_DROP_ERR(-ECONNREFUSED);
         }
 
         return NF_ACCEPT;
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 489a85afa477..ccb71a044a1a 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -2408,22 +2408,22 @@ static int smack_setprocattr(struct task_struct *p, char *name,
 
 /**
  * smack_unix_stream_connect - Smack access on UDS
- * @sock: one socket
- * @other: the other socket
+ * @sock: one sock
+ * @other: the other sock
  * @newsk: unused
  *
  * Return 0 if a subject with the smack of sock could access
  * an object with the smack of other, otherwise an error code
  */
-static int smack_unix_stream_connect(struct socket *sock,
-                                     struct socket *other, struct sock *newsk)
+static int smack_unix_stream_connect(struct sock *sock,
+                                     struct sock *other, struct sock *newsk)
 {
-        struct inode *sp = SOCK_INODE(sock);
-        struct inode *op = SOCK_INODE(other);
+        struct inode *sp = SOCK_INODE(sock->sk_socket);
+        struct inode *op = SOCK_INODE(other->sk_socket);
         struct smk_audit_info ad;
 
         smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_NET);
-        smk_ad_setfield_u_net_sk(&ad, other->sk);
+        smk_ad_setfield_u_net_sk(&ad, other);
         return smk_access(smk_of_inode(sp), smk_of_inode(op),
                                  MAY_READWRITE, &ad);
 }