Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6:
  Take ima_file_free() to proper place.
  ima: rename PATH_CHECK to FILE_CHECK
  ima: rename ima_path_check to ima_file_check
  ima: initialize ima before inodes can be allocated
  fix ima breakage
  Take ima_path_check() in nfsd past dentry_open() in nfsd_open()
  freeze_bdev: don't deactivate successfully frozen MS_RDONLY sb
  befs: fix leak

5 files changed, 9 insertions, 8 deletions

diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c
index 33baf27fac78..34ddda888e63 100644
--- a/fs/befs/linuxvfs.c
+++ b/fs/befs/linuxvfs.c
@@ -873,6 +873,7 @@ befs_fill_super(struct super_block *sb, void *data, int silent)
         brelse(bh);
 
       unacquire_priv_sbp:
+        kfree(befs_sb->mount_opts.iocharset);
         kfree(sb->s_fs_info);
 
       unacquire_none:
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 73d6a735b8f3..d11d0289f3d2 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -246,7 +246,8 @@ struct super_block *freeze_bdev(struct block_device *bdev)
         if (!sb)
                 goto out;
         if (sb->s_flags & MS_RDONLY) {
-                deactivate_locked_super(sb);
+                sb->s_frozen = SB_FREEZE_TRANS;
+                up_write(&sb->s_umount);
                 mutex_unlock(&bdev->bd_fsfreeze_mutex);
                 return sb;
         }
@@ -307,7 +308,7 @@ int thaw_bdev(struct block_device *bdev, struct super_block *sb)
         BUG_ON(sb->s_bdev != bdev);
         down_write(&sb->s_umount);
         if (sb->s_flags & MS_RDONLY)
-                goto out_deactivate;
+                goto out_unfrozen;
 
         if (sb->s_op->unfreeze_fs) {
                 error = sb->s_op->unfreeze_fs(sb);
@@ -321,11 +322,11 @@ int thaw_bdev(struct block_device *bdev, struct super_block *sb)
                 }
         }
 
+out_unfrozen:
         sb->s_frozen = SB_UNFROZEN;
         smp_wmb();
         wake_up(&sb->s_wait_unfrozen);
 
-out_deactivate:
         if (sb)
                 deactivate_locked_super(sb);
 out_unlock:
diff --git a/fs/file_table.c b/fs/file_table.c
index 69652c5bd5f0..b98404b54383 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -253,6 +253,7 @@ void __fput(struct file *file)
         if (file->f_op && file->f_op->release)
                 file->f_op->release(inode, file);
         security_file_free(file);
+        ima_file_free(file);
         if (unlikely(S_ISCHR(inode->i_mode) && inode->i_cdev != NULL))
                 cdev_put(inode->i_cdev);
         fops_put(file->f_op);
diff --git a/fs/namei.c b/fs/namei.c
index 94a5e60779f9..d62fdc875f22 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1736,8 +1736,7 @@ do_last:
                 if (nd.root.mnt)
                         path_put(&nd.root);
                 if (!IS_ERR(filp)) {
-                        error = ima_path_check(&filp->f_path, filp->f_mode &
-                                       (MAY_READ | MAY_WRITE | MAY_EXEC));
+                        error = ima_file_check(filp, acc_mode);
                         if (error) {
                                 fput(filp);
                                 filp = ERR_PTR(error);
@@ -1797,8 +1796,7 @@ ok:
         }
         filp = nameidata_to_filp(&nd);
         if (!IS_ERR(filp)) {
-                error = ima_path_check(&filp->f_path, filp->f_mode &
-                               (MAY_READ | MAY_WRITE | MAY_EXEC));
+                error = ima_file_check(filp, acc_mode);
                 if (error) {
                         fput(filp);
                         filp = ERR_PTR(error);
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index c194793b642b..97d79eff6b7f 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -752,6 +752,7 @@ nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
                             flags, current_cred());
         if (IS_ERR(*filp))
                 host_err = PTR_ERR(*filp);
+        host_err = ima_file_check(*filp, access);
 out_nfserr:
         err = nfserrno(host_err);
 out:
@@ -2127,7 +2128,6 @@ nfsd_permission(struct svc_rqst *rqstp, struct svc_export *exp,
          */
         path.mnt = exp->ex_path.mnt;
         path.dentry = dentry;
-        err = ima_path_check(&path, acc & (MAY_READ | MAY_WRITE | MAY_EXEC));
 nfsd_out:
         return err? nfserrno(err) : 0;
 }