Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  integrity: digital signature config option name change
  lib: Removed MPILIB, MPILIB_EXTRA, and SIGNATURE prompts
  lib: MPILIB Kconfig description update
  lib: digital signature dependency fix
  lib: digital signature config option name change
  encrypted-keys: fix rcu and sparse messages
  keys: fix trusted/encrypted keys sparse rcu_assign_pointer messages
  KEYS: Add missing smp_rmb() primitives to the keyring search code
  TOMOYO: Accept \000 as a valid character.
  security: update MAINTAINERS file with new git repo

14 files changed, 50 insertions, 36 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index 2a90101309d..ece8935025e 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -5846,7 +5846,7 @@ F:	drivers/mmc/host/sdhci-spear.c
 SECURITY SUBSYSTEM
 M:      James Morris <jmorris@namei.org>
 L:      linux-security-module@vger.kernel.org (suggested Cc:)
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git
 W:      http://security.wiki.kernel.org/
 S:      Supported
 F:      security/
diff --git a/include/linux/digsig.h b/include/linux/digsig.h
index efae755017d..b01558b1581 100644
--- a/include/linux/digsig.h
+++ b/include/linux/digsig.h
@@ -46,7 +46,7 @@ struct signature_hdr {
         char            mpi[0];
 } __packed;
 
-#if defined(CONFIG_DIGSIG) || defined(CONFIG_DIGSIG_MODULE)
+#if defined(CONFIG_SIGNATURE) || defined(CONFIG_SIGNATURE_MODULE)
 
 int digsig_verify(struct key *keyring, const char *sig, int siglen,
                                         const char *digest, int digestlen);
@@ -59,6 +59,6 @@ static inline int digsig_verify(struct key *keyring, const char *sig,
         return -EOPNOTSUPP;
 }
 
-#endif /* CONFIG_DIGSIG */
+#endif /* CONFIG_SIGNATURE */
 
 #endif /* _DIGSIG_H */
diff --git a/include/linux/key.h b/include/linux/key.h
index 183a6af7715..bfc014c5735 100644
--- a/include/linux/key.h
+++ b/include/linux/key.h
@@ -293,6 +293,9 @@ static inline bool key_is_instantiated(const struct key *key)
         (rcu_dereference_protected((KEY)->payload.rcudata,              \
                                    rwsem_is_locked(&((struct key *)(KEY))->sem)))
 
+#define rcu_assign_keypointer(KEY, PAYLOAD)                             \
+        (rcu_assign_pointer((KEY)->payload.rcudata, PAYLOAD))
+
 #ifdef CONFIG_SYSCTL
 extern ctl_table key_sysctls[];
 #endif
diff --git a/lib/Kconfig b/lib/Kconfig
index 201e1b33d72..169eb7c598e 100644
--- a/lib/Kconfig
+++ b/lib/Kconfig
@@ -286,25 +286,24 @@ config CORDIC
           calculations are in fixed point. Module will be called cordic.
 
 config MPILIB
-        tristate "Multiprecision maths library"
+        tristate
         help
           Multiprecision maths library from GnuPG.
           It is used to implement RSA digital signature verification,
           which is used by IMA/EVM digital signature extension.
 
 config MPILIB_EXTRA
-        bool "Multiprecision maths library - additional sources"
+        bool
         depends on MPILIB
         help
-          Multiprecision maths library from GnuPG.
-          It is used to implement RSA digital signature verification,
-          which is used by IMA/EVM digital signature extension.
-          This code in unnecessary for RSA digital signature verification,
-          and can be compiled if needed.
+          Additional sources of multiprecision maths library from GnuPG.
+          This code is unnecessary for RSA digital signature verification,
+          but can be compiled if needed.
 
-config DIGSIG
-        tristate "In-kernel signature checker"
-        depends on KEYS
+config SIGNATURE
+        tristate
+        depends on KEYS && CRYPTO
+        select CRYPTO_SHA1
         select MPILIB
         help
           Digital signature verification. Currently only RSA is supported.
diff --git a/lib/Makefile b/lib/Makefile
index dace162c7e1..d71aae1b01b 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -119,7 +119,7 @@ obj-$(CONFIG_CORDIC) += cordic.o
 obj-$(CONFIG_DQL) += dynamic_queue_limits.o
 
 obj-$(CONFIG_MPILIB) += mpi/
-obj-$(CONFIG_DIGSIG) += digsig.o
+obj-$(CONFIG_SIGNATURE) += digsig.o
 
 hostprogs-y     := gen_crc32table
 clean-files     := crc32table.h
diff --git a/security/integrity/Kconfig b/security/integrity/Kconfig
index d384ea92148..5bd1cc1b4a5 100644
--- a/security/integrity/Kconfig
+++ b/security/integrity/Kconfig
@@ -3,11 +3,11 @@ config INTEGRITY
         def_bool y
         depends on IMA || EVM
 
-config INTEGRITY_DIGSIG
+config INTEGRITY_SIGNATURE
         boolean "Digital signature verification using multiple keyrings"
         depends on INTEGRITY && KEYS
         default n
-        select DIGSIG
+        select SIGNATURE
         help
           This option enables digital signature verification support
           using multiple keyrings. It defines separate keyrings for each
diff --git a/security/integrity/Makefile b/security/integrity/Makefile
index bece0563ee5..d43799cc14f 100644
--- a/security/integrity/Makefile
+++ b/security/integrity/Makefile
@@ -3,7 +3,7 @@
 #
 
 obj-$(CONFIG_INTEGRITY) += integrity.o
-obj-$(CONFIG_INTEGRITY_DIGSIG) += digsig.o
+obj-$(CONFIG_INTEGRITY_SIGNATURE) += digsig.o
 
 integrity-y := iint.o
 
diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index 4da6ba81d15..7a25ecec5aa 100644
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -51,7 +51,7 @@ struct integrity_iint_cache *integrity_iint_find(struct inode *inode);
 #define INTEGRITY_KEYRING_IMA           2
 #define INTEGRITY_KEYRING_MAX           3
 
-#ifdef CONFIG_INTEGRITY_DIGSIG
+#ifdef CONFIG_INTEGRITY_SIGNATURE
 
 int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
                                         const char *digest, int digestlen);
@@ -65,7 +65,7 @@ static inline int integrity_digsig_verify(const unsigned int id,
         return -EOPNOTSUPP;
 }
 
-#endif /* CONFIG_INTEGRITY_DIGSIG */
+#endif /* CONFIG_INTEGRITY_SIGNATURE */
 
 /* set during initialization */
 extern int iint_initialized;
diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
index 41144f71d61..2d1bb8af769 100644
--- a/security/keys/encrypted-keys/encrypted.c
+++ b/security/keys/encrypted-keys/encrypted.c
@@ -314,7 +314,7 @@ static struct key *request_user_key(const char *master_desc, u8 **master_key,
                 goto error;
 
         down_read(&ukey->sem);
-        upayload = rcu_dereference(ukey->payload.data);
+        upayload = ukey->payload.data;
         *master_key = upayload->data;
         *master_keylen = upayload->datalen;
 error:
@@ -810,7 +810,7 @@ static int encrypted_instantiate(struct key *key, const void *data,
                 goto out;
         }
 
-        rcu_assign_pointer(key->payload.data, epayload);
+        rcu_assign_keypointer(key, epayload);
 out:
         kfree(datablob);
         return ret;
@@ -874,7 +874,7 @@ static int encrypted_update(struct key *key, const void *data, size_t datalen)
         memcpy(new_epayload->payload_data, epayload->payload_data,