Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: (24 commits)
  integrity: special fs magic
  As pointed out by Jonathan Corbet, the timer must be deleted before
  ERROR: code indent should use tabs where possible
  The tpm_dev_release function is only called for platform devices, not pnp
  Protect tpm_chip_list when transversing it.
  Renames num_open to is_open, as only one process can open the file at a time.
  Remove the BKL calls from the TPM driver, which were added in the overall
  netlabel: Add configuration support for local labeling
  cipso: Add support for native local labeling and fixup mapping names
  netlabel: Changes to the NetLabel security attributes to allow LSMs to pass full contexts
  selinux: Cache NetLabel secattrs in the socket's security struct
  selinux: Set socket NetLabel based on connection endpoint
  netlabel: Add functionality to set the security attributes of a packet
  netlabel: Add network address selectors to the NetLabel/LSM domain mapping
  netlabel: Add a generic way to create ordered linked lists of network addrs
  netlabel: Replace protocol/NetLabel linking with refrerence counts
  smack: Fix missing calls to netlbl_skbuff_err()
  selinux: Fix missing calls to netlbl_skbuff_err()
  selinux: Fix a problem in security_netlbl_sid_to_secattr()
  selinux: Better local/forward check in selinux_ip_postroute()
  ...

3 files changed, 61 insertions, 52 deletions

diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index ae766d868454..1fee7034a386 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -954,72 +954,63 @@ EXPORT_SYMBOL_GPL(tpm_store_cancel);
 
 /*
  * Device file system interface to the TPM
+ *
+ * It's assured that the chip will be opened just once,
+ * by the check of is_open variable, which is protected
+ * by driver_lock.
  */
 int tpm_open(struct inode *inode, struct file *file)
 {
-        int rc = 0, minor = iminor(inode);
+        int minor = iminor(inode);
         struct tpm_chip *chip = NULL, *pos;
 
-        lock_kernel();
-        spin_lock(&driver_lock);
-
-        list_for_each_entry(pos, &tpm_chip_list, list) {
+        rcu_read_lock();
+        list_for_each_entry_rcu(pos, &tpm_chip_list, list) {
                 if (pos->vendor.miscdev.minor == minor) {
                         chip = pos;
+                        get_device(chip->dev);
                         break;
                 }
         }
+        rcu_read_unlock();
 
-        if (chip == NULL) {
-                rc = -ENODEV;
-                goto err_out;
-        }
+        if (!chip)
+                return -ENODEV;
 
-        if (chip->num_opens) {
+        if (test_and_set_bit(0, &chip->is_open)) {
                 dev_dbg(chip->dev, "Another process owns this TPM\n");
-                rc = -EBUSY;
-                goto err_out;
+                put_device(chip->dev);
+                return -EBUSY;
         }
 
-        chip->num_opens++;
-        get_device(chip->dev);
-
-        spin_unlock(&driver_lock);
-
         chip->data_buffer = kmalloc(TPM_BUFSIZE * sizeof(u8), GFP_KERNEL);
         if (chip->data_buffer == NULL) {
-                chip->num_opens--;
+                clear_bit(0, &chip->is_open);
                 put_device(chip->dev);
-                unlock_kernel();
                 return -ENOMEM;
         }
 
         atomic_set(&chip->data_pending, 0);
 
         file->private_data = chip;
-        unlock_kernel();
         return 0;
-
-err_out:
-        spin_unlock(&driver_lock);
-        unlock_kernel();
-        return rc;
 }
 EXPORT_SYMBOL_GPL(tpm_open);
 
+/*
+ * Called on file close
+ */
 int tpm_release(struct inode *inode, struct file *file)
 {
         struct tpm_chip *chip = file->private_data;
 
+        del_singleshot_timer_sync(&chip->user_read_timer);
         flush_scheduled_work();
-        spin_lock(&driver_lock);
         file->private_data = NULL;
-        del_singleshot_timer_sync(&chip->user_read_timer);
         atomic_set(&chip->data_pending, 0);
-        chip->num_opens--;
-        put_device(chip->dev);
         kfree(chip->data_buffer);
-        spin_unlock(&driver_lock);
+        clear_bit(0, &chip->is_open);
+        put_device(chip->dev);
         return 0;
 }
 EXPORT_SYMBOL_GPL(tpm_release);
@@ -1093,13 +1084,11 @@ void tpm_remove_hardware(struct device *dev)
         }
 
         spin_lock(&driver_lock);
-
-        list_del(&chip->list);
-
+        list_del_rcu(&chip->list);
         spin_unlock(&driver_lock);
+        synchronize_rcu();
 
         misc_deregister(&chip->vendor.miscdev);
-
         sysfs_remove_group(&dev->kobj, chip->vendor.attr_group);
         tpm_bios_log_teardown(chip->bios_dir);
 
@@ -1144,25 +1133,33 @@ int tpm_pm_resume(struct device *dev)
 }
 EXPORT_SYMBOL_GPL(tpm_pm_resume);
 
+/* In case vendor provided release function, call it too.*/
+
+void tpm_dev_vendor_release(struct tpm_chip *chip)
+{
+        if (chip->vendor.release)
+                chip->vendor.release(chip->dev);
+
+        clear_bit(chip->dev_num, dev_mask);
+        kfree(chip->vendor.miscdev.name);
+}
+EXPORT_SYMBOL_GPL(tpm_dev_vendor_release);
+
+
 /*
  * Once all references to platform device are down to 0,
  * release all allocated structures.
- * In case vendor provided release function,
- * call it too.
  */
 static void tpm_dev_release(struct device *dev)
 {
         struct tpm_chip *chip = dev_get_drvdata(dev);
 
-        if (chip->vendor.release)
-                chip->vendor.release(dev);
+        tpm_dev_vendor_release(chip);
 
         chip->release(dev);
-
-        clear_bit(chip->dev_num, dev_mask);
-        kfree(chip->vendor.miscdev.name);
         kfree(chip);
 }
+EXPORT_SYMBOL_GPL(tpm_dev_release);
 
 /*
  * Called from tpm_<specific>.c probe function only for devices 
@@ -1171,8 +1168,8 @@ static void tpm_dev_release(struct device *dev)
  * upon errant exit from this function specific probe function should call
  * pci_disable_device
  */
-struct tpm_chip *tpm_register_hardware(struct device *dev, const struct tpm_vendor_specific
-                                       *entry)
+struct tpm_chip *tpm_register_hardware(struct device *dev,
+                                        const struct tpm_vendor_specific *entry)
 {
 #define DEVNAME_SIZE 7
 
@@ -1231,21 +1228,20 @@ struct tpm_chip *tpm_register_hardware(struct device *dev, const struct tpm_vend
                 return NULL;
         }
 
-        spin_lock(&driver_lock);
-
-        list_add(&chip->list, &tpm_chip_list);
-
-        spin_unlock(&driver_lock);
-
         if (sysfs_create_group(&dev->kobj, chip->vendor.attr_group)) {
-                list_del(&chip->list);
                 misc_deregister(&chip->vendor.miscdev);
                 put_device(chip->dev);
+
                 return NULL;
         }
 
         chip->bios_dir = tpm_bios_log_setup(devname);
 
+        /* Make chip available */
+        spin_lock(&driver_lock);
+        list_add_rcu(&chip->list, &tpm_chip_list);
+        spin_unlock(&driver_lock);
+
         return chip;
 }
 EXPORT_SYMBOL_GPL(tpm_register_hardware);
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index e885148b4cfb..8e30df4a4388 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -90,7 +90,7 @@ struct tpm_chip {
         struct device *dev;     /* Device stuff */
 
         int dev_num;            /* /dev/tpm# */
-        int num_opens;          /* only one allowed */
+        unsigned long is_open;  /* only one allowed */
         int time_expired;
 
         /* Data passed to and from the tpm via the read/write calls */
@@ -132,6 +132,7 @@ extern struct tpm_chip* tpm_register_hardware(struct device *,
                                  const struct tpm_vendor_specific *);
 extern int tpm_open(struct inode *, struct file *);
 extern int tpm_release(struct inode *, struct file *);
+extern void tpm_dev_vendor_release(struct tpm_chip *);
 extern ssize_t tpm_write(struct file *, const char __user *, size_t,
                          loff_t *);
 extern ssize_t tpm_read(struct file *, char __user *, size_t, loff_t *);
diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
index ed1879c0dd8d..717af7ad1bdf 100644
--- a/drivers/char/tpm/tpm_tis.c
+++ b/drivers/char/tpm/tpm_tis.c
@@ -630,12 +630,23 @@ static struct pnp_device_id tpm_pnp_tbl[] __devinitdata = {
         {"", 0}                 /* Terminator */
 };
 
+static __devexit void tpm_tis_pnp_remove(struct pnp_dev *dev)
+{
+        struct tpm_chip *chip = pnp_get_drvdata(dev);
+
+        tpm_dev_vendor_release(chip);
+
+        kfree(chip);
+}
+
+
 static struct pnp_driver tis_pnp_driver = {
         .name = "tpm_tis",
         .id_table = tpm_pnp_tbl,
         .probe = tpm_tis_pnp_init,
         .suspend = tpm_tis_pnp_suspend,
         .resume = tpm_tis_pnp_resume,
+        .remove = tpm_tis_pnp_remove,
 };
 
 #define TIS_HID_USR_IDX sizeof(tpm_pnp_tbl)/sizeof(struct pnp_device_id) -2
@@ -683,6 +694,7 @@ static void __exit cleanup_tis(void)
         spin_lock(&tis_lock);
         list_for_each_entry_safe(i, j, &tis_chips, list) {
                 chip = to_tpm_chip(i);
+                tpm_remove_hardware(chip->dev);
                 iowrite32(~TPM_GLOBAL_INT_ENABLE &
                           ioread32(chip->vendor.iobase +
                                    TPM_INT_ENABLE(chip->vendor.
@@ -694,9 +706,9 @@ static void __exit cleanup_tis(void)
                         free_irq(chip->vendor.irq, chip);
                 iounmap(i->iobase);
                 list_del(&i->list);
-                tpm_remove_hardware(chip->dev);
         }
         spin_unlock(&tis_lock);
+
         if (force) {
                 platform_device_unregister(pdev);
                 driver_unregister(&tis_drv);