Merge branch 'next' of git://selinuxproject.org/~jmorris/linux-security

* 'next' of git://selinuxproject.org/~jmorris/linux-security: (95 commits)
  TOMOYO: Fix incomplete read after seek.
  Smack: allow to access /smack/access as normal user
  TOMOYO: Fix unused kernel config option.
  Smack: fix: invalid length set for the result of /smack/access
  Smack: compilation fix
  Smack: fix for /smack/access output, use string instead of byte
  Smack: domain transition protections (v3)
  Smack: Provide information for UDS getsockopt(SO_PEERCRED)
  Smack: Clean up comments
  Smack: Repair processing of fcntl
  Smack: Rule list lookup performance
  Smack: check permissions from user space (v2)
  TOMOYO: Fix quota and garbage collector.
  TOMOYO: Remove redundant tasklist_lock.
  TOMOYO: Fix domain transition failure warning.
  TOMOYO: Remove tomoyo_policy_memory_lock spinlock.
  TOMOYO: Simplify garbage collector.
  TOMOYO: Fix make namespacecheck warnings.
  target: check hex2bin result
  encrypted-keys: check hex2bin result
  ...

1 files changed, 16 insertions, 2 deletions

diff --git a/kernel/cred.c b/kernel/cred.c
index 8ef31f53c44c..bb55d052d858 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -644,6 +644,9 @@ void __init cred_init(void)
  */
 struct cred *prepare_kernel_cred(struct task_struct *daemon)
 {
+#ifdef CONFIG_KEYS
+        struct thread_group_cred *tgcred;
+#endif
         const struct cred *old;
         struct cred *new;
 
@@ -651,6 +654,14 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
         if (!new)
                 return NULL;
 
+#ifdef CONFIG_KEYS
+        tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
+        if (!tgcred) {
+                kmem_cache_free(cred_jar, new);
+                return NULL;
+        }
+#endif
+
         kdebug("prepare_kernel_cred() alloc %p", new);
 
         if (daemon)
@@ -667,8 +678,11 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
         get_group_info(new->group_info);
 
 #ifdef CONFIG_KEYS
-        atomic_inc(&init_tgcred.usage);
-        new->tgcred = &init_tgcred;
+        atomic_set(&tgcred->usage, 1);
+        spin_lock_init(&tgcred->lock);
+        tgcred->process_keyring = NULL;
+        tgcred->session_keyring = NULL;
+        new->tgcred = tgcred;
         new->request_key_auth = NULL;
         new->thread_keyring = NULL;
         new->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING;