Merge branch 'next' into for-linus

15 files changed, 66 insertions, 41 deletions

diff --git a/security/Kconfig b/security/Kconfig
index 95accd442d55..e0f08b52e4ab 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -167,6 +167,7 @@ config INTEL_TXT
 config LSM_MMAP_MIN_ADDR
         int "Low address space for LSM to protect from user allocation"
         depends on SECURITY && SECURITY_SELINUX
+        default 32768 if ARM
         default 65536
         help
           This is the portion of low virtual memory which should be protected
diff --git a/security/commoncap.c b/security/commoncap.c
index f20e984ccfb4..a93b3b733079 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -529,15 +529,10 @@ skip:
         new->suid = new->fsuid = new->euid;
         new->sgid = new->fsgid = new->egid;
 
-        /* For init, we want to retain the capabilities set in the initial
-         * task.  Thus we skip the usual capability rules
-         */
-        if (!is_global_init(current)) {
-                if (effective)
-                        new->cap_effective = new->cap_permitted;
-                else
-                        cap_clear(new->cap_effective);
-        }
+        if (effective)
+                new->cap_effective = new->cap_permitted;
+        else
+                cap_clear(new->cap_effective);
         bprm->cap_effective = effective;
 
         /*
diff --git a/security/keys/internal.h b/security/keys/internal.h
index 07a025f81902..f375152a2500 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -109,11 +109,13 @@ extern key_ref_t keyring_search_aux(key_ref_t keyring_ref,
                                     const struct cred *cred,
                                     struct key_type *type,
                                     const void *description,
-                                    key_match_func_t match);
+                                    key_match_func_t match,
+                                    bool no_state_check);
 
 extern key_ref_t search_my_process_keyrings(struct key_type *type,
                                             const void *description,
                                             key_match_func_t match,
+                                            bool no_state_check,
                                             const struct cred *cred);
 extern key_ref_t search_process_keyrings(struct key_type *type,
                                          const void *description,
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index 427fddcaeb19..eca51918c951 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -206,8 +206,14 @@ SYSCALL_DEFINE4(request_key, const char __user *, _type,
                 goto error5;
         }
 
+        /* wait for the key to finish being constructed */
+        ret = wait_for_key_construction(key, 1);
+        if (ret < 0)
+                goto error6;
+
         ret = key->serial;
 
+error6:
         key_put(key);
 error5:
         key_type_put(ktype);
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index cdd2f3f88c88..a06ffab38568 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -176,13 +176,15 @@ static void keyring_describe(const struct key *keyring, struct seq_file *m)
         else
                 seq_puts(m, "[anon]");
 
-        rcu_read_lock();
-        klist = rcu_dereference(keyring->payload.subscriptions);
-        if (klist)
-                seq_printf(m, ": %u/%u", klist->nkeys, klist->maxkeys);
-        else
-                seq_puts(m, ": empty");
-        rcu_read_unlock();
+        if (key_is_instantiated(keyring)) {
+                rcu_read_lock();
+                klist = rcu_dereference(keyring->payload.subscriptions);
+                if (klist)
+                        seq_printf(m, ": %u/%u", klist->nkeys, klist->maxkeys);
+                else
+                        seq_puts(m, ": empty");
+                rcu_read_unlock();
+        }
 }
 
 /*
@@ -271,6 +273,7 @@ struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,
  * @type: The type of key to search for.
  * @description: Parameter for @match.
  * @match: Function to rule on whether or not a key is the one required.
+ * @no_state_check: Don't check if a matching key is bad
  *
  * Search the supplied keyring tree for a key that matches the criteria given.
  * The root keyring and any linked keyrings must grant Search permission to the
@@ -303,7 +306,8 @@ key_ref_t keyring_search_aux(key_ref_t keyring_ref,
                              const struct cred *cred,
                              struct key_type *type,
                              const void *description,
-                             key_match_func_t match)
+                             key_match_func_t match,
+                             bool no_state_check)
 {
         struct {
                 struct keyring_list *keylist;
@@ -345,6 +349,8 @@ key_ref_t keyring_search_aux(key_ref_t keyring_ref,
         kflags = keyring->flags;
         if (keyring->type == type && match(keyring, description)) {
                 key = keyring;
+                if (no_state_check)
+                        goto found;
 
                 /* check it isn't negative and hasn't expired or been
                  * revoked */
@@ -384,11 +390,13 @@ descend:
                         continue;
 
                 /* skip revoked keys and expired keys */
-                if (kflags & (1 << KEY_FLAG_REVOKED))
-                        continue;
+                if (!no_state_check) {
+                        if (kflags & (1 << KEY_FLAG_REVOKED))
+                                continue;
 
-                if (key->expiry && now.tv_sec >= key->expiry)
-                        continue;
+                        if (key->expiry && now.tv_sec >= key->expiry)
+                                continue;
+                }
 
                 /* keys that don't match */
                 if (!match(key, description))
@@ -399,6 +407,9 @@ descend:
                                         cred, KEY_SEARCH) < 0)
                         continue;
 
+                if (no_state_check)
+                        goto found;
+
                 /* we set a different error code if we pass a negative key */
                 if (kflags & (1 << KEY_FLAG_NEGATIVE)) {
                         err = key->type_data.reject_error;
@@ -478,7 +489,7 @@ key_ref_t keyring_search(key_ref_t keyring,
                 return ERR_PTR(-ENOKEY);
 
         return keyring_search_aux(keyring, current->cred,
-                                  type, description, type->match);
+                                  type, description, type->match, false);
 }
 EXPORT_SYMBOL(keyring_search);
 
diff --git a/security/keys/proc.c b/security/keys/proc.c
index 525cf8a29cdd..49bbc97943ad 100644
--- a/security/keys/proc.c
+++ b/security/keys/proc.c
@@ -199,7 +199,7 @@ static int proc_keys_show(struct seq_file *m, void *v)
         if (key->perm & KEY_POS_VIEW) {
                 skey_ref = search_my_process_keyrings(key->type, key,
                                                       lookup_user_key_possessed,
-                                                      cred);
+                                                      true, cred);
                 if (!IS_ERR(skey_ref)) {
                         key_ref_put(skey_ref);
                         key_ref = make_key_ref(key, 1);
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 930634e45149..6c0480db8885 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -331,6 +331,7 @@ void key_fsgid_changed(struct task_struct *tsk)
 key_ref_t search_my_process_keyrings(struct key_type *type,
                                      const void *description,
                                      key_match_func_t match,
+                                     bool no_state_check,
                                      const struct cred *cred)
 {
         key_ref_t key_ref, ret, err;
@@ -350,7 +351,7 @@ key_ref_t search_my_process_keyrings(struct key_type *type,
         if (cred->thread_keyring) {
                 key_ref = keyring_search_aux(
                         make_key_ref(cred->thread_keyring, 1),
-                        cred, type, description, match);
+                        cred, type, description, match, no_state_check);
                 if (!IS_ERR(key_ref))
                         goto found;
 
@@ -371,7 +372,7 @@ key_ref_t search_my_process_keyrings(struct key_type *type,
         if (cred->tgcred->process_keyring) {
                 key_ref = keyring_search_aux(
                         make_key_ref(cred->tgcred->process_keyring, 1),
-                        cred, type, description, match);
+                        cred, type, description, match, no_state_check);
                 if (!IS_ERR(key_ref))
                         goto found;
 
@@ -395,7 +396,7 @@ key_ref_t search_my_process_keyrings(struct key_type *type,
                         make_key_ref(rcu_dereference(
                                              cred->tgcred->session_keyring),
                                      1),
-                        cred, type, description, match);
+                        cred, type, description, match, no_state_check);
                 rcu_read_unlock();
 
                 if (!IS_ERR(key_ref))
@@ -417,7 +418,7 @@ key_ref_t search_my_process_keyrings(struct key_type *type,
         else if (cred->user->session_keyring) {
                 key_ref = keyring_search_aux(
                         make_key_ref(cred->user->session_keyring, 1),
-                        cred, type, description, match);
+                        cred, type, description, match, no_state_check);
                 if (!IS_ERR(key_ref))
                         goto found;
 
@@ -459,7 +460,8 @@ key_ref_t search_process_keyrings(struct key_type *type,
 
         might_sleep();
 
-        key_ref = search_my_process_keyrings(type, description, match, cred);
+        key_ref = search_my_process_keyrings(type, description, match,
+                                             false, cred);
         if (!IS_ERR(key_ref))
                 goto found;
         err = key_ref;
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index df3c0417ee40..b18a71745901 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -530,8 +530,7 @@ struct key *request_key_and_link(struct key_type *type,
                dest_keyring, flags);
 
         /* search all the process keyrings for a key */
-        key_ref = search_process_keyrings(type, description, type->match,
-                                          cred);
+        key_ref = search_process_keyrings(type, description, type->match, cred);
 
         if (!IS_ERR(key_ref)) {
                 key = key_ref_to_ptr(key_ref);
diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
index 68164031a74e..f6337c9082eb 100644
--- a/security/keys/request_key_auth.c
+++ b/security/keys/request_key_auth.c
@@ -59,7 +59,8 @@ static void request_key_auth_describe(const struct key *key,
 
         seq_puts(m, "key:");
         seq_puts(m, key->description);
-        seq_printf(m, " pid:%d ci:%zu", rka->pid, rka->callout_len);
+        if (key_is_instantiated(key))
+                seq_printf(m, " pid:%d ci:%zu", rka->pid, rka->callout_len);
 }
 
 /*
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
index f66baf44f32d..5b366d7af3c4 100644
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -157,8 +157,8 @@ EXPORT_SYMBOL_GPL(user_destroy);
 void user_describe(const struct key *key, struct seq_file *m)
 {
         seq_puts(m, key->description);
-
-        seq_printf(m, ": %u", key->datalen);
+        if (key_is_instantiated(key))
+                seq_printf(m, ": %u", key->datalen);
 }
 
 EXPORT_SYMBOL_GPL(user_describe);
diff --git a/security/tomoyo/common.c b/security/tomoyo/common.c
index 7556315c1978..a0d09e56874b 100644
--- a/security/tomoyo/common.c
+++ b/security/tomoyo/common.c
@@ -108,10 +108,9 @@ static bool tomoyo_flush(struct tomoyo_io_buffer *head)
                         head->read_user_buf += len;
                         w += len;
                 }
-                if (*w) {
-                        head->r.w[0] = w;
+                head->r.w[0] = w;
+                if (*w)
                         return false;
-                }
                 /* Add '\0' for query. */
                 if (head->poll) {
                         if (!head->read_user_buf_avail ||
@@ -459,8 +458,16 @@ static int tomoyo_write_profile(struct tomoyo_io_buffer *head)
         if (profile == &tomoyo_default_profile)
                 return -EINVAL;
         if (!strcmp(data, "COMMENT")) {
-                const struct tomoyo_path_info *old_comment = profile->comment;
-                profile->comment = tomoyo_get_name(cp);
+                static DEFINE_SPINLOCK(lock);
+                const struct tomoyo_path_info *new_comment
+                        = tomoyo_get_name(cp);
+                const struct tomoyo_path_info *old_comment;
+                if (!new_comment)
+                        return -ENOMEM;
+                spin_lock(&lock);
+                old_comment = profile->comment;
+                profile->comment = new_comment;
+                spin_unlock(&lock);
                 tomoyo_put_name(old_comment);
                 return 0;
         }
diff --git a/security/tomoyo/file.c b/security/tomoyo/file.c
index cb09f1fce910..d64e8ecb6fb3 100644
--- a/security/tomoyo/file.c
+++ b/security/tomoyo/file.c
@@ -1011,7 +1011,6 @@ int tomoyo_path_perm(const u8 operation, struct path *path)
                 break;
         case TOMOYO_TYPE_RMDIR:
         case TOMOYO_TYPE_CHROOT:
-        case TOMOYO_TYPE_UMOUNT:
                 tomoyo_add_slash(&buf);
                 break;
         }
diff --git a/security/tomoyo/memory.c b/security/tomoyo/memory.c
index 297612669c74..42a7b1ba8cbf 100644
--- a/security/tomoyo/memory.c
+++ b/security/tomoyo/memory.c
@@ -75,6 +75,7 @@ void *tomoyo_commit_ok(void *data, const unsigned int size)
                 memset(data, 0, size);
                 return ptr;
         }
+        kfree(ptr);
         return NULL;
 }
 
diff --git a/security/tomoyo/mount.c b/security/tomoyo/mount.c
index 82bf8c2390bc..162a864dba24 100644
--- a/security/tomoyo/mount.c
+++ b/security/tomoyo/mount.c
@@ -143,6 +143,7 @@ static int tomoyo_mount_acl(struct tomoyo_request_info *r, char *dev_name,
                         goto out;
                 }
                 requested_dev_name = tomoyo_realpath_from_path(&path);
+                path_put(&path);
                 if (!requested_dev_name) {
                         error = -ENOENT;
                         goto out;
diff --git a/security/tomoyo/util.c b/security/tomoyo/util.c
index 9bfc1ee8222d..6d5393204d95 100644
--- a/security/tomoyo/util.c
+++ b/security/tomoyo/util.c
@@ -390,7 +390,7 @@ bool tomoyo_correct_domain(const unsigned char *domainname)
                 if (!cp)
                         break;
                 if (*domainname != '/' ||
-                    !tomoyo_correct_word2(domainname, cp - domainname - 1))
+                    !tomoyo_correct_word2(domainname, cp - domainname))
                         goto out;
                 domainname = cp + 1;
         }