Merge tag 'v3.16' into next

Linux 3.16

27 files changed, 490 insertions, 175 deletions

diff --git a/security/capability.c b/security/capability.c
index ad0d4de69944..e76373de3129 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -879,7 +879,7 @@ static void cap_key_free(struct key *key)
 }
 
 static int cap_key_permission(key_ref_t key_ref, const struct cred *cred,
-                              key_perm_t perm)
+                              unsigned perm)
 {
         return 0;
 }
diff --git a/security/device_cgroup.c b/security/device_cgroup.c
index 9134dbf70d3e..d9d69e6930ed 100644
--- a/security/device_cgroup.c
+++ b/security/device_cgroup.c
@@ -182,7 +182,7 @@ static inline bool is_devcg_online(const struct dev_cgroup *devcg)
 static int devcgroup_online(struct cgroup_subsys_state *css)
 {
         struct dev_cgroup *dev_cgroup = css_to_devcgroup(css);
-        struct dev_cgroup *parent_dev_cgroup = css_to_devcgroup(css_parent(css));
+        struct dev_cgroup *parent_dev_cgroup = css_to_devcgroup(css->parent);
         int ret = 0;
 
         mutex_lock(&devcgroup_mutex);
@@ -455,7 +455,7 @@ static bool verify_new_ex(struct dev_cgroup *dev_cgroup,
 static int parent_has_perm(struct dev_cgroup *childcg,
                                   struct dev_exception_item *ex)
 {
-        struct dev_cgroup *parent = css_to_devcgroup(css_parent(&childcg->css));
+        struct dev_cgroup *parent = css_to_devcgroup(childcg->css.parent);
 
         if (!parent)
                 return 1;
@@ -476,7 +476,7 @@ static int parent_has_perm(struct dev_cgroup *childcg,
 static bool parent_allows_removal(struct dev_cgroup *childcg,
                                   struct dev_exception_item *ex)
 {
-        struct dev_cgroup *parent = css_to_devcgroup(css_parent(&childcg->css));
+        struct dev_cgroup *parent = css_to_devcgroup(childcg->css.parent);
 
         if (!parent)
                 return true;
@@ -587,13 +587,6 @@ static int propagate_exception(struct dev_cgroup *devcg_root,
         return rc;
 }
 
-static inline bool has_children(struct dev_cgroup *devcgroup)
-{
-        struct cgroup *cgrp = devcgroup->css.cgroup;
-
-        return !list_empty(&cgrp->children);
-}
-
 /*
  * Modify the exception list using allow/deny rules.
  * CAP_SYS_ADMIN is needed for this.  It's at least separate from CAP_MKNOD
@@ -614,7 +607,7 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
         char temp[12];          /* 11 + 1 characters needed for a u32 */
         int count, rc = 0;
         struct dev_exception_item ex;
-        struct dev_cgroup *parent = css_to_devcgroup(css_parent(&devcgroup->css));
+        struct dev_cgroup *parent = css_to_devcgroup(devcgroup->css.parent);
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
@@ -626,7 +619,7 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
         case 'a':
                 switch (filetype) {
                 case DEVCG_ALLOW:
-                        if (has_children(devcgroup))
+                        if (css_has_online_children(&devcgroup->css))
                                 return -EINVAL;
 
                         if (!may_allow_all(parent))
@@ -642,7 +635,7 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
                                 return rc;
                         break;
                 case DEVCG_DENY:
-                        if (has_children(devcgroup))
+                        if (css_has_online_children(&devcgroup->css))
                                 return -EINVAL;
 
                         dev_exception_clean(devcgroup);
@@ -767,27 +760,27 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
         return rc;
 }
 
-static int devcgroup_access_write(struct cgroup_subsys_state *css,
-                                  struct cftype *cft, char *buffer)
+static ssize_t devcgroup_access_write(struct kernfs_open_file *of,
+                                      char *buf, size_t nbytes, loff_t off)
 {
         int retval;
 
         mutex_lock(&devcgroup_mutex);
-        retval = devcgroup_update_access(css_to_devcgroup(css),
-                                         cft->private, buffer);
+        retval = devcgroup_update_access(css_to_devcgroup(of_css(of)),
+                                         of_cft(of)->private, strstrip(buf));
         mutex_unlock(&devcgroup_mutex);
-        return retval;
+        return retval ?: nbytes;
 }
 
 static struct cftype dev_cgroup_files[] = {
         {
                 .name = "allow",
-                .write_string  = devcgroup_access_write,
+                .write = devcgroup_access_write,
                 .private = DEVCG_ALLOW,
         },
         {
                 .name = "deny",
-                .write_string = devcgroup_access_write,
+                .write = devcgroup_access_write,
                 .private = DEVCG_DENY,
         },
         {
diff --git a/security/integrity/evm/Kconfig b/security/integrity/evm/Kconfig
index d35b4915b00d..d606f3d12d6b 100644
--- a/security/integrity/evm/Kconfig
+++ b/security/integrity/evm/Kconfig
@@ -12,15 +12,41 @@ config EVM
 
           If you are unsure how to answer this question, answer N.