3 files changed, 183 insertions, 226 deletions

diff --git a/security/tomoyo/common.c b/security/tomoyo/common.c
index ae3ed7313ee0..a53ee059da48 100644
--- a/security/tomoyo/common.c
+++ b/security/tomoyo/common.c
@@ -1103,10 +1103,10 @@ static LIST_HEAD(tomoyo_policy_manager_list);
 static int tomoyo_update_manager_entry(const char *manager,
                                        const bool is_delete)
 {
-        struct tomoyo_policy_manager_entry *new_entry;
+        struct tomoyo_policy_manager_entry *entry = NULL;
         struct tomoyo_policy_manager_entry *ptr;
         const struct tomoyo_path_info *saved_manager;
-        int error = -ENOMEM;
+        int error = is_delete ? -ENOENT : -ENOMEM;
         bool is_domain = false;
 
         if (tomoyo_is_domain_def(manager)) {
@@ -1120,29 +1120,25 @@ static int tomoyo_update_manager_entry(const char *manager,
         saved_manager = tomoyo_save_name(manager);
         if (!saved_manager)
                 return -ENOMEM;
-        new_entry = kmalloc(sizeof(*new_entry), GFP_KERNEL);
+        if (!is_delete)
+                entry = kmalloc(sizeof(*entry), GFP_KERNEL);
         mutex_lock(&tomoyo_policy_lock);
         list_for_each_entry_rcu(ptr, &tomoyo_policy_manager_list, list) {
                 if (ptr->manager != saved_manager)
                         continue;
                 ptr->is_deleted = is_delete;
                 error = 0;
-                goto out;
+                break;
         }
-        if (is_delete) {
-                error = -ENOENT;
-                goto out;
+        if (!is_delete && error && tomoyo_memory_ok(entry)) {
+                entry->manager = saved_manager;
+                entry->is_domain = is_domain;
+                list_add_tail_rcu(&entry->list, &tomoyo_policy_manager_list);
+                entry = NULL;
+                error = 0;
         }
-        if (!tomoyo_memory_ok(new_entry))
-                goto out;
-        new_entry->manager = saved_manager;
-        new_entry->is_domain = is_domain;
-        list_add_tail_rcu(&new_entry->list, &tomoyo_policy_manager_list);
-        new_entry = NULL;
-        error = 0;
- out:
         mutex_unlock(&tomoyo_policy_lock);
-        kfree(new_entry);
+        kfree(entry);
         return error;
 }
 
diff --git a/security/tomoyo/domain.c b/security/tomoyo/domain.c
index ec612ae87b51..229de1e71a38 100644
--- a/security/tomoyo/domain.c
+++ b/security/tomoyo/domain.c
@@ -201,11 +201,11 @@ static int tomoyo_update_domain_initializer_entry(const char *domainname,
                                                   const bool is_not,
                                                   const bool is_delete)
 {
-        struct tomoyo_domain_initializer_entry *new_entry;
+        struct tomoyo_domain_initializer_entry *entry = NULL;
         struct tomoyo_domain_initializer_entry *ptr;
         const struct tomoyo_path_info *saved_program;
         const struct tomoyo_path_info *saved_domainname = NULL;
-        int error = -ENOMEM;
+        int error = is_delete ? -ENOENT : -ENOMEM;
         bool is_last_name = false;
 
         if (!tomoyo_is_correct_path(program, 1, -1, -1, __func__))
@@ -218,12 +218,13 @@ static int tomoyo_update_domain_initializer_entry(const char *domainname,
                         return -EINVAL;
                 saved_domainname = tomoyo_save_name(domainname);
                 if (!saved_domainname)
-                        return -ENOMEM;
+                        goto out;
         }
         saved_program = tomoyo_save_name(program);
         if (!saved_program)
-                return -ENOMEM;
-        new_entry = kmalloc(sizeof(*new_entry), GFP_KERNEL);
+                goto out;
+        if (!is_delete)
+                entry = kmalloc(sizeof(*entry), GFP_KERNEL);
         mutex_lock(&tomoyo_policy_lock);
         list_for_each_entry_rcu(ptr, &tomoyo_domain_initializer_list, list) {
                 if (ptr->is_not != is_not ||
@@ -232,24 +233,21 @@ static int tomoyo_update_domain_initializer_entry(const char *domainname,
                         continue;
                 ptr->is_deleted = is_delete;
                 error = 0;
-                goto out;
+                break;
         }
-        if (is_delete) {
-                error = -ENOENT;
-                goto out;
+        if (!is_delete && error && tomoyo_memory_ok(entry)) {
+                entry->domainname = saved_domainname;
+                entry->program = saved_program;
+                entry->is_not = is_not;
+                entry->is_last_name = is_last_name;
+                list_add_tail_rcu(&entry->list,
+                                  &tomoyo_domain_initializer_list);
+                entry = NULL;
+                error = 0;
         }
-        if (!tomoyo_memory_ok(new_entry))
-                goto out;
-        new_entry->domainname = saved_domainname;
-        new_entry->program = saved_program;
-        new_entry->is_not = is_not;
-        new_entry->is_last_name = is_last_name;
-        list_add_tail_rcu(&new_entry->list, &tomoyo_domain_initializer_list);
-        new_entry = NULL;
-        error = 0;
- out:
         mutex_unlock(&tomoyo_policy_lock);
-        kfree(new_entry);
+ out:
+        kfree(entry);
         return error;
 }
 
@@ -419,11 +417,11 @@ static int tomoyo_update_domain_keeper_entry(const char *domainname,
                                              const bool is_not,
                                              const bool is_delete)
 {
-        struct tomoyo_domain_keeper_entry *new_entry;
+        struct tomoyo_domain_keeper_entry *entry = NULL;
         struct tomoyo_domain_keeper_entry *ptr;
         const struct tomoyo_path_info *saved_domainname;
         const struct tomoyo_path_info *saved_program = NULL;
-        int error = -ENOMEM;
+        int error = is_delete ? -ENOENT : -ENOMEM;
         bool is_last_name = false;
 
         if (!tomoyo_is_domain_def(domainname) &&
@@ -436,12 +434,13 @@ static int tomoyo_update_domain_keeper_entry(const char *domainname,
                         return -EINVAL;
                 saved_program = tomoyo_save_name(program);
                 if (!saved_program)
-                        return -ENOMEM;
+                        goto out;
         }
         saved_domainname = tomoyo_save_name(domainname);
         if (!saved_domainname)
-                return -ENOMEM;
-        new_entry = kmalloc(sizeof(*new_entry), GFP_KERNEL);
+                goto out;
+        if (!is_delete)
+                entry = kmalloc(sizeof(*entry), GFP_KERNEL);
         mutex_lock(&tomoyo_policy_lock);
         list_for_each_entry_rcu(ptr, &tomoyo_domain_keeper_list, list) {
                 if (ptr->is_not != is_not ||
@@ -450,24 +449,20 @@ static int tomoyo_update_domain_keeper_entry(const char *domainname,
                         continue;
                 ptr->is_deleted = is_delete;
                 error = 0;
-                goto out;
+                break;
         }
-        if (is_delete) {
+        if (!is_delete && error && tomoyo_memory_ok(entry)) {