9 files changed, 84 insertions, 73 deletions

diff --git a/fs/ecryptfs/Kconfig b/fs/ecryptfs/Kconfig
index 0c754e64232b..1cd6d9d3e29a 100644
--- a/fs/ecryptfs/Kconfig
+++ b/fs/ecryptfs/Kconfig
@@ -1,6 +1,9 @@
 config ECRYPT_FS
         tristate "eCrypt filesystem layer support (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && KEYS && CRYPTO && NET
+        depends on EXPERIMENTAL && KEYS && CRYPTO
+        select CRYPTO_ECB
+        select CRYPTO_CBC
+        select CRYPTO_MD5
         help
           Encrypted filesystem that operates on the VFS layer.  See
           <file:Documentation/filesystems/ecryptfs.txt> to learn more about
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index b91851f1cda3..fbb6e5eed697 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -245,13 +245,11 @@ void ecryptfs_destroy_crypt_stat(struct ecryptfs_crypt_stat *crypt_stat)
                 crypto_free_blkcipher(crypt_stat->tfm);
         if (crypt_stat->hash_tfm)
                 crypto_free_hash(crypt_stat->hash_tfm);
-        mutex_lock(&crypt_stat->keysig_list_mutex);
         list_for_each_entry_safe(key_sig, key_sig_tmp,
                                  &crypt_stat->keysig_list, crypt_stat_list) {
                 list_del(&key_sig->crypt_stat_list);
                 kmem_cache_free(ecryptfs_key_sig_cache, key_sig);
         }
-        mutex_unlock(&crypt_stat->keysig_list_mutex);
         memset(crypt_stat, 0, sizeof(struct ecryptfs_crypt_stat));
 }
 
@@ -511,13 +509,14 @@ int ecryptfs_encrypt_page(struct page *page)
                                   + extent_offset), crypt_stat);
                 rc = ecryptfs_write_lower(ecryptfs_inode, enc_extent_virt,
                                           offset, crypt_stat->extent_size);
-                if (rc) {
+                if (rc < 0) {
                         ecryptfs_printk(KERN_ERR, "Error attempting "
                                         "to write lower page; rc = [%d]"
                                         "\n", rc);
                         goto out;
                 }
         }
+        rc = 0;
 out:
         if (enc_extent_page) {
                 kunmap(enc_extent_page);
@@ -633,7 +632,7 @@ int ecryptfs_decrypt_page(struct page *page)
                 rc = ecryptfs_read_lower(enc_extent_virt, offset,
                                          crypt_stat->extent_size,
                                          ecryptfs_inode);
-                if (rc) {
+                if (rc < 0) {
                         ecryptfs_printk(KERN_ERR, "Error attempting "
                                         "to read lower page; rc = [%d]"
                                         "\n", rc);
@@ -797,6 +796,7 @@ int ecryptfs_init_crypt_ctx(struct ecryptfs_crypt_stat *crypt_stat)
         kfree(full_alg_name);
         if (IS_ERR(crypt_stat->tfm)) {
                 rc = PTR_ERR(crypt_stat->tfm);
+                crypt_stat->tfm = NULL;
                 ecryptfs_printk(KERN_ERR, "cryptfs: init_crypt_ctx(): "
                                 "Error initializing cipher [%s]\n",
                                 crypt_stat->cipher);
@@ -925,7 +925,9 @@ static int ecryptfs_copy_mount_wide_sigs_to_inode_sigs(
         struct ecryptfs_global_auth_tok *global_auth_tok;
         int rc = 0;
 
+        mutex_lock(&crypt_stat->keysig_list_mutex);
         mutex_lock(&mount_crypt_stat->global_auth_tok_list_mutex);
+
         list_for_each_entry(global_auth_tok,
                             &mount_crypt_stat->global_auth_tok_list,
                             mount_crypt_stat_list) {
@@ -934,13 +936,13 @@ static int ecryptfs_copy_mount_wide_sigs_to_inode_sigs(
                 rc = ecryptfs_add_keysig(crypt_stat, global_auth_tok->sig);
                 if (rc) {
                         printk(KERN_ERR "Error adding keysig; rc = [%d]\n", rc);
-                        mutex_unlock(
-                                &mount_crypt_stat->global_auth_tok_list_mutex);
                         goto out;
                 }
         }
-        mutex_unlock(&mount_crypt_stat->global_auth_tok_list_mutex);
+
 out:
+        mutex_unlock(&mount_crypt_stat->global_auth_tok_list_mutex);
+        mutex_unlock(&crypt_stat->keysig_list_mutex);
         return rc;
 }
 
@@ -1212,14 +1214,15 @@ int ecryptfs_read_and_validate_header_region(char *data,
                 crypt_stat->extent_size = ECRYPTFS_DEFAULT_EXTENT_SIZE;
         rc = ecryptfs_read_lower(data, 0, crypt_stat->extent_size,
                                  ecryptfs_inode);
-        if (rc) {
+        if (rc < 0) {
                 printk(KERN_ERR "%s: Error reading header region; rc = [%d]\n",
                        __func__, rc);
                 goto out;
         }
         if (!contains_ecryptfs_marker(data + ECRYPTFS_FILE_SIZE_BYTES)) {
                 rc = -EINVAL;
-        }
+        } else
+                rc = 0;
 out:
         return rc;
 }
@@ -1314,10 +1317,11 @@ ecryptfs_write_metadata_to_contents(struct dentry *ecryptfs_dentry,
 
         rc = ecryptfs_write_lower(ecryptfs_dentry->d_inode, virt,
                                   0, virt_len);
-        if (rc)
+        if (rc < 0)
                 printk(KERN_ERR "%s: Error attempting to write header "
-                       "information to lower file; rc = [%d]\n", __func__,
-                       rc);
+                       "information to lower file; rc = [%d]\n", __func__, rc);
+        else
+                rc = 0;
         return rc;
 }
 
@@ -1597,7 +1601,7 @@ int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry)
         }
         rc = ecryptfs_read_lower(page_virt, 0, crypt_stat->extent_size,
                                  ecryptfs_inode);
-        if (!rc)
+        if (rc >= 0)
                 rc = ecryptfs_read_headers_virt(page_virt, crypt_stat,
                                                 ecryptfs_dentry,
                                                 ECRYPTFS_VALIDATE_HEADER_SIZE);
@@ -1702,7 +1706,7 @@ ecryptfs_encrypt_filename(struct ecryptfs_filename *filename,
         } else {
                 printk(KERN_ERR "%s: No support for requested filename "
                        "encryption method in this release\n", __func__);
-                rc = -ENOTSUPP;
+                rc = -EOPNOTSUPP;
                 goto out;
         }
 out:
@@ -1763,7 +1767,7 @@ ecryptfs_process_key_cipher(struct crypto_blkcipher **key_tfm,
         if (IS_ERR(*key_tfm)) {
                 rc = PTR_ERR(*key_tfm);
                 printk(KERN_ERR "Unable to allocate crypto cipher with name "
-                       "[%s]; rc = [%d]\n", cipher_name, rc);
+                       "[%s]; rc = [%d]\n", full_alg_name, rc);
                 goto out;
         }
         crypto_blkcipher_set_flags(*key_tfm, CRYPTO_TFM_REQ_WEAK_KEY);
@@ -1776,7 +1780,8 @@ ecryptfs_process_key_cipher(struct crypto_blkcipher **key_tfm,
         rc = crypto_blkcipher_setkey(*key_tfm, dummy_key, *key_size);
         if (rc) {
                 printk(KERN_ERR "Error attempting to set key of size [%zd] for "
-                       "cipher [%s]; rc = [%d]\n", *key_size, cipher_name, rc);
+                       "cipher [%s]; rc = [%d]\n", *key_size, full_alg_name,
+                       rc);
                 rc = -EINVAL;
                 goto out;
         }
@@ -2166,7 +2171,7 @@ int ecryptfs_encrypt_and_encode_filename(
                         (*encoded_name)[(*encoded_name_size)] = '\0';
                         (*encoded_name_size)++;
                 } else {
-                        rc = -ENOTSUPP;
+                        rc = -EOPNOTSUPP;
                 }
                 if (rc) {
                         printk(KERN_ERR "%s: Error attempting to encode "
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index 2f0945d63297..056fed62d0de 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -476,6 +476,7 @@ static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry)
         struct inode *lower_dir_inode = ecryptfs_inode_to_lower(dir);
         struct dentry *lower_dir_dentry;
 
+        dget(lower_dentry);
         lower_dir_dentry = lock_parent(lower_dentry);
         rc = vfs_unlink(lower_dir_inode, lower_dentry);
         if (rc) {
@@ -489,6 +490,7 @@ static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry)
         d_drop(dentry);
 out_unlock:
         unlock_dir(lower_dir_dentry);
+        dput(lower_dentry);
         return rc;
 }
 
diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index 259525c9abb8..a0a7847567e9 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -416,7 +416,9 @@ ecryptfs_find_global_auth_tok_for_sig(
                             &mount_crypt_stat->global_auth_tok_list,
                             mount_crypt_stat_list) {
                 if (memcmp(walker->sig, sig, ECRYPTFS_SIG_SIZE_HEX) == 0) {
-                        (*global_auth_tok) = walker;
+                        rc = key_validate(walker->global_auth_tok_key);
+                        if (!rc)
+                                (*global_auth_tok) = walker;
                         goto out;
                 }
         }
@@ -612,7 +614,12 @@ ecryptfs_write_tag_70_packet(char *dest, size_t *remaining_bytes,
         }
         /* TODO: Support other key modules than passphrase for
          * filename encryption */
-        BUG_ON(s->auth_tok->token_type != ECRYPTFS_PASSWORD);
+        if (s->auth_tok->token_type != ECRYPTFS_PASSWORD) {
+                rc = -EOPNOTSUPP;
+                printk(KERN_INFO "%s: Filename encryption only supports "
+                       "password tokens\n", __func__);
+                goto out_free_unlock;
+        }
         sg_init_one(
                 &s->hash_sg,
                 (u8 *)s->auth_tok->token.password.session_key_encryption_key,
@@ -910,7 +917,12 @@ ecryptfs_parse_tag_70_packet(char **filename, size_t *filename_size,
         }
         /* TODO: Support other key modules than passphrase for
          * filename encryption */
-        BUG_ON(s->auth_tok->token_type != ECRYPTFS_PASSWORD);
+        if (s->auth_tok->token_type != ECRYPTFS_PASSWORD) {
+                rc = -EOPNOTSUPP;
+                printk(KERN_INFO "%s: Filename encryption only supports "
+                       "password tokens\n", __func__);
+                goto out_free_unlock;
+        }
         rc = crypto_blkcipher_setkey(
                 s->desc.tfm,
                 s->auth_tok->token.password.session_key_encryption_key,
@@ -1316,8 +1328,10 @@ parse_tag_3_packet(struct ecryptfs_crypt_stat *crypt_stat,
                 rc = -EINVAL;
                 goto out_free;
         }
-        ecryptfs_cipher_code_to_string(crypt_stat->cipher,
-                                       (u16)data[(*packet_size)]);
+        rc = ecryptfs_cipher_code_to_string(crypt_stat->cipher,
+                                            (u16)data[(*packet_size)]);
+        if (rc)
+                goto out_free;
         /* A little extra work to differentiate among the AES key
          * sizes; see RFC2440 */
         switch(data[(*packet_size)++]) {
@@ -1328,7 +1342,9 @@ parse_tag_3_packet(struct ecryptfs_crypt_stat *crypt_stat,
                 crypt_stat->key_size =
                         (*new_auth_tok)->session_key.encrypted_key_size;
         }
-        ecryptfs_init_crypt_ctx(crypt_stat);
+        rc = ecryptfs_init_crypt_ctx(crypt_stat);
+        if (rc)
+                goto out_free;
         if (unlikely(data[(*packet_size)++] != 0x03)) {
                 printk(KERN_WARNING "Only S2K ID 3 is currently supported\n");
                 rc = -ENOSYS;
@@ -2366,21 +2382,18 @@ struct kmem_cache *ecryptfs_key_sig_cache;
 int ecryptfs_add_keysig(struct ecryptfs_crypt_stat *crypt_stat, char *sig)
 {
         struct ecryptfs_key_sig *new_key_sig;
-        int rc = 0;
 
         new_key_sig = kmem_cache_alloc(ecryptfs_key_sig_cache, GFP_KERNEL);
         if (!new_key_sig) {
-                rc = -ENOMEM;
                 printk(KERN_ERR
                        "Error allocating from ecryptfs_key_sig_cache\n");
-                goto out;
+                return -ENOMEM;
         }
         memcpy(new_key_sig->keysig, sig, ECRYPTFS_SIG_SIZE_HEX);
-        mutex_lock(&crypt_stat->keysig_list_mutex);
+        /* Caller must hold keysig_list_mutex */
         list_add(&new_key_sig->crypt_stat_list, &crypt_stat->keysig_list);
-        mutex_unlock(&crypt_stat->keysig_list_mutex);
-out:
-        return rc;
+
+        return 0;
 }
 
 struct kmem_cache *ecryptfs_global_auth_tok_cache;
diff --git a/fs/ecryptfs/kthread.c b/fs/ecryptfs/kthread.c
index c6d7a4d748a0..e14cf7e588db 100644
--- a/fs/ecryptfs/kthread.c
+++ b/fs/ecryptfs/kthread.c
@@ -136,6 +136,7 @@ int ecryptfs_privileged_open(struct file **lower_file,
                              const struct cred *cred)
 {
         struct ecryptfs_open_req *req;
+        int flags = O_LARGEFILE;
         int rc = 0;
 
         /* Corresponding dput() and mntput() are done when the
@@ -143,10 +144,14 @@ int ecryptfs_privileged_open(struct file **lower_file,
          * destroyed. */
         dget(lower_dentry);
         mntget(lower_mnt);
-        (*lower_file) = dentry_open(lower_dentry, lower_mnt,
-                                    (O_RDWR | O_LARGEFILE), cred);
+        flags |= IS_RDONLY(lower_dentry->d_inode) ? O_RDONLY : O_RDWR;
+        (*lower_file) = dentry_open(lower_dentry, lower_mnt, flags, cred);
         if (!IS_ERR(*lower_file))
                 goto out;
+        if (flags & O_RDONLY) {
+                rc = PTR_ERR((*lower_file));
+                goto out;
+        }
         req = kmem_cache_alloc(ecryptfs_open_req_cache, GFP_KERNEL);
         if (!req) {
                 rc = -ENOMEM;
@@ -180,21 +185,8 @@ int ecryptfs_privileged_open(struct file **lower_file,
                        __func__);
                 goto out_unlock;
         }
-        if (IS_ERR(*req->lower_file)) {
+        if (IS_ERR(*req->lower_file))
                 rc = PTR_ERR(*req->lower_file);
-                dget(lower_dentry);
-                mntget(lower_mnt);
-                (*lower_file) = dentry_open(lower_dentry, lower_mnt,
-                                            (O_RDONLY | O_LARGEFILE), cred);
-                if (IS_ERR(*lower_file)) {
-                        rc = PTR_ERR(*req->lower_file);
-                        (*lower_file) = NULL;
-                        printk(KERN_WARNING "%s: Error attempting privileged "
-                               "open of lower file with either RW or RO "
-                               "perms; rc = [%d]. Giving up.\n",
-                               __func__, rc);
-                }
-        }
 out_unlock:
         mutex_unlock(&req->mux);
 out_free:
diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
index 9f0aa9883c28..c6ac85d6c701 100644
--- a/fs/ecryptfs/main.c
+++ b/fs/ecryptfs/main.c
@@ -35,6 +35,7 @@
 #include <linux/key.h>
 #include <linux/parser.h>
 #include <linux/fs_stack.h>
+#include <linux/ima.h>
 #include "ecryptfs_kernel.h"
 
 /**
@@ -118,6 +119,7 @@ int ecryptfs_init_persistent_file(struct dentry *ecryptfs_dentry)
         const struct cred *cred = current_cred();
         struct ecryptfs_inode_info *inode_info =
                 ecryptfs_inode_to_private(ecryptfs_dentry->d_inode);
+        int opened_lower_file = 0;
         int rc = 0;
 
         mutex_lock(&inode_info->lower_file_mutex);
@@ -129,15 +131,17 @@ int ecryptfs_init_persistent_file(struct dentry *ecryptfs_dentry)
                 lower_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry);
                 rc = ecryptfs_privileged_open(&inode_info->lower_file,
                                               lower_dentry, lower_mnt, cred);
-                if (rc || IS_ERR(inode_info->lower_file)) {
+                if (rc) {
                         printk(KERN_ERR "Error opening lower persistent file "
                                "for lower_dentry [0x%p] and lower_mnt [0x%p]; "
                                "rc = [%d]\n", lower_dentry, lower_mnt, rc);
-                        rc = PTR_ERR(inode_info->lower_file);
                         inode_info->lower_file = NULL;
-                }
+                } else
+                        opened_lower_file = 1;
         }
         mutex_unlock(&inode_info->lower_file_mutex);
+        if (opened_lower_file)
+                ima_counts_get(inode_info->lower_file);
         return rc;
 }
 
diff --git a/fs/ecryptfs/mmap.c b/fs/ecryptfs/mmap.c
index 05772aeaa8f4..df4ce99d0597 100644
--- a/fs/ecryptfs/mmap.c
+++ b/fs/ecryptfs/mmap.c
@@ -396,9 +396,11 @@ static int ecryptfs_write_inode_size_to_header(struct inode *ecryptfs_inode)
         rc = ecryptfs_write_lower(ecryptfs_inode, file_size_virt, 0,
                                   sizeof(u64));
         kfree(file_size_virt);
-        if (rc)
+        if (rc < 0)
                 printk(KERN_ERR "%s: Error writing file size to header; "
                        "rc = [%d]\n", __func__, rc);
+        else
+                rc = 0;
 out:
         return rc;
 }
diff --git a/fs/ecryptfs/read_write.c b/fs/ecryptfs/read_write.c
index a137c6ea2fee..0cc4fafd6552 100644
--- a/fs/ecryptfs/read_write.c
+++ b/fs/ecryptfs/read_write.c
@@ -34,15 +34,14 @@
  *
  * Write data to the lower file.
  *
- * Returns zero on success; non-zero on error
+ * Returns bytes written on success; less than zero on error
  */
 int ecryptfs_write_lower(struct inode *ecryptfs_inode, char *data,
                          loff_t offset, size_t size)
 {
         struct ecryptfs_inode_info *inode_info;
-        ssize_t octets_written;
         mm_segment_t fs_save;
-        int rc = 0;
+        ssize_t rc;
 
         inode_info = ecryptfs_inode_to_private(ecryptfs_inode);
         mutex_lock(&inode_info->lower_file_mutex);
@@ -50,14 +49,9 @@ int ecryptfs_write_lower(struct inode *ecryptfs_inode, char *data,
         inode_info->lower_file->f_pos = offset;
         fs_save = get_fs();
         set_fs(get_ds());
-        octets_written = vfs_write(inode_info->lower_file, data, size,
-                                   &inode_info->lower_file->f_pos);
+        rc = vfs_write(inode_info->lower_file, data, size,
+                       &inode_info->lower_file->f_pos);
         set_fs(fs_save);
-        if (octets_written < 0) {
-                printk(KERN_ERR "%s: octets_written = [%td]; "
-                       "expected [%td]\n", __func__, octets_written, size);
-                rc = -EINVAL;
-        }
         mutex_unlock(&inode_info->lower_file_mutex);
         mark_inode_dirty_sync(ecryptfs_inode);
         return rc;
@@ -91,6 +85,8 @@ int ecryptfs_write_lower_page_segment(struct inode *ecryptfs_inode,
                   + offset_in_page);
         virt = kmap(page_for_lower);
         rc = ecryptfs_write_lower(ecryptfs_inode, virt, offset, size);
+        if (rc > 0)
+                rc = 0;
         kunmap(page_for_lower);
         return rc;
 }
@@ -229,30 +225,24 @@ out:
  * Read @size bytes of data at byte offset @offset from the lower
  * inode into memory location @data.
  *
- * Returns zero on success; non-zero on error
+ * Returns bytes read on success; 0 on EOF; less than zero on error
  */
 int ecryptfs_read_lower(char *data, loff_t offset, size_t size,
                         struct inode *ecryptfs_inode)
 {
         struct ecryptfs_inode_info *inode_info =
                 ecryptfs_inode_to_private(ecryptfs_inode);
-        ssize_t octets_read;
         mm_segment_t fs_save;
-        int rc = 0;
+        ssize_t rc;
 
         mutex_lock(&inode_info->lower_file_mutex);
         BUG_ON(!inode_info->lower_file);
         inode_info->lower_file->f_pos = offset;
         fs_save = get_fs();
         set_fs(get_ds());
-        octets_read = vfs_read(inode_info->lower_file, data, size,
-                               &inode_info->lower_file->f_pos);
+        rc = vfs_read(inode_info->lower_file, data, size,
+                      &inode_info->lower_file->f_pos);
         set_fs(fs_save);
-        if (octets_read < 0) {
-                printk(KERN_ERR "%s: octets_read = [%td]; "
-                       "expected [%td]\n", __func__, octets_read, size);
-                rc = -EINVAL;
-        }
         mutex_unlock(&inode_info->lower_file_mutex);
         return rc;
 }
@@ -284,6 +274,8 @@ int ecryptfs_read_lower_page_segment(struct page *page_for_ecryptfs,
         offset = ((((loff_t)page_index) << PAGE_CACHE_SHIFT) + offset_in_page);
         virt = kmap(page_for_ecryptfs);
         rc = ecryptfs_read_lower(virt, offset, size, ecryptfs_inode);
+        if (rc > 0)
+                rc = 0;
         kunmap(page_for_ecryptfs);
         flush_dcache_page(page_for_ecryptfs);
         return rc;
diff --git a/fs/ecryptfs/super.c b/fs/ecryptfs/super.c
index 12d649602d3a..b15a43a80ab7 100644
--- a/fs/ecryptfs/super.c
+++ b/fs/ecryptfs/super.c
@@ -77,7 +77,6 @@ static void ecryptfs_destroy_inode(struct inode *inode)
         struct ecryptfs_inode_info *inode_info;
 
         inode_info = ecryptfs_inode_to_private(inode);
-        mutex_lock(&inode_info->lower_file_mutex);
         if (inode_info->lower_file) {
                 struct dentry *lower_dentry =
                         inode_info->lower_file->f_dentry;
@@ -89,7 +88,6 @@ static void ecryptfs_destroy_inode(struct inode *inode)
                         d_drop(lower_dentry);
                 }
         }
-        mutex_unlock(&inode_info->lower_file_mutex);
         ecryptfs_destroy_crypt_stat(&inode_info->crypt_stat);
         kmem_cache_free(ecryptfs_inode_info_cache, inode_info);
 }