1 files changed, 18 insertions, 5 deletions

diff --git a/security/keys/key.c b/security/keys/key.c
index 46f125aa7fa3..14948cf83ef6 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -27,6 +27,11 @@ DEFINE_SPINLOCK(key_serial_lock);
 struct rb_root  key_user_tree; /* tree of quota records indexed by UID */
 DEFINE_SPINLOCK(key_user_lock);
 
+unsigned int key_quota_root_maxkeys = 200;      /* root's key count quota */
+unsigned int key_quota_root_maxbytes = 20000;   /* root's key space quota */
+unsigned int key_quota_maxkeys = 200;           /* general key count quota */
+unsigned int key_quota_maxbytes = 20000;        /* general key space quota */
+
 static LIST_HEAD(key_types_list);
 static DECLARE_RWSEM(key_types_sem);
 
@@ -236,11 +241,16 @@ struct key *key_alloc(struct key_type *type, const char *desc,
         /* check that the user's quota permits allocation of another key and
          * its description */
         if (!(flags & KEY_ALLOC_NOT_IN_QUOTA)) {
+                unsigned maxkeys = (uid == 0) ?
+                        key_quota_root_maxkeys : key_quota_maxkeys;
+                unsigned maxbytes = (uid == 0) ?
+                        key_quota_root_maxbytes : key_quota_maxbytes;
+
                 spin_lock(&user->lock);
                 if (!(flags & KEY_ALLOC_QUOTA_OVERRUN)) {
-                        if (user->qnkeys + 1 >= KEYQUOTA_MAX_KEYS ||
-                            user->qnbytes + quotalen >= KEYQUOTA_MAX_BYTES
-                            )
+                        if (user->qnkeys + 1 >= maxkeys ||
+                            user->qnbytes + quotalen >= maxbytes ||
+                            user->qnbytes + quotalen < user->qnbytes)
                                 goto no_quota;
                 }
 
@@ -345,11 +355,14 @@ int key_payload_reserve(struct key *key, size_t datalen)
 
         /* contemplate the quota adjustment */
         if (delta != 0 && test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) {
+                unsigned maxbytes = (key->user->uid == 0) ?
+                        key_quota_root_maxbytes : key_quota_maxbytes;
+
                 spin_lock(&key->user->lock);
 
                 if (delta > 0 &&
-                    key->user->qnbytes + delta > KEYQUOTA_MAX_BYTES
-                    ) {
+                    (key->user->qnbytes + delta >= maxbytes ||
+                     key->user->qnbytes + delta < key->user->qnbytes)) {
                         ret = -EDQUOT;
                 }
                 else {