1 files changed, 22 insertions, 11 deletions

diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index 3364fbf46807..6d9d0c747525 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -46,6 +46,9 @@ static int key_get_type_from_user(char *type,
  * Extract the description of a new key from userspace and either add it as a
  * new key to the specified keyring or update a matching key in that keyring.
  *
+ * If the description is NULL or an empty string, the key type is asked to
+ * generate one from the payload.
+ *
  * The keyring must be writable so that we can attach the key to it.
  *
  * If successful, the new key's serial number is returned, otherwise an error
@@ -72,10 +75,17 @@ SYSCALL_DEFINE5(add_key, const char __user *, _type,
         if (ret < 0)
                 goto error;
 
-        description = strndup_user(_description, PAGE_SIZE);
-        if (IS_ERR(description)) {
-                ret = PTR_ERR(description);
-                goto error;
+        description = NULL;
+        if (_description) {
+                description = strndup_user(_description, PAGE_SIZE);
+                if (IS_ERR(description)) {
+                        ret = PTR_ERR(description);
+                        goto error;
+                }
+                if (!*description) {
+                        kfree(description);
+                        description = NULL;
+                }
         }
 
         /* pull the payload in if one was supplied */
@@ -1112,12 +1122,12 @@ long keyctl_instantiate_key_iov(key_serial_t id,
         ret = rw_copy_check_uvector(WRITE, _payload_iov, ioc,
                                     ARRAY_SIZE(iovstack), iovstack, &iov);
         if (ret < 0)
-                return ret;
+                goto err;
         if (ret == 0)
                 goto no_payload_free;
 
         ret = keyctl_instantiate_key_common(id, iov, ioc, ret, ringid);
-
+err:
         if (iov != iovstack)
                 kfree(iov);
         return ret;
@@ -1475,7 +1485,8 @@ long keyctl_session_to_parent(void)
                 goto error_keyring;
         newwork = &cred->rcu;
 
-        cred->tgcred->session_keyring = key_ref_to_ptr(keyring_r);
+        cred->session_keyring = key_ref_to_ptr(keyring_r);
+        keyring_r = NULL;
         init_task_work(newwork, key_change_session_keyring);
 
         me = current;
@@ -1500,7 +1511,7 @@ long keyctl_session_to_parent(void)
         mycred = current_cred();
         pcred = __task_cred(parent);
         if (mycred == pcred ||
-            mycred->tgcred->session_keyring == pcred->tgcred->session_keyring) {
+            mycred->session_keyring == pcred->session_keyring) {
                 ret = 0;
                 goto unlock;
         }
@@ -1516,9 +1527,9 @@ long keyctl_session_to_parent(void)
                 goto unlock;
 
         /* the keyrings must have the same UID */
-        if ((pcred->tgcred->session_keyring &&
-             pcred->tgcred->session_keyring->uid != mycred->euid) ||
-            mycred->tgcred->session_keyring->uid != mycred->euid)
+        if ((pcred->session_keyring &&
+             pcred->session_keyring->uid != mycred->euid) ||
+            mycred->session_keyring->uid != mycred->euid)
                 goto unlock;
 
         /* cancel an already pending keyring replacement */