8 files changed, 279 insertions, 182 deletions

diff --git a/security/keys/internal.h b/security/keys/internal.h
index 24ba0307b7ad..5d4402a1161a 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -87,7 +87,16 @@ extern wait_queue_head_t request_key_conswq;
 extern struct key_type *key_type_lookup(const char *type);
 extern void key_type_put(struct key_type *ktype);
 
-extern int __key_link(struct key *keyring, struct key *key);
+extern int __key_link_begin(struct key *keyring,
+                            const struct key_type *type,
+                            const char *description,
+                            struct keyring_list **_prealloc);
+extern int __key_link_check_live_key(struct key *keyring, struct key *key);
+extern void __key_link(struct key *keyring, struct key *key,
+                       struct keyring_list **_prealloc);
+extern void __key_link_end(struct key *keyring,
+                           struct key_type *type,
+                           struct keyring_list *prealloc);
 
 extern key_ref_t __keyring_search_one(key_ref_t keyring_ref,
                                       const struct key_type *type,
diff --git a/security/keys/key.c b/security/keys/key.c
index e50d264c9ad1..c1eac8084ade 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -355,7 +355,7 @@ EXPORT_SYMBOL(key_alloc);
  */
 int key_payload_reserve(struct key *key, size_t datalen)
 {
-        int delta = (int) datalen - key->datalen;
+        int delta = (int)datalen - key->datalen;
         int ret = 0;
 
         key_check(key);
@@ -398,7 +398,8 @@ static int __key_instantiate_and_link(struct key *key,
                                       const void *data,
                                       size_t datalen,
                                       struct key *keyring,
-                                      struct key *authkey)
+                                      struct key *authkey,
+                                      struct keyring_list **_prealloc)
 {
         int ret, awaken;
 
@@ -425,7 +426,7 @@ static int __key_instantiate_and_link(struct key *key,
 
                         /* and link it into the destination keyring */
                         if (keyring)
-                                ret = __key_link(keyring, key);
+                                __key_link(keyring, key, _prealloc);
 
                         /* disable the authorisation key */
                         if (authkey)
@@ -453,15 +454,21 @@ int key_instantiate_and_link(struct key *key,
                              struct key *keyring,
                              struct key *authkey)
 {
+        struct keyring_list *prealloc;
         int ret;
 
-        if (keyring)
-                down_write(&keyring->sem);
+        if (keyring) {
+                ret = __key_link_begin(keyring, key->type, key->description,
+                                       &prealloc);
+                if (ret < 0)
+                        return ret;
+        }
 
-        ret = __key_instantiate_and_link(key, data, datalen, keyring, authkey);
+        ret = __key_instantiate_and_link(key, data, datalen, keyring, authkey,
+                                         &prealloc);
 
         if (keyring)
-                up_write(&keyring->sem);
+                __key_link_end(keyring, key->type, prealloc);
 
         return ret;
 
@@ -478,8 +485,9 @@ int key_negate_and_link(struct key *key,
                         struct key *keyring,
                         struct key *authkey)
 {
+        struct keyring_list *prealloc;
         struct timespec now;
-        int ret, awaken;
+        int ret, awaken, link_ret = 0;
 
         key_check(key);
         key_check(keyring);
@@ -488,7 +496,8 @@ int key_negate_and_link(struct key *key,
         ret = -EBUSY;
 
         if (keyring)
-                down_write(&keyring->sem);
+                link_ret = __key_link_begin(keyring, key->type,
+                                            key->description, &prealloc);
 
         mutex_lock(&key_construction_mutex);
 
@@ -508,8 +517,8 @@ int key_negate_and_link(struct key *key,
                 ret = 0;
 
                 /* and link it into the destination keyring */
-                if (keyring)
-                        ret = __key_link(keyring, key);
+                if (keyring && link_ret == 0)
+                        __key_link(keyring, key, &prealloc);
 
                 /* disable the authorisation key */
                 if (authkey)
@@ -519,13 +528,13 @@ int key_negate_and_link(struct key *key,
         mutex_unlock(&key_construction_mutex);
 
         if (keyring)
-                up_write(&keyring->sem);
+                __key_link_end(keyring, key->type, prealloc);
 
         /* wake up anyone waiting for a key to be constructed */
         if (awaken)
                 wake_up_bit(&key->flags, KEY_FLAG_USER_CONSTRUCT);
 
-        return ret;
+        return ret == 0 ? link_ret : ret;
 
 } /* end key_negate_and_link() */
 
@@ -749,6 +758,7 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
                                key_perm_t perm,
                                unsigned long flags)
 {
+        struct keyring_list *prealloc;
         const struct cred *cred = current_cred();
         struct key_type *ktype;
         struct key *keyring, *key = NULL;
@@ -775,7 +785,9 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
         if (keyring->type != &key_type_keyring)
                 goto error_2;
 
-        down_write(&keyring->sem);
+        ret = __key_link_begin(keyring, ktype, description, &prealloc);
+        if (ret < 0)
+                goto error_2;
 
         /* if we're going to allocate a new key, we're going to have
          * to modify the keyring */
@@ -817,7 +829,8 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
         }
 
         /* instantiate it and link it into the target keyring */
-        ret = __key_instantiate_and_link(key, payload, plen, keyring, NULL);
+        ret = __key_instantiate_and_link(key, payload, plen, keyring, NULL,
+                                         &prealloc);
         if (ret < 0) {
                 key_put(key);
                 key_ref = ERR_PTR(ret);
@@ -827,7 +840,7 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
         key_ref = make_key_ref(key, is_key_possessed(keyring_ref));
 
  error_3:
-        up_write(&keyring->sem);
+        __key_link_end(keyring, ktype, prealloc);
  error_2:
         key_type_put(ktype);
  error:
@@ -837,7 +850,7 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
         /* we found a matching key, so we're going to try to update it
          * - we can drop the locks first as we have the key pinned
          */
-        up_write(&keyring->sem);
+        __key_link_end(keyring, ktype, prealloc);
         key_type_put(ktype);
 
         key_ref = __key_update(key_ref, payload, plen);
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index e9c2e7c584d9..8f4dce1987c4 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -212,15 +212,15 @@ SYSCALL_DEFINE4(request_key, const char __user *, _type,
         ret = key->serial;
 
         key_put(key);
- error5:
+error5:
         key_type_put(ktype);
- error4:
+error4:
         key_ref_put(dest_ref);
- error3:
+error3:
         kfree(callout_info);
- error2:
+error2:
         kfree(description);
- error:
+error:
         return ret;
 
 } /* end sys_request_key() */
@@ -246,7 +246,7 @@ long keyctl_get_keyring_ID(key_serial_t id, int create)
 
         ret = key_ref_to_ptr(key_ref)->serial;
         key_ref_put(key_ref);
- error:
+error:
         return ret;
 
 } /* end keyctl_get_keyring_ID() */
@@ -275,7 +275,7 @@ long keyctl_join_session_keyring(const char __user *_name)
         ret = join_session_keyring(name);
         kfree(name);
 
- error:
+error:
         return ret;
 
 } /* end keyctl_join_session_keyring() */
@@ -322,9 +322,9 @@ long keyctl_update_key(key_serial_t id,
         ret = key_update(key_ref, payload, plen);
 
         key_ref_put(key_ref);
- error2:
+error2:
         kfree(payload);
- error:
+error:
         return ret;
 
 } /* end keyctl_update_key() */
@@ -356,7 +356,7 @@ long keyctl_revoke_key(key_serial_t id)
         ret = 0;
 
         key_ref_put(key_ref);
- error:
+error:
         return ret;
 
 } /* end keyctl_revoke_key() */
@@ -381,7 +381,7 @@ long keyctl_keyring_clear(key_serial_t ringid)
         ret = keyring_clear(key_ref_to_ptr(keyring_ref));
 
         key_ref_put(keyring_ref);
- error:
+error:
         return ret;
 
 } /* end keyctl_keyring_clear() */
@@ -413,9 +413,9 @@ long keyctl_keyring_link(key_serial_t id, key_serial_t ringid)
         ret = key_link(key_ref_to_ptr(keyring_ref), key_ref_to_ptr(key_ref));
 
         key_ref_put(key_ref);
- error2:
+error2:
         key_ref_put(keyring_ref);
- error:
+error:
         return ret;
 
 } /* end keyctl_keyring_link() */
@@ -447,9 +447,9 @@ long keyctl_keyring_unlink(key_serial_t id, key_serial_t ringid)
         ret = key_unlink(key_ref_to_ptr(keyring_ref), key_ref_to_ptr(key_ref));
 
         key_ref_put(key_ref);
- error2:
+error2:
         key_ref_put(keyring_ref);
- error:
+error:
         return ret;
 
 } /* end keyctl_keyring_unlink() */
@@ -529,9 +529,9 @@ okay:
         }
 
         kfree(tmpbuf);
- error2:
+error2:
         key_ref_put(key_ref);
- error:
+error:
         return ret;
 
 } /* end keyctl_describe_key() */
@@ -616,17 +616,17 @@ long keyctl_keyring_search(key_serial_t ringid,
 
         ret = key_ref_to_ptr(key_ref)->serial;
 
- error6:
+error6:
         key_ref_put(key_ref);
- error5:
+error5:
         key_type_put(ktype);
- error4:
+error4:
         key_ref_put(dest_ref);
- error3:
+error3:
         key_ref_put(keyring_ref);
- error2:
+error2:
         kfree(description);
- error:
+error:
         return ret;
 
 } /* end keyctl_keyring_search() */
@@ -673,7 +673,7 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
         }
 
         /* the key is probably readable - now try to read it */
- can_read_key:
+can_read_key:
         ret = key_validate(key);
         if (ret == 0) {
                 ret = -EOPNOTSUPP;
@@ -686,9 +686,9 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
                 }
         }
 
- error2:
+error2:
         key_put(key);
- error:
+error:
         return ret;
 
 } /* end keyctl_read_key() */
@@ -1282,26 +1282,19 @@ long keyctl_session_to_parent(void)
 
         /* the parent must have the same effective ownership and mustn't be
          * SUID/SGID */
-        if (pcred-> uid != mycred->euid ||
+        if (pcred->uid  != mycred->euid ||
             pcred->euid != mycred->euid ||
             pcred->suid != mycred->euid ||
-            pcred-> gid != mycred->egid ||
+            pcred->gid  != mycred->egid ||
             pcred->egid != mycred->egid ||
             pcred->sgid != mycred->egid)
                 goto not_permitted;
 
         /* the keyrings must have the same UID */
-        if (pcred ->tgcred->session_keyring->uid != mycred->euid ||
+        if (pcred->tgcred->session_keyring->uid != mycred->euid ||
             mycred->tgcred->session_keyring->uid != mycred->euid)
                 goto not_permitted;
 
-        /* the LSM must permit the replacement of the parent's keyring with the
-         * keyring from this process */
-        ret = security_key_session_to_parent(mycred, pcred,
-                                             key_ref_to_ptr(keyring_r));
-        if (ret < 0)
-                goto not_permitted;
-
         /* if there's an already pending keyring replacement, then we replace
          * that */
         oldcred = parent->replacement_session_keyring;
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index 1e4b0037935c..ef03a82a0135 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -17,7 +17,7 @@
 #include <linux/seq_file.h>
 #include <linux/err.h>
 #include <keys/keyring-type.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 #include "internal.h"
 
 #define rcu_dereference_locked_keyring(keyring)                         \
@@ -44,7 +44,7 @@ static inline unsigned keyring_hash(const char *desc)
         unsigned bucket = 0;
 
         for (; *desc; desc++)
-                bucket += (unsigned char) *desc;
+                bucket += (unsigned char)*desc;
 
         return bucket & (KEYRING_NAME_HASH_SIZE - 1);
 }
@@ -175,12 +175,10 @@ static void keyring_describe(const struct key *keyring, struct seq_file *m)
 {
         struct keyring_list *klist;
 
-        if (keyring->description) {
+        if (keyring->description)
                 seq_puts(m, keyring->description);
-        }
-        else {
+        else
                 seq_puts(m, "[anon]");
-        }
 
         rcu_read_lock();
         klist = rcu_dereference(keyring->payload.subscriptions);
@@ -241,7 +239,7 @@ static long keyring_read(const struct key *keyring,
                 ret = qty;
         }
 
- error:
+error:
         return ret;
 
 } /* end keyring_read() */
@@ -310,7 +308,7 @@ key_ref_t keyring_search_aux(key_ref_t keyring_ref,
         key_check(keyring);
 
         /* top keyring must have search permission to begin the search */
-        err = key_task_permission(keyring_ref, cred, KEY_SEARCH);
+        err = key_task_permission(keyring_ref, cred, KEY_SEARCH);
         if (err < 0) {
                 key_ref = ERR_PTR(err);
                 goto error;
@@ -512,7 +510,7 @@ key_ref_t __keyring_search_one(key_ref_t keyring_ref,
         rcu_read_unlock();
         return ERR_PTR(-ENOKEY);
 
- found:
+found:
         atomic_inc(&key->usage);
         rcu_read_unlock();
         return make_key_ref(key, possessed);
@@ -602,7 +600,7 @@ static int keyring_detect_cycle(struct key *A, struct key *B)
         sp = 0;
 
         /* start processing a new keyring */
- descend:
+descend:
         if (test_bit(KEY_FLAG_REVOKED, &subtree->flags))
                 goto not_this_keyring;
 
@@ -611,7 +609,7 @@ static int keyring_detect_cycle(struct key *A, struct key *B)
                 goto not_this_keyring;
         kix = 0;
 
- ascend:
+ascend:
         /* iterate through the remaining keys in this keyring */
         for (; kix < keylist->nkeys; kix++) {
                 key = keylist->keys[kix];
@@ -637,7 +635,7 @@ static int keyring_detect_cycle(struct key *A, struct key *B)
 
         /* the keyring we're looking at was disqualified or didn't contain a
          * matching key */
- not_this_keyring:
+not_this_keyring:
         if (sp > 0) {
                 /* resume the checking of a keyring higher up in the tree */
                 sp--;
@@ -648,34 +646,20 @@ static int keyring_detect_cycle(struct key *A, struct key *B)
 
         ret = 0; /* no cycles detected */
 
- error:
+error:
         rcu_read_unlock();
         return ret;
 
- too_deep:
+too_deep:
         ret = -ELOOP;
         goto error;
 
- cycle_detected:
+cycle_detected:
         ret = -EDEADLK;
         goto error;
 
 } /* end keyring_detect_cycle() */
 
-/*****************************************************************************/
-/*
- * dispose of a keyring list after the RCU grace period
- */
-static void keyring_link_rcu_disposal(struct rcu_head *rcu)
-{
-        struct keyring_list *klist =
-                container_of(rcu, struct keyring_list, rcu);
-
-        kfree(klist);
-
-} /* end keyring_link_rcu_disposal() */
-
-/*****************************************************************************/
 /*
  * dispose of a keyring list after the RCU grace period, freeing the unlinked
  * key
@@ -685,55 +669,51 @@ static void keyring_unlink_rcu_disposal(struct rcu_head *rcu)
         struct keyring_list *klist =
                 container_of(rcu, struct keyring_list, rcu);
 
-        key_put(klist->keys[klist->delkey]);
+        if (klist->delkey != USHORT_MAX)
+                key_put(klist->keys[klist->delkey]);
         kfree(klist);
+}
 
-} /* end keyring_unlink_rcu_disposal() */
-
-/*****************************************************************************/
 /*
- * link a key into to a keyring
- * - must be called with the keyring's semaphore write-locked
- * - discard already extant link to matching key if there is one
+ * preallocate memory so that a key can be linked into to a keyring
  */
-int __key_link(struct key *keyring, struct key *key)
+int __key_link_begin(struct key *keyring, const struct key_type *type,
+                     const char *description,
+                     struct keyring_list **_prealloc)
+        __acquires(&keyring->sem)
 {
         struct keyring_list *klist, *nklist;
         unsigned max;
         size_t size;
         int loop, ret;
 
-        ret = -EKEYREVOKED;
-        if (test_bit(KEY_FLAG_REVOKED, &keyring->flags))
-                goto error;
+        kenter("%d,%s,%s,", key_serial(keyring), type->name, description);
 
-        ret = -ENOTDIR;
         if (keyring->type != &key_type_keyring)
-                goto error;
+                return -ENOTDIR;
 
-        /* serialise link/link calls to prevent parallel calls causing a
-         * cycle when applied to two keyring in opposite orders */
-        down_write(&keyring_serialise_link_sem);
+        down_write(&keyring->sem);
 
-        /* check that we aren't going to create a cycle adding one keyring to
-         * another */
-        if (key->type == &key_type_keyring) {
-                ret = keyring_detect_cycle(keyring, key);
-                if (ret < 0)
-                        goto error2;
-        }
+        ret = -EKEYREVOKED;
+        if (test_bit(KEY_FLAG_REVOKED, &keyring->flags))
+                goto error_krsem;
+
+        /* serialise link/link calls to prevent parallel calls causing a cycle
+         * when linking two keyring in opposite orders */
+        if (type == &key_type_keyring)
+                down_write(&keyring_serialise_link_sem);
 
-        /* see if there's a matching key we can displace */
         klist = rcu_dereference_locked_keyring(keyring);
-        if (klist && klist->nkeys > 0) {
-                struct key_type *type = key->type;
 
+        /* see if there's a matching key we can displace */
+        if (klist && klist->nkeys > 0) {
                 for (loop = klist->nkeys - 1; loop >= 0; loop--) {
                         if (klist->keys[loop]->type == type &&
                             strcmp(klist->keys[loop]->description,
-                                   key->description) == 0
+                                   description) == 0
                             ) {
-                                /* found a match - replace with new key */
+                                /* found a match - we'll replace this one with
+                                 * the new key */
                                 size = sizeof(struct key *) * klist->maxkeys;
                                 size += sizeof(*klist);
                                 BUG_ON(size > PAGE_SIZE);
@@ -741,22 +721,10 @@ int __key_link(struct key *keyring, struct key *key)
                                 ret = -ENOMEM;
                                 nklist = kmemdup(klist, size, GFP_KERNEL);
                                 if (!nklist)
-                                        goto error2;
-
-                                /* replace matched key */
-                                atomic_inc(&key->usage);
-                                nklist->keys[loop] = key;
-
-                                rcu_assign_pointer(
-                                        keyring->payload.subscriptions,
-                                        nklist);
-
-                                /* dispose of the old keyring list and the
-                                 * displaced key */
-                                klist->delkey = loop;
-                                call_rcu(&klist->rcu,
-                                         keyring_unlink_rcu_disposal);
+                                        goto error_sem;
 
+                                /* note replacement slot */
+                                klist->delkey = nklist->delkey = loop;
                                 goto done;
                         }
                 }
@@ -766,88 +734,167 @@ int __key_link(struct key *keyring, struct key *key)
         ret = key_payload_reserve(keyring,
                                   keyring->datalen + KEYQUOTA_LINK_BYTES);
         if (ret < 0)
-                goto error2;
+                goto error_sem;
 
         if (klist && klist->nkeys < klist->maxkeys) {
-                /* there's sufficient slack space to add directly */
-                atomic_inc(&key->usage);
-
-                klist->keys[klist->nkeys] = key;
-                smp_wmb();
-                klist->nkeys++;
-                smp_wmb();
-        }
-        else {
+                /* there's sufficient slack space to append directly */
+                nklist = NULL;
+        } else {
                 /* grow the key list */
                 max = 4;
                 if (klist)
                         max += klist->maxkeys;
 
                 ret = -ENFILE;
-                if (max > 65535)
-                        goto error3;
+                if (max > USHORT_MAX - 1)
+                        goto error_quota;
                 size = sizeof(*klist) + sizeof(struct key *) * max;
                 if (size > PAGE_SIZE)
-                        goto error3;
+                        goto error_quota;
 
                 ret = -ENOMEM;
                 nklist = kmalloc(size, GFP_KERNEL);
                 if (!nklist)
-                        goto error3;
-                nklist->maxkeys = max;
-                nklist->nkeys = 0;
+                        goto error_quota;
 
+                nklist->maxkeys = max;
                 if (klist) {
-                        nklist->nkeys = klist->nkeys;
-                        memcpy(nklist->keys,
-                               klist->keys,
+                        memcpy(nklist->keys, klist->keys,
                                sizeof(struct key *) * klist->nkeys);
+                        nklist->delkey = klist->nkeys;
+                        nklist->nkeys = klist->nkeys + 1;
+                        klist->delkey = USHORT_MAX;
+                } else {
+                        nklist->nkeys = 1;
+                        nklist->delkey = 0;
                 }
 
                 /* add the key into the new space */
-                atomic_inc(&key->usage);
-                nklist->keys[nklist->nkeys++] = key;
-
-                rcu_assign_pointer(keyring->payload.subscriptions, nklist);
-
-                /* dispose of the old keyring list */
-                if (klist)
-                        call_rcu(&klist->rcu, keyring_link_rcu_disposal);
+                nklist->keys[nklist->delkey] = NULL;
         }
 
 done:
-        ret = 0;
-error2:
-        up_write(&keyring_serialise_link_sem);
-error:
-        return ret;
+        *_prealloc = nklist;
+        kleave(" = 0");
+        return 0;
 
-error3:
+error_quota:
         /* undo the quota changes */
         key_payload_reserve(keyring,
                             keyring->datalen - KEYQUOTA_LINK_BYTES);
-        goto error2;
+error_sem:
+        if (type == &key_type_keyring)
+                up_write(&keyring_serialise_link_sem);
+error_krsem:
+        up_write(&keyring->sem);
+        kleave(" = %d", ret);
+        return ret;
+}
 
-} /* end __key_link() */
+/*
+ * check already instantiated keys aren't going to be a problem
+ * - the caller must have called __key_link_begin()
+ * - don't need to call this for keys that were created since __key_link_begin()
+ *   was called
+ */
+int __key_link_check_live_key(struct key *keyring, struct key *key)
+{
+        if (key->type == &key_type_keyring)
+                /* check that we aren't going to create a cycle by linking one
+                 * keyring to another */
+                return keyring_detect_cycle(keyring, key);
+        return 0;
+}
+
+/*
+ * link a key into to a keyring
+ * - must be called with __key_link_begin() having being called
+ * - discard already extant link to matching key if there is one
+ */
+void __key_link(struct key *keyring, struct key *key,
+                struct keyring_list **_prealloc)
+{
+        struct keyring_list *klist, *nklist;
+
+        nklist = *_prealloc;
+        *_prealloc = NULL;
+
+        kenter("%d,%d,%p", keyring->serial, key->serial, nklist);
+
+        klist = rcu_dereference_protected(keyring->payload.subscriptions,
+                                          rwsem_is_locked(&keyring->sem));
+
+        atomic_inc(&key->usage);
+
+        /* there's a matching key we can displace or an empty slot in a newly
+         * allocated list we can fill */
+        if (nklist) {
+                kdebug("replace %hu/%hu/%hu",
+                       nklist->delkey, nklist->nkeys, nklist->maxkeys);
+
+                nklist->keys[nklist->delkey] = key;
+
+                rcu_assign_pointer(keyring->payload.subscriptions, nklist);
+
+                /* dispose of the old keyring list and, if there was one, the
+                 * displaced key */
+                if (klist) {
+                        kdebug("dispose %hu/%hu/%hu",
+                               klist->delkey, klist->nkeys, klist->maxkeys);
+                        call_rcu(&klist->rcu, keyring_unlink_rcu_disposal);
+                }
+        } else {
+                /* there's sufficient slack space to append directly */
+                klist->keys[klist->nkeys] = key;
+                smp_wmb();
+                klist->nkeys++;
+        }
+}
+
+/*
+ * finish linking a key into to a keyring
+ * - must be called with __key_link_begin() having being called
+ */
+void __key_link_end(struct key *keyring, struct key_type *type,
+                    struct keyring_list *prealloc)
+        __releases(&keyring->sem)
+{
+        BUG_ON(type == NULL);
+        BUG_ON(type->name == NULL);
+        kenter("%d,%s,%p", keyring->serial, type->name, prealloc);
+
+        if (type == &key_type_keyring)
+                up_write(&keyring_serialise_link_sem);
+
+        if (prealloc) {
+                kfree(prealloc);
+                key_payload_reserve(keyring,
+                                    keyring->datalen - KEYQUOTA_LINK_BYTES);
+        }
+        up_write(&keyring->sem);
+}
 
-/*****************************************************************************/
 /*
  * link a key to a keyring
  */
 int key_link(struct key *keyring, struct key *key)
 {
+        struct keyring_list *prealloc;
         int ret;
 
         key_check(keyring);
         key_check(key);
 
-        down_write(&keyring->sem);
-        ret = __key_link(keyring, key);
-        up_write(&keyring->sem);
+        ret = __key_link_begin(keyring, key->type, key->description, &prealloc);
+        if (ret == 0) {
+                ret = __key_link_check_live_key(keyring, key);
+                if (ret == 0)
+                        __key_link(keyring, key, &prealloc);
+                __key_link_end(keyring, key->type, prealloc);
+        }
 
         return ret;
-
-} /* end key_link() */
+}
 
 EXPORT_SYMBOL(key_link);
 
diff --git a/security/keys/permission.c b/security/keys/permission.c
index 0ed802c9e698..28645502cd0d 100644
--- a/security/keys/permission.c
+++ b/security/keys/permission.c
@@ -109,7 +109,7 @@ int key_validate(struct key *key)
                 }
         }
 
- error:
+error:
         return ret;
 
 } /* end key_validate() */
diff --git a/security/keys/proc.c b/security/keys/proc.c
index 706d63f4f185..068b66ea2f1b 100644
--- a/security/keys/proc.c
+++ b/security/keys/proc.c
@@ -306,7 +306,7 @@ static void *proc_key_users_start(struct seq_file *p, loff_t *_pos)
 static void *proc_key_users_next(struct seq_file *p, void *v, loff_t *_pos)
 {
         (*_pos)++;
-        return key_user_next((struct rb_node *) v);
+        return key_user_next((struct rb_node *)v);
 }
 
 static void proc_key_users_stop(struct seq_file *p, void *v)
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 06c2ccf26ed3..20a38fed61b1 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -508,7 +508,7 @@ try_again:
 
                         ret = install_thread_keyring();
                         if (ret < 0) {
-                                key = ERR_PTR(ret);
+                                key_ref = ERR_PTR(ret);
                                 goto error;
                         }
                         goto reget_creds;
@@ -526,7 +526,7 @@ try_again:
 
                         ret = install_process_keyring();
                         if (ret < 0) {
-                                key = ERR_PTR(ret);
+                                key_ref = ERR_PTR(ret);
                                 goto error;
                         }
                         goto reget_creds;
@@ -585,7 +585,7 @@ try_again:
 
         case KEY_SPEC_GROUP_KEYRING:
                 /* group keyrings are not yet supported */
-                key = ERR_PTR(-EINVAL);
+                key_ref = ERR_PTR(-EINVAL);
                 goto error;
 
         case KEY_SPEC_REQKEY_AUTH_KEY:
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index d8c1a6a0fb08..f656e9c069e3 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -299,12 +299,15 @@ static int construct_alloc_key(struct key_type *type,
                                struct key_user *user,
                                struct key **_key)
 {
+        struct keyring_list *prealloc;
         const struct cred *cred = current_cred();
         struct key *key;
         key_ref_t key_ref;
+        int ret;
 
         kenter("%s,%s,,,", type->name, description);
 
+        *_key = NULL;
         mutex_lock(&user->cons_lock);
 
         key = key_alloc(type, description, cred->fsuid, cred->fsgid, cred,
@@ -314,8 +317,12 @@ static int construct_alloc_key(struct key_type *type,
 
         set_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags);
 
-        if (dest_keyring)
-                down_write(&dest_keyring->sem);
+        if (dest_keyring) {
+                ret = __key_link_begin(dest_keyring, type, description,
+                                       &prealloc);
+                if (ret < 0)
+                        goto link_prealloc_failed;
+        }
 
         /* attach the key to the destination keyring under lock, but we do need
          * to do another check just in case someone beat us to it whilst we
@@ -327,31 +334,49 @@ static int construct_alloc_key(struct key_type *type,
                 goto key_already_present;
 
         if (dest_keyring)
-                __key_link(dest_keyring, key);
+                __key_link(dest_keyring, key, &prealloc);
 
         mutex_unlock(&key_construction_mutex);
         if (dest_keyring)
-                up_write(&dest_keyring->sem);
+                __key_link_end(dest_keyring, type, prealloc);
         mutex_unlock(&user->cons_lock);
         *_key = key;
         kleave(" = 0 [%d]", key_serial(key));
         return 0;
 
+        /* the key is now present - we tell the caller that we found it by
+         * returning -EINPROGRESS  */
 key_already_present:
+        key_put(key);
         mutex_unlock(&key_construction_mutex);
+        key = key_ref_to_ptr(key_ref);
         if (dest_keyring) {
-                __key_link(dest_keyring, key_ref_to_ptr(key_ref));
-                up_write(&dest_keyring->sem);
+                ret = __key_link_check_live_key(dest_keyring, key);
+                if (ret == 0)
+                        __key_link(dest_keyring, key, &prealloc);
+                __key_link_end(dest_keyring, type, prealloc);
+                if (ret < 0)
+                        goto link_check_failed;
         }
         mutex_unlock(&user->cons_lock);
-        key_put(key);
-        *_key = key = key_ref_to_ptr(key_ref);
+        *_key = key;
         kleave(" = -EINPROGRESS [%d]", key_serial(key));
         return -EINPROGRESS;
 
+link_check_failed:
+        mutex_unlock(&user->cons_lock);
+        key_put(key);
+        kleave(" = %d [linkcheck]", ret);
+        return ret;
+
+link_prealloc_failed:
+        up_write(&dest_keyring->sem);
+        mutex_unlock(&user->cons_lock);
+        kleave(" = %d [prelink]", ret);
+        return ret;
+
 alloc_failed:
         mutex_unlock(&user->cons_lock);
-        *_key = NULL;
         kleave(" = %ld", PTR_ERR(key));
         return PTR_ERR(key);
 }
@@ -390,6 +415,10 @@ static struct key *construct_key_and_link(struct key_type *type,
                         kdebug("cons failed");
                         goto construction_failed;
                 }
+        } else if (ret == -EINPROGRESS) {
+                ret = 0;
+        } else {
+                key = ERR_PTR(ret);
         }
 
         key_put(dest_keyring);
@@ -422,6 +451,7 @@ struct key *request_key_and_link(struct key_type *type,
         const struct cred *cred = current_cred();
         struct key *key;
         key_ref_t key_ref;
+        int ret;
 
         kenter("%s,%s,%p,%zu,%p,%p,%lx",
                type->name, description, callout_info, callout_len, aux,
@@ -435,8 +465,13 @@ struct key *request_key_and_link(struct key_type *type,
                 key = key_ref_to_ptr(key_ref);
                 if (dest_keyring) {
                         construct_get_dest_keyring(&dest_keyring);
-                        key_link(dest_keyring, key);
+                        ret = key_link(dest_keyring, key);
                         key_put(dest_keyring);
+                        if (ret < 0) {
+                                key_put(key);
+                                key = ERR_PTR(ret);
+                                goto error;
+                        }
                 }
         } else if (PTR_ERR(key_ref) != -EAGAIN) {
                 key = ERR_CAST(key_ref);