17 files changed, 124 insertions, 105 deletions

diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
index 69ddb47787b2..e39df6d43779 100644
--- a/security/apparmor/apparmorfs.c
+++ b/security/apparmor/apparmorfs.c
@@ -165,7 +165,7 @@ static void __init aafs_remove(const char *name)
  *
  * Used aafs_remove to remove entries created with this fn.
  */
-static int __init aafs_create(const char *name, int mask,
+static int __init aafs_create(const char *name, umode_t mask,
                               const struct file_operations *fops)
 {
         struct dentry *dentry;
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 37832026e58a..2c0a0ff41399 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -262,7 +262,7 @@ static int apparmor_path_unlink(struct path *dir, struct dentry *dentry)
 }
 
 static int apparmor_path_mkdir(struct path *dir, struct dentry *dentry,
-                               int mode)
+                               umode_t mode)
 {
         return common_perm_create(OP_MKDIR, dir, dentry, AA_MAY_CREATE,
                                   S_IFDIR);
@@ -274,7 +274,7 @@ static int apparmor_path_rmdir(struct path *dir, struct dentry *dentry)
 }
 
 static int apparmor_path_mknod(struct path *dir, struct dentry *dentry,
-                               int mode, unsigned int dev)
+                               umode_t mode, unsigned int dev)
 {
         return common_perm_create(OP_MKNOD, dir, dentry, AA_MAY_CREATE, mode);
 }
@@ -344,13 +344,12 @@ static int apparmor_path_rename(struct path *old_dir, struct dentry *old_dentry,
         return error;
 }
 
-static int apparmor_path_chmod(struct dentry *dentry, struct vfsmount *mnt,
-                               mode_t mode)
+static int apparmor_path_chmod(struct path *path, umode_t mode)
 {
-        if (!mediated_filesystem(dentry->d_inode))
+        if (!mediated_filesystem(path->dentry->d_inode))
                 return 0;
 
-        return common_perm_mnt_dentry(OP_CHMOD, mnt, dentry, AA_MAY_CHMOD);
+        return common_perm_mnt_dentry(OP_CHMOD, path->mnt, path->dentry, AA_MAY_CHMOD);
 }
 
 static int apparmor_path_chown(struct path *path, uid_t uid, gid_t gid)
diff --git a/security/apparmor/path.c b/security/apparmor/path.c
index 36cc0cc39e78..9d070a7c3ffc 100644
--- a/security/apparmor/path.c
+++ b/security/apparmor/path.c
@@ -13,7 +13,6 @@
  */
 
 #include <linux/magic.h>
-#include <linux/mnt_namespace.h>
 #include <linux/mount.h>
 #include <linux/namei.h>
 #include <linux/nsproxy.h>
@@ -57,23 +56,44 @@ static int prepend(char **buffer, int buflen, const char *str, int namelen)
 static int d_namespace_path(struct path *path, char *buf, int buflen,
                             char **name, int flags)
 {
-        struct path root, tmp;
         char *res;
-        int connected, error = 0;
+        int error = 0;
+        int connected = 1;
+
+        if (path->mnt->mnt_flags & MNT_INTERNAL) {
+                /* it's not mounted anywhere */
+                res = dentry_path(path->dentry, buf, buflen);
+                *name = res;
+                if (IS_ERR(res)) {
+                        *name = buf;
+                        return PTR_ERR(res);
+                }
+                if (path->dentry->d_sb->s_magic == PROC_SUPER_MAGIC &&
+                    strncmp(*name, "/sys/", 5) == 0) {
+                        /* TODO: convert over to using a per namespace
+                         * control instead of hard coded /proc
+                         */
+                        return prepend(name, *name - buf, "/proc", 5);
+                }
+                return 0;
+        }
 
-        /* Get the root we want to resolve too, released below */
+        /* resolve paths relative to chroot?*/
         if (flags & PATH_CHROOT_REL) {
-                /* resolve paths relative to chroot */
+                struct path root;
                 get_fs_root(current->fs, &root);
-        } else {
-                /* resolve paths relative to namespace */
-                root.mnt = current->nsproxy->mnt_ns->root;
-                root.dentry = root.mnt->mnt_root;
-                path_get(&root);
+                res = __d_path(path, &root, buf, buflen);
+                if (res && !IS_ERR(res)) {
+                        /* everything's fine */
+                        *name = res;
+                        path_put(&root);
+                        goto ok;
+                }
+                path_put(&root);
+                connected = 0;
         }
 
-        tmp = root;
-        res = __d_path(path, &tmp, buf, buflen);
+        res = d_absolute_path(path, buf, buflen);
 
         *name = res;
         /* handle error conditions - and still allow a partial path to
@@ -84,7 +104,10 @@ static int d_namespace_path(struct path *path, char *buf, int buflen,
                 *name = buf;
                 goto out;
         }
+        if (!our_mnt(path->mnt))
+                connected = 0;
 
+ok:
         /* Handle two cases:
          * 1. A deleted dentry && profile is not allowing mediation of deleted
          * 2. On some filesystems, newly allocated dentries appear to the
@@ -97,10 +120,7 @@ static int d_namespace_path(struct path *path, char *buf, int buflen,
                         goto out;
         }
 
-        /* Determine if the path is connected to the expected root */
-        connected = tmp.dentry == root.dentry && tmp.mnt == root.mnt;
-
-        /* If the path is not connected,
+        /* If the path is not connected to the expected root,
          * check if it is a sysctl and handle specially else remove any
          * leading / that __d_path may have returned.
          * Unless
@@ -112,17 +132,9 @@ static int d_namespace_path(struct path *path, char *buf, int buflen,
          *     namespace root.
          */
         if (!connected) {
-                /* is the disconnect path a sysctl? */
-                if (tmp.dentry->d_sb->s_magic == PROC_SUPER_MAGIC &&
-                    strncmp(*name, "/sys/", 5) == 0) {
-                        /* TODO: convert over to using a per namespace
-                         * control instead of hard coded /proc
-                         */
-                        error = prepend(name, *name - buf, "/proc", 5);
-                } else if (!(flags & PATH_CONNECT_PATH) &&
+                if (!(flags & PATH_CONNECT_PATH) &&
                            !(((flags & CHROOT_NSCONNECT) == CHROOT_NSCONNECT) &&
-                             (tmp.mnt == current->nsproxy->mnt_ns->root &&
-                              tmp.dentry == tmp.mnt->mnt_root))) {
+                             our_mnt(path->mnt))) {
                         /* disconnected path, don't return pathname starting
                          * with '/'
                          */
@@ -133,8 +145,6 @@ static int d_namespace_path(struct path *path, char *buf, int buflen,
         }
 
 out:
-        path_put(&root);
-
         return error;
 }
 
diff --git a/security/capability.c b/security/capability.c
index 2984ea4f776f..3b5883b7179f 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -125,7 +125,7 @@ static int cap_inode_init_security(struct inode *inode, struct inode *dir,
 }
 
 static int cap_inode_create(struct inode *inode, struct dentry *dentry,
-                            int mask)
+                            umode_t mask)
 {
         return 0;
 }
@@ -148,7 +148,7 @@ static int cap_inode_symlink(struct inode *inode, struct dentry *dentry,
 }
 
 static int cap_inode_mkdir(struct inode *inode, struct dentry *dentry,
-                           int mask)
+                           umode_t mask)
 {
         return 0;
 }
@@ -159,7 +159,7 @@ static int cap_inode_rmdir(struct inode *inode, struct dentry *dentry)
 }
 
 static int cap_inode_mknod(struct inode *inode, struct dentry *dentry,
-                           int mode, dev_t dev)
+                           umode_t mode, dev_t dev)
 {
         return 0;
 }
@@ -235,13 +235,13 @@ static void cap_inode_getsecid(const struct inode *inode, u32 *secid)
 }
 
 #ifdef CONFIG_SECURITY_PATH
-static int cap_path_mknod(struct path *dir, struct dentry *dentry, int mode,
+static int cap_path_mknod(struct path *dir, struct dentry *dentry, umode_t mode,
                           unsigned int dev)
 {
         return 0;
 }
 
-static int cap_path_mkdir(struct path *dir, struct dentry *dentry, int mode)
+static int cap_path_mkdir(struct path *dir, struct dentry *dentry, umode_t mode)
 {
         return 0;
 }
@@ -279,8 +279,7 @@ static int cap_path_truncate(struct path *path)
         return 0;
 }
 
-static int cap_path_chmod(struct dentry *dentry, struct vfsmount *mnt,
-                          mode_t mode)
+static int cap_path_chmod(struct path *path, umode_t mode)
 {
         return 0;
 }
diff --git a/security/inode.c b/security/inode.c
index c4df2fbebe6b..90a70a67d835 100644
--- a/security/inode.c
+++ b/security/inode.c
@@ -56,7 +56,7 @@ static const struct file_operations default_file_ops = {
         .llseek =       noop_llseek,
 };
 
-static struct inode *get_inode(struct super_block *sb, int mode, dev_t dev)
+static struct inode *get_inode(struct super_block *sb, umode_t mode, dev_t dev)
 {
         struct inode *inode = new_inode(sb);
 
@@ -85,7 +85,7 @@ static struct inode *get_inode(struct super_block *sb, int mode, dev_t dev)
 
 /* SMP-safe */
 static int mknod(struct inode *dir, struct dentry *dentry,
-                         int mode, dev_t dev)
+                         umode_t mode, dev_t dev)
 {
         struct inode *inode;
         int error = -ENOMEM;
@@ -102,7 +102,7 @@ static int mknod(struct inode *dir, struct dentry *dentry,
         return error;
 }
 
-static int mkdir(struct inode *dir, struct dentry *dentry, int mode)
+static int mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
 {
         int res;
 
@@ -113,7 +113,7 @@ static int mkdir(struct inode *dir, struct dentry *dentry, int mode)
         return res;
 }
 
-static int create(struct inode *dir, struct dentry *dentry, int mode)
+static int create(struct inode *dir, struct dentry *dentry, umode_t mode)
 {
         mode = (mode & S_IALLUGO) | S_IFREG;
         return mknod(dir, dentry, mode, 0);
@@ -145,7 +145,7 @@ static struct file_system_type fs_type = {
         .kill_sb =      kill_litter_super,
 };
 
-static int create_by_name(const char *name, mode_t mode,
+static int create_by_name(const char *name, umode_t mode,
                           struct dentry *parent,
                           struct dentry **dentry)
 {
@@ -159,12 +159,12 @@ static int create_by_name(const char *name, mode_t mode,
          * have around.
          */
         if (!parent)
-                parent = mount->mnt_sb->s_root;
+                parent = mount->mnt_root;
 
         mutex_lock(&parent->d_inode->i_mutex);
         *dentry = lookup_one_len(name, parent, strlen(name));
         if (!IS_ERR(*dentry)) {
-                if ((mode & S_IFMT) == S_IFDIR)
+                if (S_ISDIR(mode))
                         error = mkdir(parent->d_inode, *dentry, mode);
                 else
                         error = create(parent->d_inode, *dentry, mode);
@@ -205,7 +205,7 @@ static int create_by_name(const char *name, mode_t mode,
  * If securityfs is not enabled in the kernel, the value %-ENODEV is
  * returned.
  */
-struct dentry *securityfs_create_file(const char *name, mode_t mode,
+struct dentry *securityfs_create_file(const char *name, umode_t mode,
                                    struct dentry *parent, void *data,
                                    const struct file_operations *fops)
 {
diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c
index 5dd5b140242c..8738deff26fa 100644
--- a/security/integrity/evm/evm_crypto.c
+++ b/security/integrity/evm/evm_crypto.c
@@ -27,20 +27,35 @@ static int evmkey_len = MAX_KEY_SIZE;
 
 struct crypto_shash *hmac_tfm;
 
+static DEFINE_MUTEX(mutex);
+
 static struct shash_desc *init_desc(void)
 {
         int rc;
         struct shash_desc *desc;
 
         if (hmac_tfm == NULL) {
+                mutex_lock(&mutex);
+                if (hmac_tfm)
+                        goto out;
                 hmac_tfm = crypto_alloc_shash(evm_hmac, 0, CRYPTO_ALG_ASYNC);
                 if (IS_ERR(hmac_tfm)) {
                         pr_err("Can not allocate %s (reason: %ld)\n",
                                evm_hmac, PTR_ERR(hmac_tfm));
                         rc = PTR_ERR(hmac_tfm);
                         hmac_tfm = NULL;
+                        mutex_unlock(&mutex);
+                        return ERR_PTR(rc);
+                }
+                rc = crypto_shash_setkey(hmac_tfm, evmkey, evmkey_len);
+                if (rc) {
+                        crypto_free_shash(hmac_tfm);
+                        hmac_tfm = NULL;
+                        mutex_unlock(&mutex);
                         return ERR_PTR(rc);
                 }
+out:
+                mutex_unlock(&mutex);
         }
 
         desc = kmalloc(sizeof(*desc) + crypto_shash_descsize(hmac_tfm),
@@ -51,11 +66,7 @@ static struct shash_desc *init_desc(void)
         desc->tfm = hmac_tfm;
         desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP;
 
-        rc = crypto_shash_setkey(hmac_tfm, evmkey, evmkey_len);
-        if (rc)
-                goto out;
         rc = crypto_shash_init(desc);
-out:
         if (rc) {
                 kfree(desc);
                 return ERR_PTR(rc);
diff --git a/security/lsm_audit.c b/security/lsm_audit.c
index 893af8a2fa1e..7bd6f138236b 100644
--- a/security/lsm_audit.c
+++ b/security/lsm_audit.c
@@ -114,19 +114,20 @@ int ipv6_skb_to_auditdata(struct sk_buff *skb,
         int offset, ret = 0;
         struct ipv6hdr *ip6;
         u8 nexthdr;
+        __be16 frag_off;
 
         ip6 = ipv6_hdr(skb);
         if (ip6 == NULL)
                 return -EINVAL;
-        ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
-        ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
+        ad->u.net.v6info.saddr = ip6->saddr;
+        ad->u.net.v6info.daddr = ip6->daddr;
         ret = 0;
         /* IPv6 can have several extension header before the Transport header
          * skip them */
         offset = skb_network_offset(skb);
         offset += sizeof(*ip6);
         nexthdr = ip6->nexthdr;
-        offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
+        offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
         if (offset < 0)
                 return 0;
         if (proto)
diff --git a/security/security.c b/security/security.c
index 0c6cc69c8f86..214502c772ab 100644
--- a/security/security.c
+++ b/security/security.c
@@ -381,14 +381,14 @@ int security_old_inode_init_security(struct inode *inode, struct inode *dir,
                                      void **value, size_t *len)
 {
         if (unlikely(IS_PRIVATE(inode)))
-                return 0;
+                return -EOPNOTSUPP;
         return security_ops->inode_init_security(inode, dir, qstr, name, value,
                                                  len);
 }
 EXPORT_SYMBOL(security_old_inode_init_security);
 
 #ifdef CONFIG_SECURITY_PATH
-int security_path_mknod(struct path *dir, struct dentry *dentry, int mode,
+int security_path_mknod(struct path *dir, struct dentry *dentry, umode_t mode,
                         unsigned int dev)
 {
         if (unlikely(IS_PRIVATE(dir->dentry->d_inode)))
@@ -397,7 +397,7 @@ int security_path_mknod(struct path *dir, struct dentry *dentry, int mode,
 }
 EXPORT_SYMBOL(security_path_mknod);
 
-int security_path_mkdir(struct path *dir, struct dentry *dentry, int mode)
+int security_path_mkdir(struct path *dir, struct dentry *dentry, umode_t mode)
 {
         if (unlikely(IS_PRIVATE(dir->dentry->d_inode)))
                 return 0;
@@ -454,12 +454,11 @@ int security_path_truncate(struct path *path)
         return security_ops->path_truncate(path);
 }
 
-int security_path_chmod(struct dentry *dentry, struct vfsmount *mnt,
-                        mode_t mode)
+int security_path_chmod(struct path *path, umode_t mode)
 {
-        if (unlikely(IS_PRIVATE(dentry->d_inode)))
+        if (unlikely(IS_PRIVATE(path->dentry->d_inode)))
                 return 0;
-        return security_ops->path_chmod(dentry, mnt, mode);
+        return security_ops->path_chmod(path, mode);
 }
 
 int security_path_chown(struct path *path, uid_t uid, gid_t gid)
@@ -475,7 +474,7 @@ int security_path_chroot(struct path *path)
 }
 #endif
 
-int security_inode_create(struct inode *dir, struct dentry *dentry, int mode)
+int security_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
 {
         if (unlikely(IS_PRIVATE(dir)))
                 return 0;
@@ -506,7 +505,7 @@ int security_inode_symlink(struct inode *dir, struct dentry *dentry,
         return security_ops->inode_symlink(dir, dentry, old_name);
 }
 
-int security_inode_mkdir(struct inode *dir, struct dentry *dentry, int mode)
+int security_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
 {
         if (unlikely(IS_PRIVATE(dir)))
                 return 0;
@@ -521,7 +520,7 @@ int security_inode_rmdir(struct inode *dir, struct dentry *dentry)
         return security_ops->inode_rmdir(dir, dentry);
 }
 
-int security_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
+int security_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
 {
         if (unlikely(IS_PRIVATE(dir)))
                 return 0;
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 1126c10a5e82..7cd4c3affac8 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1090,7 +1090,7 @@ static inline u16 socket_type_to_security_class(int family, int type, int protoc
                         return SECCLASS_NETLINK_ROUTE_SOCKET;
                 case NETLINK_FIREWALL:
                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
-                case NETLINK_INET_DIAG:
+                case NETLINK_SOCK_DIAG:
                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
                 case NETLINK_NFLOG:
                         return SECCLASS_NETLINK_NFLOG_SOCKET;
@@ -1740,7 +1740,7 @@ static inline u32 file_mask_to_av(int mode, int mask)
 {
         u32 av = 0;
 
-        if ((mode & S_IFMT) != S_IFDIR) {
+        if (!S_ISDIR(mode)) {
                 if (mask & MAY_EXEC)
                         av |= FILE__EXECUTE;
                 if (mask & MAY_READ)
@@ -2507,7 +2507,7 @@ static int selinux_mount(char *dev_name,
         const struct cred *cred = current_cred();
 
         if (flags & MS_REMOUNT)
-                return superblock_has_perm(cred, path->mnt->mnt_sb,
+                return superblock_has_perm(cred, path->dentry->d_sb,
                                            FILESYSTEM__REMOUNT, NULL);
         else
                 return path_has_perm(cred, path, FILE__MOUNTON);
@@ -2598,7 +2598,7 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
         return 0;
 }
 
-static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
+static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
 {
         return may_create(dir, dentry, SECCLASS_FILE);
 }
@@ -2618,7 +2618,7 @@ static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const
         return may_create(dir, dentry, SECCLASS_LNK_FILE);
 }
 
-static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
+static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
 {
         return may_create(dir, dentry, SECCLASS_DIR);
 }
@@ -2628,7 +2628,7 @@ static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
         return may_link(dir, dentry, MAY_RMDIR);
 }
 
-static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
+static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
 {
         return may_create(dir, dentry, inode_mode_to_security_class(mode));
 }
@@ -3561,19 +3561,20 @@ static int selinux_parse_skb_ipv6(struct sk_buff *skb,
         u8 nexthdr;
         int ret = -EINVAL, offset;
         struct ipv6hdr _ipv6h, *ip6;
+        __be16 frag_off;
 
         offset = skb_network_offset(skb);
         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
         if (ip6 == NULL)
                 goto out;
 
-        ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
-        ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
+        ad->u.net.v6info.saddr = ip6->saddr;
+        ad->u.net.v6info.daddr = ip6->daddr;
         ret = 0;
 
         nexthdr = ip6->nexthdr;
         offset += sizeof(_ipv6h);
-        offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
+        offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
         if (offset < 0)
                 goto out;
 
@@ -3871,7 +3872,7 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in
                 if (family == PF_INET)
                         ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
                 else
-                        ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
+                        ad.u.net.v6info.saddr = addr6->sin6_addr;
 
                 err = avc_has_perm(sksec->sid, sid,
                                    sksec->sclass, node_perm, &ad);
diff --git a/security/selinux/netnode.c b/security/selinux/netnode.c
index 3bf46abaa688..86365857c088 100644
--- a/security/selinux/netnode.c
+++ b/security/selinux/netnode.c
@@ -220,7 +220,7 @@ static int sel_netnode_sid_slow(void *addr, u16 family, u32 *sid)
         case PF_INET6:
                 ret = security_node_sid(PF_INET6,
                                         addr, sizeof(struct in6_addr), sid);
-                ipv6_addr_copy(&new->nsec.addr.ipv6, addr);
+                new->nsec.addr.ipv6 = *(struct in6_addr *)addr;
                 break;
         default:
                 BUG();
diff --git a/security/selinux/netport.c b/security/selinux/netport.c
index 0b62bd112461..7b9eb1faf68b 100644
--- a/security/selinux/netport.c
+++ b/security/selinux/netport.c
@@ -123,7 +123,9 @@ static void sel_netport_insert(struct sel_netport *port)
         if (sel_netport_hash[idx].size == SEL_NETPORT_HASH_BKT_LIMIT) {
                 struct sel_netport *tail;
                 tail = list_entry(
-                        rcu_dereference(sel_netport_hash[idx].list.prev),
+                        rcu_dereference_protected(
+                                sel_netport_hash[idx].list.prev,
+                                lockdep_is_held(&sel_netport_lock)),
                         struct sel_netport, list);
                 list_del_rcu(&tail->list);
                 kfree_rcu(tail, rcu);
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 7db62b48eb42..e8af5b0ba80f 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -406,7 +406,7 @@ static int smack_sb_statfs(struct dentry *dentry)
 static int smack_sb_mount(char *dev_name, struct path *path,
                           char *type, unsigned long flags, void *data)
 {
-        struct superblock_smack *sbp = path->mnt->mnt_sb->s_security;
+        struct superblock_smack *sbp = path->dentry->d_sb->s_security;
         struct smk_audit_info ad;
 
         smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
@@ -435,7 +435,7 @@ static int smack_sb_umount(struct vfsmount *mnt, int flags)
         smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
         smk_ad_setfield_u_fs_path(&ad, path);
 
-        sbp = mnt->mnt_sb->s_security;
+        sbp = path.dentry->d_sb->s_security;
         return smk_curacc(sbp->smk_floor, MAY_WRITE, &ad);
 }
 
diff --git a/security/tomoyo/audit.c b/security/tomoyo/audit.c
index 075c3a6d1649..5ca47ea3049f 100644
--- a/security/tomoyo/audit.c
+++ b/security/tomoyo/audit.c
@@ -112,7 +112,7 @@ out:
  *
  * Returns file type string.
  */
-static inline const char *tomoyo_filetype(const mode_t mode)
+static inline const char *tomoyo_filetype(const umode_t mode)
 {
         switch (mode & S_IFMT) {
         case S_IFREG:
@@ -180,7 +180,7 @@ static char *tomoyo_print_header(struct tomoyo_request_info *r)
         for (i = 0; i < TOMOYO_MAX_PATH_STAT; i++) {
                 struct tomoyo_mini_stat *stat;
                 unsigned int dev;
-                mode_t mode;
+                umode_t mode;
                 if (!obj->stat_valid[i])
                         continue;
                 stat = &obj->stat[i];
diff --git a/security/tomoyo/common.h b/security/tomoyo/common.h
index ed311d7a8ce0..deeab7be5b97 100644
--- a/security/tomoyo/common.h
+++ b/security/tomoyo/common.h
@@ -564,7 +564,7 @@ struct tomoyo_mini_stat {
         uid_t uid;
         gid_t gid;
         ino_t ino;
-        mode_t mode;
+        umode_t mode;
         dev_t dev;
         dev_t rdev;
 };
diff --git a/security/tomoyo/realpath.c b/security/tomoyo/realpath.c
index 738bbdf8d4c7..80a09c37cac8 100644
--- a/security/tomoyo/realpath.c
+++ b/security/tomoyo/realpath.c
@@ -4,15 +4,8 @@
  * Copyright (C) 2005-2011  NTT DATA CORPORATION
  */
 
-#include <linux/types.h>
-#include <linux/mount.h>
-#include <linux/mnt_namespace.h>
-#include <linux/fs_struct.h>
-#include <linux/magic.h>
-#include <linux/slab.h>
-#include <net/sock.h>
 #include "common.h"
-#include "../../fs/internal.h"
+#include <linux/magic.h>
 
 /**
  * tomoyo_encode2 - Encode binary string to ascii string.
@@ -101,9 +94,8 @@ static char *tomoyo_get_absolute_path(struct path *path, char * const buffer,
 {
         char *pos = ERR_PTR(-ENOMEM);
         if (buflen >= 256) {
-                struct path ns_root = { };
                 /* go to whatever namespace root we are under */
-                pos = __d_path(path, &ns_root, buffer, buflen - 1);
+                pos = d_absolute_path(path, buffer, buflen - 1);
                 if (!IS_ERR(pos) && *pos == '/' && pos[1]) {
                         struct inode *inode = path->dentry->d_inode;
                         if (inode && S_ISDIR(inode->i_mode)) {
@@ -294,8 +286,16 @@ char *tomoyo_realpath_from_path(struct path *path)
                         pos = tomoyo_get_local_path(path->dentry, buf,
                                                     buf_len - 1);
                 /* Get absolute name for the rest. */
-                else
+                else {
                         pos = tomoyo_get_absolute_path(path, buf, buf_len - 1);
+                        /*
+                         * Fall back to local name if absolute name is not
+                         * available.
+                         */
+                        if (pos == ERR_PTR(-EINVAL))
+                                pos = tomoyo_get_local_path(path->dentry, buf,
+                                                            buf_len - 1);
+                }
 encode:
                 if (IS_ERR(pos))
                         continue;
diff --git a/security/tomoyo/securityfs_if.c b/security/tomoyo/securityfs_if.c
index 2672ac4f3beb..482b2a5f48f0 100644
--- a/security/tomoyo/securityfs_if.c
+++ b/security/tomoyo/securityfs_if.c
@@ -224,7 +224,7 @@ static const struct file_operations tomoyo_operations = {
  *
  * Returns nothing.
  */
-static void __init tomoyo_create_entry(const char *name, const mode_t mode,
+static void __init tomoyo_create_entry(const char *name, const umode_t mode,
                                        struct dentry *parent, const u8 key)
 {
         securityfs_create_file(name, mode, parent, ((u8 *) NULL) + key,
diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c
index 4b327b691745..620d37c159a3 100644
--- a/security/tomoyo/tomoyo.c
+++ b/security/tomoyo/tomoyo.c
@@ -186,7 +186,7 @@ static int tomoyo_path_unlink(struct path *parent, struct dentry *dentry)
  * Returns 0 on success, negative value otherwise.
  */
 static int tomoyo_path_mkdir(struct path *parent, struct dentry *dentry,
-                             int mode)
+                             umode_t mode)
 {
         struct path path = { parent->mnt, dentry };
         return tomoyo_path_number_perm(TOMOYO_TYPE_MKDIR, &path,
@@ -234,7 +234,7 @@ static int tomoyo_path_symlink(struct path *parent, struct dentry *dentry,
  * Returns 0 on success, negative value otherwise.
  */
 static int tomoyo_path_mknod(struct path *parent, struct dentry *dentry,
-                             int mode, unsigned int dev)
+                             umode_t mode, unsigned int dev)
 {
         struct path path = { parent->mnt, dentry };
         int type = TOMOYO_TYPE_CREATE;
@@ -353,17 +353,14 @@ static int tomoyo_file_ioctl(struct file *file, unsigned int cmd,
 /**
  * tomoyo_path_chmod - Target for security_path_chmod().
  *
- * @dentry: Pointer to "struct dentry".
- * @mnt:    Pointer to "struct vfsmount".
- * @mode:   DAC permission mode.
+ * @path: Pointer to "struct path".
+ * @mode: DAC permission mode.
  *
  * Returns 0 on success, negative value otherwise.
  */
-static int tomoyo_path_chmod(struct dentry *dentry, struct vfsmount *mnt,
-                             mode_t mode)
+static int tomoyo_path_chmod(struct path *path, umode_t mode)
 {
-        struct path path = { mnt, dentry };
-        return tomoyo_path_number_perm(TOMOYO_TYPE_CHMOD, &path,
+        return tomoyo_path_number_perm(TOMOYO_TYPE_CHMOD, path,
                                        mode & S_IALLUGO);
 }