9 files changed, 41 insertions, 30 deletions

diff --git a/security/keys/key.c b/security/keys/key.c
index 3304d37bb379..fb89f9844465 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -980,7 +980,7 @@ void unregister_key_type(struct key_type *ktype)
         spin_unlock(&key_serial_lock);
 
         /* make sure everyone revalidates their keys */
-        synchronize_kernel();
+        synchronize_rcu();
 
         /* we should now be able to destroy the payloads of all the keys of
          * this type with impunity */
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 34db087bbcc7..9b0369c5a223 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -234,7 +234,7 @@ static int install_session_keyring(struct task_struct *tsk,
         ret = 0;
 
         /* we're using RCU on the pointer */
-        synchronize_kernel();
+        synchronize_rcu();
         key_put(old);
  error:
         return ret;
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 87302a49067b..17a1189f1ff8 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1658,9 +1658,8 @@ static int selinux_bprm_secureexec (struct linux_binprm *bprm)
 
 static void selinux_bprm_free_security(struct linux_binprm *bprm)
 {
-        struct bprm_security_struct *bsec = bprm->security;
+        kfree(bprm->security);
         bprm->security = NULL;
-        kfree(bsec);
 }
 
 extern struct vfsmount *selinuxfs_mount;
@@ -2477,6 +2476,17 @@ static int selinux_file_mprotect(struct vm_area_struct *vma,
                 prot = reqprot;
 
 #ifndef CONFIG_PPC32
+        if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXECUTABLE) &&
+           (vma->vm_start >= vma->vm_mm->start_brk &&
+            vma->vm_end <= vma->vm_mm->brk)) {
+                /*
+                 * We are making an executable mapping in the brk region.
+                 * This has an additional execheap check.
+                 */
+                rc = task_has_perm(current, current, PROCESS__EXECHEAP);
+                if (rc)
+                        return rc;
+        }
         if (vma->vm_file != NULL && vma->anon_vma != NULL && (prot & PROT_EXEC)) {
                 /*
                  * We are making executable a file mapping that has
@@ -2488,6 +2498,16 @@ static int selinux_file_mprotect(struct vm_area_struct *vma,
                 if (rc)
                         return rc;
         }
+        if (!vma->vm_file && (prot & PROT_EXEC) &&
+                vma->vm_start <= vma->vm_mm->start_stack &&
+                vma->vm_end >= vma->vm_mm->start_stack) {
+                /* Attempt to make the process stack executable.
+                 * This has an additional execstack check.
+                 */
+                rc = task_has_perm(current, current, PROCESS__EXECSTACK);
+                if (rc)
+                        return rc;
+        }
 #endif
 
         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
diff --git a/security/selinux/include/av_perm_to_string.h b/security/selinux/include/av_perm_to_string.h
index 8928bb4d3c53..1deb59e1b762 100644
--- a/security/selinux/include/av_perm_to_string.h
+++ b/security/selinux/include/av_perm_to_string.h
@@ -70,6 +70,8 @@
    S_(SECCLASS_PROCESS, PROCESS__DYNTRANSITION, "dyntransition")
    S_(SECCLASS_PROCESS, PROCESS__SETCURRENT, "setcurrent")
    S_(SECCLASS_PROCESS, PROCESS__EXECMEM, "execmem")
+   S_(SECCLASS_PROCESS, PROCESS__EXECSTACK, "execstack")
+   S_(SECCLASS_PROCESS, PROCESS__EXECHEAP, "execheap")
    S_(SECCLASS_MSGQ, MSGQ__ENQUEUE, "enqueue")
    S_(SECCLASS_MSG, MSG__SEND, "send")
    S_(SECCLASS_MSG, MSG__RECEIVE, "receive")
diff --git a/security/selinux/include/av_permissions.h b/security/selinux/include/av_permissions.h
index bdfce4ca8f8e..a78b5d59c9fc 100644
--- a/security/selinux/include/av_permissions.h
+++ b/security/selinux/include/av_permissions.h
@@ -465,6 +465,8 @@
 #define PROCESS__DYNTRANSITION                    0x00800000UL
 #define PROCESS__SETCURRENT                       0x01000000UL
 #define PROCESS__EXECMEM                          0x02000000UL
+#define PROCESS__EXECSTACK                        0x04000000UL
+#define PROCESS__EXECHEAP                         0x08000000UL
 
 #define IPC__CREATE                               0x00000001UL
 #define IPC__DESTROY                              0x00000002UL
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 07221568b505..8eb140dd2e4b 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -951,8 +951,7 @@ static int sel_make_bools(void)
         u32 sid;
 
         /* remove any existing files */
-        if (bool_pending_values)
-                kfree(bool_pending_values);
+        kfree(bool_pending_values);
 
         sel_remove_bools(dir);
 
@@ -997,10 +996,8 @@ static int sel_make_bools(void)
 out:
         free_page((unsigned long)page);
         if (names) {
-                for (i = 0; i < num; i++) {
-                        if (names[i])
-                                kfree(names[i]);
-                }
+                for (i = 0; i < num; i++)
+                        kfree(names[i]);
                 kfree(names);
         }
         return ret;
diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c
index b53441184aca..e2057f5a411a 100644
--- a/security/selinux/ss/conditional.c
+++ b/security/selinux/ss/conditional.c
@@ -166,16 +166,14 @@ static void cond_list_destroy(struct cond_node *list)
 
 void cond_policydb_destroy(struct policydb *p)
 {
-        if (p->bool_val_to_struct != NULL)
-                kfree(p->bool_val_to_struct);
+        kfree(p->bool_val_to_struct);
         avtab_destroy(&p->te_cond_avtab);
         cond_list_destroy(p->cond_list);
 }
 
 int cond_init_bool_indexes(struct policydb *p)
 {
-        if (p->bool_val_to_struct)
-                kfree(p->bool_val_to_struct);
+        kfree(p->bool_val_to_struct);
         p->bool_val_to_struct = (struct cond_bool_datum**)
                 kmalloc(p->p_bools.nprim * sizeof(struct cond_bool_datum*), GFP_KERNEL);
         if (!p->bool_val_to_struct)
@@ -185,8 +183,7 @@ int cond_init_bool_indexes(struct policydb *p)
 
 int cond_destroy_bool(void *key, void *datum, void *p)
 {
-        if (key)
-                kfree(key);
+        kfree(key);
         kfree(datum);
         return 0;
 }
diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index 14190efbf333..785c33cf4864 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -590,17 +590,12 @@ void policydb_destroy(struct policydb *p)
                 hashtab_destroy(p->symtab[i].table);
         }
 
-        for (i = 0; i < SYM_NUM; i++) {
-                if (p->sym_val_to_name[i])
-                        kfree(p->sym_val_to_name[i]);
-        }
+        for (i = 0; i < SYM_NUM; i++)
+                kfree(p->sym_val_to_name[i]);
 
-        if (p->class_val_to_struct)
-                kfree(p->class_val_to_struct);
-        if (p->role_val_to_struct)
-                kfree(p->role_val_to_struct);
-        if (p->user_val_to_struct)
-                kfree(p->user_val_to_struct);
+        kfree(p->class_val_to_struct);
+        kfree(p->role_val_to_struct);
+        kfree(p->user_val_to_struct);
 
         avtab_destroy(&p->te_avtab);
 
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index b6149147d5cb..922bb45054aa 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -1705,11 +1705,9 @@ out:
 err:
         if (*names) {
                 for (i = 0; i < *len; i++)
-                        if ((*names)[i])
-                                kfree((*names)[i]);
+                        kfree((*names)[i]);
         }
-        if (*values)
-                kfree(*values);
+        kfree(*values);
         goto out;
 }