5 files changed, 23 insertions, 17 deletions

diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
index ffbe259700b1..510186f0b72e 100644
--- a/security/integrity/ima/ima_fs.c
+++ b/security/integrity/ima/ima_fs.c
@@ -84,8 +84,8 @@ static void *ima_measurements_next(struct seq_file *m, void *v, loff_t *pos)
          * against concurrent list-extension
          */
         rcu_read_lock();
-        qe = list_entry(rcu_dereference(qe->later.next),
-                        struct ima_queue_entry, later);
+        qe = list_entry_rcu(qe->later.next,
+                            struct ima_queue_entry, later);
         rcu_read_unlock();
         (*pos)++;
 
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index e03a7e19c73b..11d2cb19d7a6 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -734,8 +734,8 @@ static void smk_netlbladdr_insert(struct smk_netlbladdr *new)
                 return;
         }
 
-        m = list_entry(rcu_dereference(smk_netlbladdr_list.next),
-                         struct smk_netlbladdr, list);
+        m = list_entry_rcu(smk_netlbladdr_list.next,
+                           struct smk_netlbladdr, list);
 
         /* the comparison '>' is a bit hacky, but works */
         if (new->smk_mask.s_addr > m->smk_mask.s_addr) {
@@ -748,8 +748,8 @@ static void smk_netlbladdr_insert(struct smk_netlbladdr *new)
                         list_add_rcu(&new->list, &m->list);
                         return;
                 }
-                m_next = list_entry(rcu_dereference(m->list.next),
-                                 struct smk_netlbladdr, list);
+                m_next = list_entry_rcu(m->list.next,
+                                        struct smk_netlbladdr, list);
                 if (new->smk_mask.s_addr > m_next->smk_mask.s_addr) {
                         list_add_rcu(&new->list, &m->list);
                         return;
diff --git a/security/tomoyo/common.c b/security/tomoyo/common.c
index d4d41b3efc7c..ddfb9cccf468 100644
--- a/security/tomoyo/common.c
+++ b/security/tomoyo/common.c
@@ -1720,14 +1720,14 @@ static bool tomoyo_policy_loader_exists(void)
          * policies are not loaded yet.
          * Thus, let do_execve() call this function everytime.
          */
-        struct nameidata nd;
+        struct path path;
 
-        if (path_lookup(tomoyo_loader, LOOKUP_FOLLOW, &nd)) {
+        if (kern_path(tomoyo_loader, LOOKUP_FOLLOW, &path)) {
                 printk(KERN_INFO "Not activating Mandatory Access Control now "
                        "since %s doesn't exist.\n", tomoyo_loader);
                 return false;
         }
-        path_put(&nd.path);
+        path_put(&path);
         return true;
 }
 
diff --git a/security/tomoyo/realpath.c b/security/tomoyo/realpath.c
index bf8e2b451687..40927a84cb6e 100644
--- a/security/tomoyo/realpath.c
+++ b/security/tomoyo/realpath.c
@@ -165,11 +165,11 @@ char *tomoyo_realpath_from_path(struct path *path)
  */
 char *tomoyo_realpath(const char *pathname)
 {
-        struct nameidata nd;
+        struct path path;
 
-        if (pathname && path_lookup(pathname, LOOKUP_FOLLOW, &nd) == 0) {
-                char *buf = tomoyo_realpath_from_path(&nd.path);
-                path_put(&nd.path);
+        if (pathname && kern_path(pathname, LOOKUP_FOLLOW, &path) == 0) {
+                char *buf = tomoyo_realpath_from_path(&path);
+                path_put(&path);
                 return buf;
         }
         return NULL;
@@ -184,11 +184,11 @@ char *tomoyo_realpath(const char *pathname)
  */
 char *tomoyo_realpath_nofollow(const char *pathname)
 {
-        struct nameidata nd;
+        struct path path;
 
-        if (pathname && path_lookup(pathname, 0, &nd) == 0) {
-                char *buf = tomoyo_realpath_from_path(&nd.path);
-                path_put(&nd.path);
+        if (pathname && kern_path(pathname, 0, &path) == 0) {
+                char *buf = tomoyo_realpath_from_path(&path);
+                path_put(&path);
                 return buf;
         }
         return NULL;
diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c
index 5b481912752a..e42be5c4f055 100644
--- a/security/tomoyo/tomoyo.c
+++ b/security/tomoyo/tomoyo.c
@@ -27,6 +27,12 @@ static int tomoyo_cred_prepare(struct cred *new, const struct cred *old,
 
 static int tomoyo_bprm_set_creds(struct linux_binprm *bprm)
 {
+        int rc;
+
+        rc = cap_bprm_set_creds(bprm);
+        if (rc)
+                return rc;
+
         /*
          * Do only if this function is called for the first time of an execve
          * operation.