3 files changed, 11 insertions, 8 deletions

diff --git a/security/inode.c b/security/inode.c
index c3a793881d04..1c812e874504 100644
--- a/security/inode.c
+++ b/security/inode.c
@@ -161,13 +161,13 @@ static int create_by_name(const char *name, mode_t mode,
 
         mutex_lock(&parent->d_inode->i_mutex);
         *dentry = lookup_one_len(name, parent, strlen(name));
-        if (!IS_ERR(dentry)) {
+        if (!IS_ERR(*dentry)) {
                 if ((mode & S_IFMT) == S_IFDIR)
                         error = mkdir(parent->d_inode, *dentry, mode);
                 else
                         error = create(parent->d_inode, *dentry, mode);
         } else
-                error = PTR_ERR(dentry);
+                error = PTR_ERR(*dentry);
         mutex_unlock(&parent->d_inode->i_mutex);
 
         return error;
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 03fe63ed55bd..ea97c3120d66 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -68,7 +68,8 @@ static int call_sbin_request_key(struct key_construction *cons,
 {
         const struct cred *cred = current_cred();
         key_serial_t prkey, sskey;
-        struct key *key = cons->key, *authkey = cons->authkey, *keyring;
+        struct key *key = cons->key, *authkey = cons->authkey, *keyring,
+                *session;
         char *argv[9], *envp[3], uid_str[12], gid_str[12];
         char key_str[12], keyring_str[3][12];
         char desc[20];
@@ -112,10 +113,12 @@ static int call_sbin_request_key(struct key_construction *cons,
         if (cred->tgcred->process_keyring)
                 prkey = cred->tgcred->process_keyring->serial;
 
-        if (cred->tgcred->session_keyring)
-                sskey = rcu_dereference(cred->tgcred->session_keyring)->serial;
-        else
-                sskey = cred->user->session_keyring->serial;
+        rcu_read_lock();
+        session = rcu_dereference(cred->tgcred->session_keyring);
+        if (!session)
+                session = cred->user->session_keyring;
+        sskey = session->serial;
+        rcu_read_unlock();
 
         sprintf(keyring_str[2], "%d", sskey);
 
diff --git a/security/selinux/ss/avtab.h b/security/selinux/ss/avtab.h
index 8da6a8428086..cd4f734e2749 100644
--- a/security/selinux/ss/avtab.h
+++ b/security/selinux/ss/avtab.h
@@ -82,7 +82,7 @@ struct avtab_node *avtab_search_node_next(struct avtab_node *node, int specified
 void avtab_cache_init(void);
 void avtab_cache_destroy(void);
 
-#define MAX_AVTAB_HASH_BITS 13
+#define MAX_AVTAB_HASH_BITS 11
 #define MAX_AVTAB_HASH_BUCKETS (1 << MAX_AVTAB_HASH_BITS)
 #define MAX_AVTAB_HASH_MASK (MAX_AVTAB_HASH_BUCKETS-1)
 #define MAX_AVTAB_SIZE MAX_AVTAB_HASH_BUCKETS