3 files changed, 5 insertions, 5 deletions

diff --git a/security/keys/compat.c b/security/keys/compat.c
index 1c261763f479..d65fa7fa29ba 100644
--- a/security/keys/compat.c
+++ b/security/keys/compat.c
@@ -40,12 +40,12 @@ static long compat_keyctl_instantiate_key_iov(
                                            ARRAY_SIZE(iovstack),
                                            iovstack, &iov);
         if (ret < 0)
-                return ret;
+                goto err;
         if (ret == 0)
                 goto no_payload_free;
 
         ret = keyctl_instantiate_key_common(id, iov, ioc, ret, ringid);
-
+err:
         if (iov != iovstack)
                 kfree(iov);
         return ret;
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 58dfe0890947..42defae1e161 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -57,7 +57,7 @@ int install_user_keyrings(void)
 
         kenter("%p{%u}", user, uid);
 
-        if (user->uid_keyring) {
+        if (user->uid_keyring && user->session_keyring) {
                 kleave(" = 0 [exist]");
                 return 0;
         }
@@ -839,7 +839,7 @@ void key_change_session_keyring(struct callback_head *twork)
         new-> sgid      = old-> sgid;
         new->fsgid      = old->fsgid;
         new->user       = get_uid(old->user);
-        new->user_ns    = get_user_ns(new->user_ns);
+        new->user_ns    = get_user_ns(old->user_ns);
         new->group_info = get_group_info(old->group_info);
 
         new->securebits = old->securebits;
diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
index 48665ecd1197..8ab295154517 100644
--- a/security/selinux/xfrm.c
+++ b/security/selinux/xfrm.c
@@ -310,7 +310,7 @@ int selinux_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
 
         if (old_ctx) {
                 new_ctx = kmalloc(sizeof(*old_ctx) + old_ctx->ctx_len,
-                                  GFP_KERNEL);
+                                  GFP_ATOMIC);
                 if (!new_ctx)
                         return -ENOMEM;