Add a reference to ucounts for each cred

[linux-2.6-block.git] / kernel / cred.c

diff --git a/kernel/cred.c b/kernel/cred.c
index 421b1149c6516004221159824dc6c18770db64e6..58a8a9e24347d4202a96a412e17ce2288db5c273 100644 (file)
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -60,6 +60,7 @@ struct cred init_cred = {
        .user                   = INIT_USER,
        .user_ns                = &init_user_ns,
        .group_info             = &init_groups,
+       .ucounts                = &init_ucounts,
 };
 
 static inline void set_cred_subscribers(struct cred *cred, int n)
@@ -119,6 +120,8 @@ static void put_cred_rcu(struct rcu_head *rcu)
        if (cred->group_info)
                put_group_info(cred->group_info);
        free_uid(cred->user);
+       if (cred->ucounts)
+               put_ucounts(cred->ucounts);
        put_user_ns(cred->user_ns);
        kmem_cache_free(cred_jar, cred);
 }
@@ -222,6 +225,7 @@ struct cred *cred_alloc_blank(void)
 #ifdef CONFIG_DEBUG_CREDENTIALS
        new->magic = CRED_MAGIC;
 #endif
+       new->ucounts = get_ucounts(&init_ucounts);
 
        if (security_cred_alloc_blank(new, GFP_KERNEL_ACCOUNT) < 0)
                goto error;
@@ -284,6 +288,11 @@ struct cred *prepare_creds(void)
 
        if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0)
                goto error;
+
+       new->ucounts = get_ucounts(new->ucounts);
+       if (!new->ucounts)
+               goto error;
+
        validate_creds(new);
        return new;
 
@@ -363,6 +372,8 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags)
                ret = create_user_ns(new);
                if (ret < 0)
                        goto error_put;
+               if (set_cred_ucounts(new) < 0)
+                       goto error_put;
        }
 
 #ifdef CONFIG_KEYS
@@ -653,6 +664,31 @@ int cred_fscmp(const struct cred *a, const struct cred *b)
 }
 EXPORT_SYMBOL(cred_fscmp);
 
+int set_cred_ucounts(struct cred *new)
+{
+       struct task_struct *task = current;
+       const struct cred *old = task->real_cred;
+       struct ucounts *old_ucounts = new->ucounts;
+
+       if (new->user == old->user && new->user_ns == old->user_ns)
+               return 0;
+
+       /*
+        * This optimization is needed because alloc_ucounts() uses locks
+        * for table lookups.
+        */
+       if (old_ucounts && old_ucounts->ns == new->user_ns && uid_eq(old_ucounts->uid, new->euid))
+               return 0;
+
+       if (!(new->ucounts = alloc_ucounts(new->user_ns, new->euid)))
+               return -EAGAIN;
+
+       if (old_ucounts)
+               put_ucounts(old_ucounts);
+
+       return 0;
+}
+
 /*
  * initialise the credentials stuff
  */
@@ -719,6 +755,10 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
        if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0)
                goto error;
 
+       new->ucounts = get_ucounts(new->ucounts);
+       if (!new->ucounts)
+               goto error;
+
        put_cred(old);
        validate_creds(new);
        return new;