Merge branch 'keys-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs

Pull key handling fixes from David Howells:
 "Here are two patches, the first of which at least should go upstream
  immediately:

  (1) Prevent a user-triggerable crash in the keyrings destructor when a
      negatively instantiated keyring is garbage collected.  I have also
      seen this triggered for user type keys.

  (2) Prevent the user from using requesting that a keyring be created
      and instantiated through an upcall.  Doing so is probably safe
      since the keyring type ignores the arguments to its instantiation
      function - but we probably shouldn't let keyrings be created in
      this manner"

* 'keys-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs:
  KEYS: Don't permit request_key() to construct a new keyring
  KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring
static int call_usermodehelper_keys(char *path, char **argv, char **envp,
					struct key *session_keyring, int wait)
{
	struct subprocess_info *info;

	info = call_usermodehelper_setup(path, argv, envp, GFP_KERNEL,
					  umh_keys_init, umh_keys_cleanup,
					  session_keyring);
	if (!info)
		return -ENOMEM;

	key_get(session_keyring);
	return call_usermodehelper_exec(info, wait);
}

static int call_usermodehelper_keys(char *path, char **argv, char **envp,
					struct key *session_keyring, int wait)
{
	struct subprocess_info *info;

	info = call_usermodehelper_setup(path, argv, envp, GFP_KERNEL,
					  umh_keys_init, umh_keys_cleanup,
					  session_keyring);
	if (!info)
		return -ENOMEM;

	key_get(session_keyring);
	return call_usermodehelper_exec(info, wait);
}
