Merge branch 'next' into for-linus

diff --combined fs/namei.c
index 1f13751693a5007e8ba1be6b0b06c948665b260c,ee01308a01d1c09e320c7deb97dbfbb6af9c0542..fcfc5539252c2acec1bb80c71216e17baa86d8d5
--- 1/fs/namei.c
--- 2/fs/namei.c
+++ b/fs/namei.c
@@@ -1533,40 -1533,39 +1533,42 @@@ int may_open(struct path *path, int acc
        if (error)
                return error;
  
-       error = ima_path_check(path,
-                              acc_mode & (MAY_READ | MAY_WRITE | MAY_EXEC),
+       error = ima_path_check(path, acc_mode ?
+                              acc_mode & (MAY_READ | MAY_WRITE | MAY_EXEC) :
+                              ACC_MODE(flag) & (MAY_READ | MAY_WRITE),
                               IMA_COUNT_UPDATE);
+ 
        if (error)
                return error;
        /*
         * An append-only file must be opened in append mode for writing.
         */
        if (IS_APPEND(inode)) {
 +              error = -EPERM;
                if  ((flag & FMODE_WRITE) && !(flag & O_APPEND))
 -                      return -EPERM;
 +                      goto err_out;
                if (flag & O_TRUNC)
 -                      return -EPERM;
 +                      goto err_out;
        }
  
        /* O_NOATIME can only be set by the owner or superuser */
        if (flag & O_NOATIME)
 -              if (!is_owner_or_cap(inode))
 -                      return -EPERM;
 +              if (!is_owner_or_cap(inode)) {
 +                      error = -EPERM;
 +                      goto err_out;
 +              }
  
        /*
         * Ensure there are no outstanding leases on the file.
         */
        error = break_lease(inode, flag);
        if (error)
 -              return error;
 +              goto err_out;
  
        if (flag & O_TRUNC) {
                error = get_write_access(inode);
                if (error)
 -                      return error;
 +                      goto err_out;
  
                /*
                 * Refuse to truncate files with mandatory locks held on them.
@@@ -1584,17 -1583,12 +1586,17 @@@
                }
                put_write_access(inode);
                if (error)
 -                      return error;
 +                      goto err_out;
        } else
                if (flag & FMODE_WRITE)
                        vfs_dq_init(inode);
  
        return 0;
 +err_out:
 +      ima_counts_put(path, acc_mode ?
 +                     acc_mode & (MAY_READ | MAY_WRITE | MAY_EXEC) :
 +                     ACC_MODE(flag) & (MAY_READ | MAY_WRITE));
 +      return error;
  }
  
  /*

diff --combined kernel/fork.c
index e6c04d462ab250b806cd2e7d76d84fd1729d121e,043b5d88049b0ef7bd83ba2e8b7fc8ce4058e672..aab8579c6093bb5f1c63a26876d45546e25c21df
--- 1/kernel/fork.c
--- 2/kernel/fork.c
+++ b/kernel/fork.c
@@@ -152,8 -152,7 +152,7 @@@ void __put_task_struct(struct task_stru
        WARN_ON(atomic_read(&tsk->usage));
        WARN_ON(tsk == current);
  
-       put_cred(tsk->real_cred);
-       put_cred(tsk->cred);
+       exit_creds(tsk);
        delayacct_tsk_free(tsk);
  
        if (!profile_handoff_task(tsk))
@@@ -815,8 -814,11 +814,8 @@@ static int copy_signal(unsigned long cl
  {
        struct signal_struct *sig;
  
 -      if (clone_flags & CLONE_THREAD) {
 -              atomic_inc(&current->signal->count);
 -              atomic_inc(&current->signal->live);
 +      if (clone_flags & CLONE_THREAD)
                return 0;
 -      }
  
        sig = kmem_cache_alloc(signal_cachep, GFP_KERNEL);
        tsk->signal = sig;
@@@ -874,6 -876,16 +873,6 @@@ void __cleanup_signal(struct signal_str
        kmem_cache_free(signal_cachep, sig);
  }
  
 -static void cleanup_signal(struct task_struct *tsk)
 -{
 -      struct signal_struct *sig = tsk->signal;
 -
 -      atomic_dec(&sig->live);
 -
 -      if (atomic_dec_and_test(&sig->count))
 -              __cleanup_signal(sig);
 -}
 -
  static void copy_flags(unsigned long clone_flags, struct task_struct *p)
  {
        unsigned long new_flags = p->flags;
@@@ -1226,8 -1238,6 +1225,8 @@@ static struct task_struct *copy_process
        }
  
        if (clone_flags & CLONE_THREAD) {
 +              atomic_inc(&current->signal->count);
 +              atomic_inc(&current->signal->live);
                p->group_leader = current->group_leader;
                list_add_tail_rcu(&p->thread_group, &p->group_leader->thread_group);
        }
@@@ -1271,8 -1281,7 +1270,8 @@@ bad_fork_cleanup_mm
        if (p->mm)
                mmput(p->mm);
  bad_fork_cleanup_signal:
 -      cleanup_signal(p);
 +      if (!(clone_flags & CLONE_THREAD))
 +              __cleanup_signal(p->signal);
  bad_fork_cleanup_sighand:
        __cleanup_sighand(p->sighand);
  bad_fork_cleanup_fs:
@@@ -1297,8 -1306,7 +1296,7 @@@ bad_fork_cleanup_put_domain
        module_put(task_thread_info(p)->exec_domain->module);
  bad_fork_cleanup_count:
        atomic_dec(&p->cred->user->processes);
-       put_cred(p->real_cred);
-       put_cred(p->cred);
+       exit_creds(p);
  bad_fork_free:
        free_task(p);
  fork_out: