blob: cce621c33dce559b346e44d247f70076f4488a85 [file] [log] [blame]
David Howells5d135442009-09-02 09:14:00 +01001/* Key garbage collector
2 *
David Howells0c061b52011-08-22 14:09:36 +01003 * Copyright (C) 2009-2011 Red Hat, Inc. All Rights Reserved.
David Howells5d135442009-09-02 09:14:00 +01004 * Written by David Howells (dhowells@redhat.com)
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public Licence
8 * as published by the Free Software Foundation; either version
9 * 2 of the Licence, or (at your option) any later version.
10 */
11
12#include <linux/module.h>
David Howells8bc16de2011-08-22 14:09:11 +010013#include <linux/slab.h>
14#include <linux/security.h>
David Howells5d135442009-09-02 09:14:00 +010015#include <keys/keyring-type.h>
16#include "internal.h"
17
18/*
19 * Delay between key revocation/expiry in seconds
20 */
21unsigned key_gc_delay = 5 * 60;
22
23/*
David Howells8bc16de2011-08-22 14:09:11 +010024 * Reaper for unused keys.
25 */
David Howells0c061b52011-08-22 14:09:36 +010026static void key_garbage_collector(struct work_struct *work);
27DECLARE_WORK(key_gc_work, key_garbage_collector);
David Howells8bc16de2011-08-22 14:09:11 +010028
29/*
30 * Reaper for links from keyrings to dead keys.
David Howells5d135442009-09-02 09:14:00 +010031 */
32static void key_gc_timer_func(unsigned long);
David Howells5d135442009-09-02 09:14:00 +010033static DEFINE_TIMER(key_gc_timer, key_gc_timer_func, 0, 0);
David Howells0c061b52011-08-22 14:09:36 +010034
David Howells5d135442009-09-02 09:14:00 +010035static time_t key_gc_next_run = LONG_MAX;
David Howells0c061b52011-08-22 14:09:36 +010036static struct key_type *key_gc_dead_keytype;
37
38static unsigned long key_gc_flags;
39#define KEY_GC_KEY_EXPIRED 0 /* A key expired and needs unlinking */
40#define KEY_GC_REAP_KEYTYPE 1 /* A keytype is being unregistered */
41#define KEY_GC_REAPING_KEYTYPE 2 /* Cleared when keytype reaped */
42
43
44/*
45 * Any key whose type gets unregistered will be re-typed to this if it can't be
46 * immediately unlinked.
47 */
48struct key_type key_type_dead = {
49 .name = "dead",
50};
David Howells5d135442009-09-02 09:14:00 +010051
52/*
David Howells973c9f42011-01-20 16:38:33 +000053 * Schedule a garbage collection run.
54 * - time precision isn't particularly important
David Howells5d135442009-09-02 09:14:00 +010055 */
56void key_schedule_gc(time_t gc_at)
57{
58 unsigned long expires;
59 time_t now = current_kernel_time().tv_sec;
60
61 kenter("%ld", gc_at - now);
62
David Howells0c061b52011-08-22 14:09:36 +010063 if (gc_at <= now || test_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags)) {
64 kdebug("IMMEDIATE");
Tejun Heo3b07e9c2012-08-20 14:51:24 -070065 schedule_work(&key_gc_work);
David Howells5d135442009-09-02 09:14:00 +010066 } else if (gc_at < key_gc_next_run) {
David Howells0c061b52011-08-22 14:09:36 +010067 kdebug("DEFERRED");
68 key_gc_next_run = gc_at;
David Howells5d135442009-09-02 09:14:00 +010069 expires = jiffies + (gc_at - now) * HZ;
70 mod_timer(&key_gc_timer, expires);
71 }
72}
73
74/*
David Howellsfd758152012-05-11 10:56:56 +010075 * Schedule a dead links collection run.
76 */
77void key_schedule_gc_links(void)
78{
79 set_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags);
Tejun Heo3b07e9c2012-08-20 14:51:24 -070080 schedule_work(&key_gc_work);
David Howellsfd758152012-05-11 10:56:56 +010081}
82
83/*
David Howells0c061b52011-08-22 14:09:36 +010084 * Some key's cleanup time was met after it expired, so we need to get the
85 * reaper to go through a cycle finding expired keys.
David Howells5d135442009-09-02 09:14:00 +010086 */
87static void key_gc_timer_func(unsigned long data)
88{
89 kenter("");
90 key_gc_next_run = LONG_MAX;
David Howellsfd758152012-05-11 10:56:56 +010091 key_schedule_gc_links();
David Howells5d135442009-09-02 09:14:00 +010092}
93
94/*
David Howells0c061b52011-08-22 14:09:36 +010095 * wait_on_bit() sleep function for uninterruptible waiting
96 */
97static int key_gc_wait_bit(void *flags)
98{
99 schedule();
100 return 0;
101}
102
103/*
104 * Reap keys of dead type.
105 *
106 * We use three flags to make sure we see three complete cycles of the garbage
107 * collector: the first to mark keys of that type as being dead, the second to
108 * collect dead links and the third to clean up the dead keys. We have to be
109 * careful as there may already be a cycle in progress.
110 *
111 * The caller must be holding key_types_sem.
112 */
113void key_gc_keytype(struct key_type *ktype)
114{
115 kenter("%s", ktype->name);
116
117 key_gc_dead_keytype = ktype;
118 set_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
119 smp_mb();
120 set_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags);
121
122 kdebug("schedule");
Tejun Heo3b07e9c2012-08-20 14:51:24 -0700123 schedule_work(&key_gc_work);
David Howells0c061b52011-08-22 14:09:36 +0100124
125 kdebug("sleep");
126 wait_on_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE, key_gc_wait_bit,
127 TASK_UNINTERRUPTIBLE);
128
129 key_gc_dead_keytype = NULL;
130 kleave("");
131}
132
David Howellsb2a4df22013-09-24 10:35:18 +0100133static int key_gc_keyring_func(const void *object, void *iterator_data)
134{
135 const struct key *key = object;
136 time_t *limit = iterator_data;
137 return key_is_dead(key, *limit);
138}
139
David Howells0c061b52011-08-22 14:09:36 +0100140/*
David Howells973c9f42011-01-20 16:38:33 +0000141 * Garbage collect pointers from a keyring.
142 *
David Howells0c061b52011-08-22 14:09:36 +0100143 * Not called with any locks held. The keyring's key struct will not be
144 * deallocated under us as only our caller may deallocate it.
David Howells5d135442009-09-02 09:14:00 +0100145 */
David Howells0c061b52011-08-22 14:09:36 +0100146static void key_gc_keyring(struct key *keyring, time_t limit)
David Howells5d135442009-09-02 09:14:00 +0100147{
David Howellsb2a4df22013-09-24 10:35:18 +0100148 int result;
David Howells5d135442009-09-02 09:14:00 +0100149
David Howellsb2a4df22013-09-24 10:35:18 +0100150 kenter("%x{%s}", keyring->serial, keyring->description ?: "");
David Howells5d135442009-09-02 09:14:00 +0100151
David Howellsfd758152012-05-11 10:56:56 +0100152 if (keyring->flags & ((1 << KEY_FLAG_INVALIDATED) |
153 (1 << KEY_FLAG_REVOKED)))
David Howells5d135442009-09-02 09:14:00 +0100154 goto dont_gc;
155
156 /* scan the keyring looking for dead keys */
David Howellscf8304e2010-05-04 14:16:10 +0100157 rcu_read_lock();
David Howellsb2a4df22013-09-24 10:35:18 +0100158 result = assoc_array_iterate(&keyring->keys,
159 key_gc_keyring_func, &limit);
David Howellscf8304e2010-05-04 14:16:10 +0100160 rcu_read_unlock();
David Howellsb2a4df22013-09-24 10:35:18 +0100161 if (result == true)
162 goto do_gc;
163
David Howells5d135442009-09-02 09:14:00 +0100164dont_gc:
David Howells0c061b52011-08-22 14:09:36 +0100165 kleave(" [no gc]");
166 return;
David Howells5d135442009-09-02 09:14:00 +0100167
168do_gc:
David Howells5d135442009-09-02 09:14:00 +0100169 keyring_gc(keyring, limit);
David Howells0c061b52011-08-22 14:09:36 +0100170 kleave(" [gc]");
David Howells5d135442009-09-02 09:14:00 +0100171}
172
173/*
David Howells65d87fe2012-05-11 10:56:56 +0100174 * Garbage collect a list of unreferenced, detached keys
David Howells5d135442009-09-02 09:14:00 +0100175 */
David Howells65d87fe2012-05-11 10:56:56 +0100176static noinline void key_gc_unused_keys(struct list_head *keys)
David Howells5d135442009-09-02 09:14:00 +0100177{
David Howells65d87fe2012-05-11 10:56:56 +0100178 while (!list_empty(keys)) {
179 struct key *key =
180 list_entry(keys->next, struct key, graveyard_link);
181 list_del(&key->graveyard_link);
David Howells8bc16de2011-08-22 14:09:11 +0100182
David Howells65d87fe2012-05-11 10:56:56 +0100183 kdebug("- %u", key->serial);
184 key_check(key);
David Howells8bc16de2011-08-22 14:09:11 +0100185
David Howells65d87fe2012-05-11 10:56:56 +0100186 security_key_free(key);
David Howells8bc16de2011-08-22 14:09:11 +0100187
David Howells65d87fe2012-05-11 10:56:56 +0100188 /* deal with the user's key tracking and quota */
189 if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) {
190 spin_lock(&key->user->lock);
191 key->user->qnkeys--;
192 key->user->qnbytes -= key->quotalen;
193 spin_unlock(&key->user->lock);
194 }
David Howells8bc16de2011-08-22 14:09:11 +0100195
David Howells65d87fe2012-05-11 10:56:56 +0100196 atomic_dec(&key->user->nkeys);
197 if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
198 atomic_dec(&key->user->nikeys);
David Howells8bc16de2011-08-22 14:09:11 +0100199
David Howells65d87fe2012-05-11 10:56:56 +0100200 key_user_put(key->user);
David Howells8bc16de2011-08-22 14:09:11 +0100201
David Howells65d87fe2012-05-11 10:56:56 +0100202 /* now throw away the key memory */
203 if (key->type->destroy)
204 key->type->destroy(key);
205
206 kfree(key->description);
David Howells8bc16de2011-08-22 14:09:11 +0100207
208#ifdef KEY_DEBUGGING
David Howells65d87fe2012-05-11 10:56:56 +0100209 key->magic = KEY_DEBUG_MAGIC_X;
David Howells8bc16de2011-08-22 14:09:11 +0100210#endif
David Howells65d87fe2012-05-11 10:56:56 +0100211 kmem_cache_free(key_jar, key);
212 }
David Howells0c061b52011-08-22 14:09:36 +0100213}
David Howells8bc16de2011-08-22 14:09:11 +0100214
David Howells0c061b52011-08-22 14:09:36 +0100215/*
216 * Garbage collector for unused keys.
217 *
218 * This is done in process context so that we don't have to disable interrupts
219 * all over the place. key_put() schedules this rather than trying to do the
220 * cleanup itself, which means key_put() doesn't have to sleep.
221 */
222static void key_garbage_collector(struct work_struct *work)
223{
David Howells65d87fe2012-05-11 10:56:56 +0100224 static LIST_HEAD(graveyard);
David Howells0c061b52011-08-22 14:09:36 +0100225 static u8 gc_state; /* Internal persistent state */
226#define KEY_GC_REAP_AGAIN 0x01 /* - Need another cycle */
227#define KEY_GC_REAPING_LINKS 0x02 /* - We need to reap links */
228#define KEY_GC_SET_TIMER 0x04 /* - We need to restart the timer */
229#define KEY_GC_REAPING_DEAD_1 0x10 /* - We need to mark dead keys */
230#define KEY_GC_REAPING_DEAD_2 0x20 /* - We need to reap dead key links */
231#define KEY_GC_REAPING_DEAD_3 0x40 /* - We need to reap dead keys */
232#define KEY_GC_FOUND_DEAD_KEY 0x80 /* - We found at least one dead key */
233
234 struct rb_node *cursor;
235 struct key *key;
236 time_t new_timer, limit;
237
238 kenter("[%lx,%x]", key_gc_flags, gc_state);
239
240 limit = current_kernel_time().tv_sec;
241 if (limit > key_gc_delay)
242 limit -= key_gc_delay;
243 else
244 limit = key_gc_delay;
245
246 /* Work out what we're going to be doing in this pass */
247 gc_state &= KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2;
248 gc_state <<= 1;
249 if (test_and_clear_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags))
250 gc_state |= KEY_GC_REAPING_LINKS | KEY_GC_SET_TIMER;
251
252 if (test_and_clear_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags))
253 gc_state |= KEY_GC_REAPING_DEAD_1;
254 kdebug("new pass %x", gc_state);
255
256 new_timer = LONG_MAX;
257
258 /* As only this function is permitted to remove things from the key
259 * serial tree, if cursor is non-NULL then it will always point to a
260 * valid node in the tree - even if lock got dropped.
261 */
262 spin_lock(&key_serial_lock);
263 cursor = rb_first(&key_serial_tree);
264
265continue_scanning:
266 while (cursor) {
267 key = rb_entry(cursor, struct key, serial_node);
268 cursor = rb_next(cursor);
269
270 if (atomic_read(&key->usage) == 0)
271 goto found_unreferenced_key;
272
273 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_1)) {
274 if (key->type == key_gc_dead_keytype) {
275 gc_state |= KEY_GC_FOUND_DEAD_KEY;
276 set_bit(KEY_FLAG_DEAD, &key->flags);
277 key->perm = 0;
278 goto skip_dead_key;
279 }
280 }
281
282 if (gc_state & KEY_GC_SET_TIMER) {
283 if (key->expiry > limit && key->expiry < new_timer) {
284 kdebug("will expire %x in %ld",
285 key_serial(key), key->expiry - limit);
286 new_timer = key->expiry;
287 }
288 }
289
290 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2))
291 if (key->type == key_gc_dead_keytype)
292 gc_state |= KEY_GC_FOUND_DEAD_KEY;
293
294 if ((gc_state & KEY_GC_REAPING_LINKS) ||
295 unlikely(gc_state & KEY_GC_REAPING_DEAD_2)) {
296 if (key->type == &key_type_keyring)
297 goto found_keyring;
298 }
299
300 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3))
301 if (key->type == key_gc_dead_keytype)
302 goto destroy_dead_key;
303
304 skip_dead_key:
305 if (spin_is_contended(&key_serial_lock) || need_resched())
306 goto contended;
307 }
308
309contended:
310 spin_unlock(&key_serial_lock);
311
312maybe_resched:
313 if (cursor) {
314 cond_resched();
315 spin_lock(&key_serial_lock);
316 goto continue_scanning;
317 }
318
319 /* We've completed the pass. Set the timer if we need to and queue a
320 * new cycle if necessary. We keep executing cycles until we find one
321 * where we didn't reap any keys.
322 */
323 kdebug("pass complete");
324
325 if (gc_state & KEY_GC_SET_TIMER && new_timer != (time_t)LONG_MAX) {
326 new_timer += key_gc_delay;
327 key_schedule_gc(new_timer);
328 }
329
David Howells65d87fe2012-05-11 10:56:56 +0100330 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2) ||
331 !list_empty(&graveyard)) {
332 /* Make sure that all pending keyring payload destructions are
333 * fulfilled and that people aren't now looking at dead or
334 * dying keys that they don't have a reference upon or a link
335 * to.
David Howells0c061b52011-08-22 14:09:36 +0100336 */
David Howells65d87fe2012-05-11 10:56:56 +0100337 kdebug("gc sync");
David Howells0c061b52011-08-22 14:09:36 +0100338 synchronize_rcu();
339 }
340
David Howells65d87fe2012-05-11 10:56:56 +0100341 if (!list_empty(&graveyard)) {
342 kdebug("gc keys");
343 key_gc_unused_keys(&graveyard);
344 }
345
David Howells0c061b52011-08-22 14:09:36 +0100346 if (unlikely(gc_state & (KEY_GC_REAPING_DEAD_1 |
347 KEY_GC_REAPING_DEAD_2))) {
348 if (!(gc_state & KEY_GC_FOUND_DEAD_KEY)) {
349 /* No remaining dead keys: short circuit the remaining
350 * keytype reap cycles.
351 */
352 kdebug("dead short");
353 gc_state &= ~(KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2);
354 gc_state |= KEY_GC_REAPING_DEAD_3;
355 } else {
356 gc_state |= KEY_GC_REAP_AGAIN;
357 }
358 }
359
360 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3)) {
361 kdebug("dead wake");
362 smp_mb();
363 clear_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
364 wake_up_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE);
365 }
366
367 if (gc_state & KEY_GC_REAP_AGAIN)
Tejun Heo3b07e9c2012-08-20 14:51:24 -0700368 schedule_work(&key_gc_work);
David Howells0c061b52011-08-22 14:09:36 +0100369 kleave(" [end %x]", gc_state);
370 return;
371
372 /* We found an unreferenced key - once we've removed it from the tree,
373 * we can safely drop the lock.
374 */
375found_unreferenced_key:
376 kdebug("unrefd key %d", key->serial);
377 rb_erase(&key->serial_node, &key_serial_tree);
378 spin_unlock(&key_serial_lock);
379
David Howells65d87fe2012-05-11 10:56:56 +0100380 list_add_tail(&key->graveyard_link, &graveyard);
David Howells0c061b52011-08-22 14:09:36 +0100381 gc_state |= KEY_GC_REAP_AGAIN;
382 goto maybe_resched;
383
384 /* We found a keyring and we need to check the payload for links to
385 * dead or expired keys. We don't flag another reap immediately as we
386 * have to wait for the old payload to be destroyed by RCU before we
387 * can reap the keys to which it refers.
388 */
389found_keyring:
390 spin_unlock(&key_serial_lock);
David Howells0c061b52011-08-22 14:09:36 +0100391 key_gc_keyring(key, limit);
392 goto maybe_resched;
393
394 /* We found a dead key that is still referenced. Reset its type and
395 * destroy its payload with its semaphore held.
396 */
397destroy_dead_key:
398 spin_unlock(&key_serial_lock);
399 kdebug("destroy key %d", key->serial);
400 down_write(&key->sem);
401 key->type = &key_type_dead;
402 if (key_gc_dead_keytype->destroy)
403 key_gc_dead_keytype->destroy(key);
404 memset(&key->payload, KEY_DESTROY, sizeof(key->payload));
405 up_write(&key->sem);
406 goto maybe_resched;
David Howells8bc16de2011-08-22 14:09:11 +0100407}