1 /* Key garbage collector 2 * 3 * Copyright (C) 2009-2011 Red Hat, Inc. All Rights Reserved. 4 * Written by David Howells (dhowells@redhat.com) 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public Licence 8 * as published by the Free Software Foundation; either version 9 * 2 of the Licence, or (at your option) any later version. 10 */ 11 12 #include <linux/module.h> 13 #include <linux/slab.h> 14 #include <linux/security.h> 15 #include <keys/keyring-type.h> 16 #include "internal.h" 17 18 /* 19 * Delay between key revocation/expiry in seconds 20 */ 21 unsigned key_gc_delay = 5 * 60; 22 23 /* 24 * Reaper for unused keys. 25 */ 26 static void key_garbage_collector(struct work_struct *work); 27 DECLARE_WORK(key_gc_work, key_garbage_collector); 28 29 /* 30 * Reaper for links from keyrings to dead keys. 31 */ 32 static void key_gc_timer_func(struct timer_list *); 33 static DEFINE_TIMER(key_gc_timer, key_gc_timer_func); 34 35 static time64_t key_gc_next_run = TIME64_MAX; 36 static struct key_type *key_gc_dead_keytype; 37 38 static unsigned long key_gc_flags; 39 #define KEY_GC_KEY_EXPIRED 0 /* A key expired and needs unlinking */ 40 #define KEY_GC_REAP_KEYTYPE 1 /* A keytype is being unregistered */ 41 #define KEY_GC_REAPING_KEYTYPE 2 /* Cleared when keytype reaped */ 42 43 44 /* 45 * Any key whose type gets unregistered will be re-typed to this if it can't be 46 * immediately unlinked. 47 */ 48 struct key_type key_type_dead = { 49 .name = ".dead", 50 }; 51 52 /* 53 * Schedule a garbage collection run. 54 * - time precision isn't particularly important 55 */ 56 void key_schedule_gc(time64_t gc_at) 57 { 58 unsigned long expires; 59 time64_t now = ktime_get_real_seconds(); 60 61 kenter("%lld", gc_at - now); 62 63 if (gc_at <= now || test_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags)) { 64 kdebug("IMMEDIATE"); 65 schedule_work(&key_gc_work); 66 } else if (gc_at < key_gc_next_run) { 67 kdebug("DEFERRED"); 68 key_gc_next_run = gc_at; 69 expires = jiffies + (gc_at - now) * HZ; 70 mod_timer(&key_gc_timer, expires); 71 } 72 } 73 74 /* 75 * Schedule a dead links collection run. 76 */ 77 void key_schedule_gc_links(void) 78 { 79 set_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags); 80 schedule_work(&key_gc_work); 81 } 82 83 /* 84 * Some key's cleanup time was met after it expired, so we need to get the 85 * reaper to go through a cycle finding expired keys. 86 */ 87 static void key_gc_timer_func(struct timer_list *unused) 88 { 89 kenter(""); 90 key_gc_next_run = TIME64_MAX; 91 key_schedule_gc_links(); 92 } 93 94 /* 95 * Reap keys of dead type. 96 * 97 * We use three flags to make sure we see three complete cycles of the garbage 98 * collector: the first to mark keys of that type as being dead, the second to 99 * collect dead links and the third to clean up the dead keys. We have to be 100 * careful as there may already be a cycle in progress. 101 * 102 * The caller must be holding key_types_sem. 103 */ 104 void key_gc_keytype(struct key_type *ktype) 105 { 106 kenter("%s", ktype->name); 107 108 key_gc_dead_keytype = ktype; 109 set_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags); 110 smp_mb(); 111 set_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags); 112 113 kdebug("schedule"); 114 schedule_work(&key_gc_work); 115 116 kdebug("sleep"); 117 wait_on_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE, 118 TASK_UNINTERRUPTIBLE); 119 120 key_gc_dead_keytype = NULL; 121 kleave(""); 122 } 123 124 /* 125 * Garbage collect a list of unreferenced, detached keys 126 */ 127 static noinline void key_gc_unused_keys(struct list_head *keys) 128 { 129 while (!list_empty(keys)) { 130 struct key *key = 131 list_entry(keys->next, struct key, graveyard_link); 132 short state = key->state; 133 134 list_del(&key->graveyard_link); 135 136 kdebug("- %u", key->serial); 137 key_check(key); 138 139 /* Throw away the key data if the key is instantiated */ 140 if (state == KEY_IS_POSITIVE && key->type->destroy) 141 key->type->destroy(key); 142 143 security_key_free(key); 144 145 /* deal with the user's key tracking and quota */ 146 if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) { 147 spin_lock(&key->user->lock); 148 key->user->qnkeys--; 149 key->user->qnbytes -= key->quotalen; 150 spin_unlock(&key->user->lock); 151 } 152 153 atomic_dec(&key->user->nkeys); 154 if (state != KEY_IS_UNINSTANTIATED) 155 atomic_dec(&key->user->nikeys); 156 157 key_user_put(key->user); 158 159 kfree(key->description); 160 161 memzero_explicit(key, sizeof(*key)); 162 kmem_cache_free(key_jar, key); 163 } 164 } 165 166 /* 167 * Garbage collector for unused keys. 168 * 169 * This is done in process context so that we don't have to disable interrupts 170 * all over the place. key_put() schedules this rather than trying to do the 171 * cleanup itself, which means key_put() doesn't have to sleep. 172 */ 173 static void key_garbage_collector(struct work_struct *work) 174 { 175 static LIST_HEAD(graveyard); 176 static u8 gc_state; /* Internal persistent state */ 177 #define KEY_GC_REAP_AGAIN 0x01 /* - Need another cycle */ 178 #define KEY_GC_REAPING_LINKS 0x02 /* - We need to reap links */ 179 #define KEY_GC_SET_TIMER 0x04 /* - We need to restart the timer */ 180 #define KEY_GC_REAPING_DEAD_1 0x10 /* - We need to mark dead keys */ 181 #define KEY_GC_REAPING_DEAD_2 0x20 /* - We need to reap dead key links */ 182 #define KEY_GC_REAPING_DEAD_3 0x40 /* - We need to reap dead keys */ 183 #define KEY_GC_FOUND_DEAD_KEY 0x80 /* - We found at least one dead key */ 184 185 struct rb_node *cursor; 186 struct key *key; 187 time64_t new_timer, limit; 188 189 kenter("[%lx,%x]", key_gc_flags, gc_state); 190 191 limit = ktime_get_real_seconds(); 192 if (limit > key_gc_delay) 193 limit -= key_gc_delay; 194 else 195 limit = key_gc_delay; 196 197 /* Work out what we're going to be doing in this pass */ 198 gc_state &= KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2; 199 gc_state <<= 1; 200 if (test_and_clear_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags)) 201 gc_state |= KEY_GC_REAPING_LINKS | KEY_GC_SET_TIMER; 202 203 if (test_and_clear_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags)) 204 gc_state |= KEY_GC_REAPING_DEAD_1; 205 kdebug("new pass %x", gc_state); 206 207 new_timer = TIME64_MAX; 208 209 /* As only this function is permitted to remove things from the key 210 * serial tree, if cursor is non-NULL then it will always point to a 211 * valid node in the tree - even if lock got dropped. 212 */ 213 spin_lock(&key_serial_lock); 214 cursor = rb_first(&key_serial_tree); 215 216 continue_scanning: 217 while (cursor) { 218 key = rb_entry(cursor, struct key, serial_node); 219 cursor = rb_next(cursor); 220 221 if (refcount_read(&key->usage) == 0) 222 goto found_unreferenced_key; 223 224 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_1)) { 225 if (key->type == key_gc_dead_keytype) { 226 gc_state |= KEY_GC_FOUND_DEAD_KEY; 227 set_bit(KEY_FLAG_DEAD, &key->flags); 228 key->perm = 0; 229 goto skip_dead_key; 230 } else if (key->type == &key_type_keyring && 231 key->restrict_link) { 232 goto found_restricted_keyring; 233 } 234 } 235 236 if (gc_state & KEY_GC_SET_TIMER) { 237 if (key->expiry > limit && key->expiry < new_timer) { 238 kdebug("will expire %x in %lld", 239 key_serial(key), key->expiry - limit); 240 new_timer = key->expiry; 241 } 242 } 243 244 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2)) 245 if (key->type == key_gc_dead_keytype) 246 gc_state |= KEY_GC_FOUND_DEAD_KEY; 247 248 if ((gc_state & KEY_GC_REAPING_LINKS) || 249 unlikely(gc_state & KEY_GC_REAPING_DEAD_2)) { 250 if (key->type == &key_type_keyring) 251 goto found_keyring; 252 } 253 254 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3)) 255 if (key->type == key_gc_dead_keytype) 256 goto destroy_dead_key; 257 258 skip_dead_key: 259 if (spin_is_contended(&key_serial_lock) || need_resched()) 260 goto contended; 261 } 262 263 contended: 264 spin_unlock(&key_serial_lock); 265 266 maybe_resched: 267 if (cursor) { 268 cond_resched(); 269 spin_lock(&key_serial_lock); 270 goto continue_scanning; 271 } 272 273 /* We've completed the pass. Set the timer if we need to and queue a 274 * new cycle if necessary. We keep executing cycles until we find one 275 * where we didn't reap any keys. 276 */ 277 kdebug("pass complete"); 278 279 if (gc_state & KEY_GC_SET_TIMER && new_timer != (time64_t)TIME64_MAX) { 280 new_timer += key_gc_delay; 281 key_schedule_gc(new_timer); 282 } 283 284 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2) || 285 !list_empty(&graveyard)) { 286 /* Make sure that all pending keyring payload destructions are 287 * fulfilled and that people aren't now looking at dead or 288 * dying keys that they don't have a reference upon or a link 289 * to. 290 */ 291 kdebug("gc sync"); 292 synchronize_rcu(); 293 } 294 295 if (!list_empty(&graveyard)) { 296 kdebug("gc keys"); 297 key_gc_unused_keys(&graveyard); 298 } 299 300 if (unlikely(gc_state & (KEY_GC_REAPING_DEAD_1 | 301 KEY_GC_REAPING_DEAD_2))) { 302 if (!(gc_state & KEY_GC_FOUND_DEAD_KEY)) { 303 /* No remaining dead keys: short circuit the remaining 304 * keytype reap cycles. 305 */ 306 kdebug("dead short"); 307 gc_state &= ~(KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2); 308 gc_state |= KEY_GC_REAPING_DEAD_3; 309 } else { 310 gc_state |= KEY_GC_REAP_AGAIN; 311 } 312 } 313 314 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3)) { 315 kdebug("dead wake"); 316 smp_mb(); 317 clear_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags); 318 wake_up_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE); 319 } 320 321 if (gc_state & KEY_GC_REAP_AGAIN) 322 schedule_work(&key_gc_work); 323 kleave(" [end %x]", gc_state); 324 return; 325 326 /* We found an unreferenced key - once we've removed it from the tree, 327 * we can safely drop the lock. 328 */ 329 found_unreferenced_key: 330 kdebug("unrefd key %d", key->serial); 331 rb_erase(&key->serial_node, &key_serial_tree); 332 spin_unlock(&key_serial_lock); 333 334 list_add_tail(&key->graveyard_link, &graveyard); 335 gc_state |= KEY_GC_REAP_AGAIN; 336 goto maybe_resched; 337 338 /* We found a restricted keyring and need to update the restriction if 339 * it is associated with the dead key type. 340 */ 341 found_restricted_keyring: 342 spin_unlock(&key_serial_lock); 343 keyring_restriction_gc(key, key_gc_dead_keytype); 344 goto maybe_resched; 345 346 /* We found a keyring and we need to check the payload for links to 347 * dead or expired keys. We don't flag another reap immediately as we 348 * have to wait for the old payload to be destroyed by RCU before we 349 * can reap the keys to which it refers. 350 */ 351 found_keyring: 352 spin_unlock(&key_serial_lock); 353 keyring_gc(key, limit); 354 goto maybe_resched; 355 356 /* We found a dead key that is still referenced. Reset its type and 357 * destroy its payload with its semaphore held. 358 */ 359 destroy_dead_key: 360 spin_unlock(&key_serial_lock); 361 kdebug("destroy key %d", key->serial); 362 down_write(&key->sem); 363 key->type = &key_type_dead; 364 if (key_gc_dead_keytype->destroy) 365 key_gc_dead_keytype->destroy(key); 366 memset(&key->payload, KEY_DESTROY, sizeof(key->payload)); 367 up_write(&key->sem); 368 goto maybe_resched; 369 } 370