1 /* Key garbage collector 2 * 3 * Copyright (C) 2009-2011 Red Hat, Inc. All Rights Reserved. 4 * Written by David Howells (dhowells@redhat.com) 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public Licence 8 * as published by the Free Software Foundation; either version 9 * 2 of the Licence, or (at your option) any later version. 10 */ 11 12 #include <linux/module.h> 13 #include <linux/slab.h> 14 #include <linux/security.h> 15 #include <keys/keyring-type.h> 16 #include "internal.h" 17 18 /* 19 * Delay between key revocation/expiry in seconds 20 */ 21 unsigned key_gc_delay = 5 * 60; 22 23 /* 24 * Reaper for unused keys. 25 */ 26 static void key_garbage_collector(struct work_struct *work); 27 DECLARE_WORK(key_gc_work, key_garbage_collector); 28 29 /* 30 * Reaper for links from keyrings to dead keys. 31 */ 32 static void key_gc_timer_func(unsigned long); 33 static DEFINE_TIMER(key_gc_timer, key_gc_timer_func, 0, 0); 34 35 static time_t key_gc_next_run = LONG_MAX; 36 static struct key_type *key_gc_dead_keytype; 37 38 static unsigned long key_gc_flags; 39 #define KEY_GC_KEY_EXPIRED 0 /* A key expired and needs unlinking */ 40 #define KEY_GC_REAP_KEYTYPE 1 /* A keytype is being unregistered */ 41 #define KEY_GC_REAPING_KEYTYPE 2 /* Cleared when keytype reaped */ 42 43 44 /* 45 * Any key whose type gets unregistered will be re-typed to this if it can't be 46 * immediately unlinked. 47 */ 48 struct key_type key_type_dead = { 49 .name = "dead", 50 }; 51 52 /* 53 * Schedule a garbage collection run. 54 * - time precision isn't particularly important 55 */ 56 void key_schedule_gc(time_t gc_at) 57 { 58 unsigned long expires; 59 time_t now = current_kernel_time().tv_sec; 60 61 kenter("%ld", gc_at - now); 62 63 if (gc_at <= now || test_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags)) { 64 kdebug("IMMEDIATE"); 65 queue_work(system_nrt_wq, &key_gc_work); 66 } else if (gc_at < key_gc_next_run) { 67 kdebug("DEFERRED"); 68 key_gc_next_run = gc_at; 69 expires = jiffies + (gc_at - now) * HZ; 70 mod_timer(&key_gc_timer, expires); 71 } 72 } 73 74 /* 75 * Some key's cleanup time was met after it expired, so we need to get the 76 * reaper to go through a cycle finding expired keys. 77 */ 78 static void key_gc_timer_func(unsigned long data) 79 { 80 kenter(""); 81 key_gc_next_run = LONG_MAX; 82 set_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags); 83 queue_work(system_nrt_wq, &key_gc_work); 84 } 85 86 /* 87 * wait_on_bit() sleep function for uninterruptible waiting 88 */ 89 static int key_gc_wait_bit(void *flags) 90 { 91 schedule(); 92 return 0; 93 } 94 95 /* 96 * Reap keys of dead type. 97 * 98 * We use three flags to make sure we see three complete cycles of the garbage 99 * collector: the first to mark keys of that type as being dead, the second to 100 * collect dead links and the third to clean up the dead keys. We have to be 101 * careful as there may already be a cycle in progress. 102 * 103 * The caller must be holding key_types_sem. 104 */ 105 void key_gc_keytype(struct key_type *ktype) 106 { 107 kenter("%s", ktype->name); 108 109 key_gc_dead_keytype = ktype; 110 set_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags); 111 smp_mb(); 112 set_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags); 113 114 kdebug("schedule"); 115 queue_work(system_nrt_wq, &key_gc_work); 116 117 kdebug("sleep"); 118 wait_on_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE, key_gc_wait_bit, 119 TASK_UNINTERRUPTIBLE); 120 121 key_gc_dead_keytype = NULL; 122 kleave(""); 123 } 124 125 /* 126 * Garbage collect pointers from a keyring. 127 * 128 * Not called with any locks held. The keyring's key struct will not be 129 * deallocated under us as only our caller may deallocate it. 130 */ 131 static void key_gc_keyring(struct key *keyring, time_t limit) 132 { 133 struct keyring_list *klist; 134 struct key *key; 135 int loop; 136 137 kenter("%x", key_serial(keyring)); 138 139 if (test_bit(KEY_FLAG_REVOKED, &keyring->flags)) 140 goto dont_gc; 141 142 /* scan the keyring looking for dead keys */ 143 rcu_read_lock(); 144 klist = rcu_dereference(keyring->payload.subscriptions); 145 if (!klist) 146 goto unlock_dont_gc; 147 148 for (loop = klist->nkeys - 1; loop >= 0; loop--) { 149 key = klist->keys[loop]; 150 if (test_bit(KEY_FLAG_DEAD, &key->flags) || 151 (key->expiry > 0 && key->expiry <= limit)) 152 goto do_gc; 153 } 154 155 unlock_dont_gc: 156 rcu_read_unlock(); 157 dont_gc: 158 kleave(" [no gc]"); 159 return; 160 161 do_gc: 162 rcu_read_unlock(); 163 164 keyring_gc(keyring, limit); 165 kleave(" [gc]"); 166 } 167 168 /* 169 * Garbage collect an unreferenced, detached key 170 */ 171 static noinline void key_gc_unused_key(struct key *key) 172 { 173 key_check(key); 174 175 security_key_free(key); 176 177 /* deal with the user's key tracking and quota */ 178 if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) { 179 spin_lock(&key->user->lock); 180 key->user->qnkeys--; 181 key->user->qnbytes -= key->quotalen; 182 spin_unlock(&key->user->lock); 183 } 184 185 atomic_dec(&key->user->nkeys); 186 if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) 187 atomic_dec(&key->user->nikeys); 188 189 key_user_put(key->user); 190 191 /* now throw away the key memory */ 192 if (key->type->destroy) 193 key->type->destroy(key); 194 195 kfree(key->description); 196 197 #ifdef KEY_DEBUGGING 198 key->magic = KEY_DEBUG_MAGIC_X; 199 #endif 200 kmem_cache_free(key_jar, key); 201 } 202 203 /* 204 * Garbage collector for unused keys. 205 * 206 * This is done in process context so that we don't have to disable interrupts 207 * all over the place. key_put() schedules this rather than trying to do the 208 * cleanup itself, which means key_put() doesn't have to sleep. 209 */ 210 static void key_garbage_collector(struct work_struct *work) 211 { 212 static u8 gc_state; /* Internal persistent state */ 213 #define KEY_GC_REAP_AGAIN 0x01 /* - Need another cycle */ 214 #define KEY_GC_REAPING_LINKS 0x02 /* - We need to reap links */ 215 #define KEY_GC_SET_TIMER 0x04 /* - We need to restart the timer */ 216 #define KEY_GC_REAPING_DEAD_1 0x10 /* - We need to mark dead keys */ 217 #define KEY_GC_REAPING_DEAD_2 0x20 /* - We need to reap dead key links */ 218 #define KEY_GC_REAPING_DEAD_3 0x40 /* - We need to reap dead keys */ 219 #define KEY_GC_FOUND_DEAD_KEY 0x80 /* - We found at least one dead key */ 220 221 struct rb_node *cursor; 222 struct key *key; 223 time_t new_timer, limit; 224 225 kenter("[%lx,%x]", key_gc_flags, gc_state); 226 227 limit = current_kernel_time().tv_sec; 228 if (limit > key_gc_delay) 229 limit -= key_gc_delay; 230 else 231 limit = key_gc_delay; 232 233 /* Work out what we're going to be doing in this pass */ 234 gc_state &= KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2; 235 gc_state <<= 1; 236 if (test_and_clear_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags)) 237 gc_state |= KEY_GC_REAPING_LINKS | KEY_GC_SET_TIMER; 238 239 if (test_and_clear_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags)) 240 gc_state |= KEY_GC_REAPING_DEAD_1; 241 kdebug("new pass %x", gc_state); 242 243 new_timer = LONG_MAX; 244 245 /* As only this function is permitted to remove things from the key 246 * serial tree, if cursor is non-NULL then it will always point to a 247 * valid node in the tree - even if lock got dropped. 248 */ 249 spin_lock(&key_serial_lock); 250 cursor = rb_first(&key_serial_tree); 251 252 continue_scanning: 253 while (cursor) { 254 key = rb_entry(cursor, struct key, serial_node); 255 cursor = rb_next(cursor); 256 257 if (atomic_read(&key->usage) == 0) 258 goto found_unreferenced_key; 259 260 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_1)) { 261 if (key->type == key_gc_dead_keytype) { 262 gc_state |= KEY_GC_FOUND_DEAD_KEY; 263 set_bit(KEY_FLAG_DEAD, &key->flags); 264 key->perm = 0; 265 goto skip_dead_key; 266 } 267 } 268 269 if (gc_state & KEY_GC_SET_TIMER) { 270 if (key->expiry > limit && key->expiry < new_timer) { 271 kdebug("will expire %x in %ld", 272 key_serial(key), key->expiry - limit); 273 new_timer = key->expiry; 274 } 275 } 276 277 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2)) 278 if (key->type == key_gc_dead_keytype) 279 gc_state |= KEY_GC_FOUND_DEAD_KEY; 280 281 if ((gc_state & KEY_GC_REAPING_LINKS) || 282 unlikely(gc_state & KEY_GC_REAPING_DEAD_2)) { 283 if (key->type == &key_type_keyring) 284 goto found_keyring; 285 } 286 287 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3)) 288 if (key->type == key_gc_dead_keytype) 289 goto destroy_dead_key; 290 291 skip_dead_key: 292 if (spin_is_contended(&key_serial_lock) || need_resched()) 293 goto contended; 294 } 295 296 contended: 297 spin_unlock(&key_serial_lock); 298 299 maybe_resched: 300 if (cursor) { 301 cond_resched(); 302 spin_lock(&key_serial_lock); 303 goto continue_scanning; 304 } 305 306 /* We've completed the pass. Set the timer if we need to and queue a 307 * new cycle if necessary. We keep executing cycles until we find one 308 * where we didn't reap any keys. 309 */ 310 kdebug("pass complete"); 311 312 if (gc_state & KEY_GC_SET_TIMER && new_timer != (time_t)LONG_MAX) { 313 new_timer += key_gc_delay; 314 key_schedule_gc(new_timer); 315 } 316 317 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2)) { 318 /* Make sure everyone revalidates their keys if we marked a 319 * bunch as being dead and make sure all keyring ex-payloads 320 * are destroyed. 321 */ 322 kdebug("dead sync"); 323 synchronize_rcu(); 324 } 325 326 if (unlikely(gc_state & (KEY_GC_REAPING_DEAD_1 | 327 KEY_GC_REAPING_DEAD_2))) { 328 if (!(gc_state & KEY_GC_FOUND_DEAD_KEY)) { 329 /* No remaining dead keys: short circuit the remaining 330 * keytype reap cycles. 331 */ 332 kdebug("dead short"); 333 gc_state &= ~(KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2); 334 gc_state |= KEY_GC_REAPING_DEAD_3; 335 } else { 336 gc_state |= KEY_GC_REAP_AGAIN; 337 } 338 } 339 340 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3)) { 341 kdebug("dead wake"); 342 smp_mb(); 343 clear_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags); 344 wake_up_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE); 345 } 346 347 if (gc_state & KEY_GC_REAP_AGAIN) 348 queue_work(system_nrt_wq, &key_gc_work); 349 kleave(" [end %x]", gc_state); 350 return; 351 352 /* We found an unreferenced key - once we've removed it from the tree, 353 * we can safely drop the lock. 354 */ 355 found_unreferenced_key: 356 kdebug("unrefd key %d", key->serial); 357 rb_erase(&key->serial_node, &key_serial_tree); 358 spin_unlock(&key_serial_lock); 359 360 key_gc_unused_key(key); 361 gc_state |= KEY_GC_REAP_AGAIN; 362 goto maybe_resched; 363 364 /* We found a keyring and we need to check the payload for links to 365 * dead or expired keys. We don't flag another reap immediately as we 366 * have to wait for the old payload to be destroyed by RCU before we 367 * can reap the keys to which it refers. 368 */ 369 found_keyring: 370 spin_unlock(&key_serial_lock); 371 kdebug("scan keyring %d", key->serial); 372 key_gc_keyring(key, limit); 373 goto maybe_resched; 374 375 /* We found a dead key that is still referenced. Reset its type and 376 * destroy its payload with its semaphore held. 377 */ 378 destroy_dead_key: 379 spin_unlock(&key_serial_lock); 380 kdebug("destroy key %d", key->serial); 381 down_write(&key->sem); 382 key->type = &key_type_dead; 383 if (key_gc_dead_keytype->destroy) 384 key_gc_dead_keytype->destroy(key); 385 memset(&key->payload, KEY_DESTROY, sizeof(key->payload)); 386 up_write(&key->sem); 387 goto maybe_resched; 388 } 389