security/keys/gc.c

   1 /* Key garbage collector
   2  *
   3  * Copyright (C) 2009-2011 Red Hat, Inc. All Rights Reserved.
   4  * Written by David Howells ([email protected])
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public Licence
   8  * as published by the Free Software Foundation; either version
   9  * 2 of the Licence, or (at your option) any later version.
  10  */
  11
  12 #include <linux/slab.h>
  13 #include <linux/security.h>
  14 #include <keys/keyring-type.h>
  15 #include "internal.h"
  16
  17 /*
  18  * Delay between key revocation/expiry in seconds
  19  */
  20 unsigned key_gc_delay = 5 * 60;
  21
  22 /*
  23  * Reaper for unused keys.
  24  */
  25 static void key_garbage_collector(struct work_struct *work);
  26 DECLARE_WORK(key_gc_work, key_garbage_collector);
  27
  28 /*
  29  * Reaper for links from keyrings to dead keys.
  30  */
  31 static void key_gc_timer_func(struct timer_list *);
  32 static DEFINE_TIMER(key_gc_timer, key_gc_timer_func);
  33
  34 static time64_t key_gc_next_run = TIME64_MAX;
  35 static struct key_type *key_gc_dead_keytype;
  36
  37 static unsigned long key_gc_flags;
  38 #define KEY_GC_KEY_EXPIRED      0       /* A key expired and needs unlinking */
  39 #define KEY_GC_REAP_KEYTYPE     1       /* A keytype is being unregistered */
  40 #define KEY_GC_REAPING_KEYTYPE  2       /* Cleared when keytype reaped */
  41
  42
  43 /*
  44  * Any key whose type gets unregistered will be re-typed to this if it can't be
  45  * immediately unlinked.
  46  */
  47 struct key_type key_type_dead = {
  48         .name = ".dead",
  49 };
  50
  51 /*
  52  * Schedule a garbage collection run.
  53  * - time precision isn't particularly important
  54  */
  55 void key_schedule_gc(time64_t gc_at)
  56 {
  57         unsigned long expires;
  58         time64_t now = ktime_get_real_seconds();
  59
  60         kenter("%lld", gc_at - now);
  61
  62         if (gc_at <= now || test_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags)) {
  63                 kdebug("IMMEDIATE");
  64                 schedule_work(&key_gc_work);
  65         } else if (gc_at < key_gc_next_run) {
  66                 kdebug("DEFERRED");
  67                 key_gc_next_run = gc_at;
  68                 expires = jiffies + (gc_at - now) * HZ;
  69                 mod_timer(&key_gc_timer, expires);
  70         }
  71 }
  72
  73 /*
  74  * Schedule a dead links collection run.
  75  */
  76 void key_schedule_gc_links(void)
  77 {
  78         set_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags);
  79         schedule_work(&key_gc_work);
  80 }
  81
  82 /*
  83  * Some key's cleanup time was met after it expired, so we need to get the
  84  * reaper to go through a cycle finding expired keys.
  85  */
  86 static void key_gc_timer_func(struct timer_list *unused)
  87 {
  88         kenter("");
  89         key_gc_next_run = TIME64_MAX;
  90         key_schedule_gc_links();
  91 }
  92
  93 /*
  94  * Reap keys of dead type.
  95  *
  96  * We use three flags to make sure we see three complete cycles of the garbage
  97  * collector: the first to mark keys of that type as being dead, the second to
  98  * collect dead links and the third to clean up the dead keys.  We have to be
  99  * careful as there may already be a cycle in progress.
 100  *
 101  * The caller must be holding key_types_sem.
 102  */
 103 void key_gc_keytype(struct key_type *ktype)
 104 {
 105         kenter("%s", ktype->name);
 106
 107         key_gc_dead_keytype = ktype;
 108         set_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
 109         smp_mb();
 110         set_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags);
 111
 112         kdebug("schedule");
 113         schedule_work(&key_gc_work);
 114
 115         kdebug("sleep");
 116         wait_on_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE,
 117                     TASK_UNINTERRUPTIBLE);
 118
 119         key_gc_dead_keytype = NULL;
 120         kleave("");
 121 }
 122
 123 /*
 124  * Garbage collect a list of unreferenced, detached keys
 125  */
 126 static noinline void key_gc_unused_keys(struct list_head *keys)
 127 {
 128         while (!list_empty(keys)) {
 129                 struct key *key =
 130                         list_entry(keys->next, struct key, graveyard_link);
 131                 short state = key->state;
 132
 133                 list_del(&key->graveyard_link);
 134
 135                 kdebug("- %u", key->serial);
 136                 key_check(key);
 137
 138                 /* Throw away the key data if the key is instantiated */
 139                 if (state == KEY_IS_POSITIVE && key->type->destroy)
 140                         key->type->destroy(key);
 141
 142                 security_key_free(key);
 143
 144                 /* deal with the user's key tracking and quota */
 145                 if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) {
 146                         spin_lock(&key->user->lock);
 147                         key->user->qnkeys--;
 148                         key->user->qnbytes -= key->quotalen;
 149                         spin_unlock(&key->user->lock);
 150                 }
 151
 152                 atomic_dec(&key->user->nkeys);
 153                 if (state != KEY_IS_UNINSTANTIATED)
 154                         atomic_dec(&key->user->nikeys);
 155
 156                 key_user_put(key->user);
 157
 158                 kfree(key->description);
 159
 160                 memzero_explicit(key, sizeof(*key));
 161                 kmem_cache_free(key_jar, key);
 162         }
 163 }
 164
 165 /*
 166  * Garbage collector for unused keys.
 167  *
 168  * This is done in process context so that we don't have to disable interrupts
 169  * all over the place.  key_put() schedules this rather than trying to do the
 170  * cleanup itself, which means key_put() doesn't have to sleep.
 171  */
 172 static void key_garbage_collector(struct work_struct *work)
 173 {
 174         static LIST_HEAD(graveyard);
 175         static u8 gc_state;             /* Internal persistent state */
 176 #define KEY_GC_REAP_AGAIN       0x01    /* - Need another cycle */
 177 #define KEY_GC_REAPING_LINKS    0x02    /* - We need to reap links */
 178 #define KEY_GC_SET_TIMER        0x04    /* - We need to restart the timer */
 179 #define KEY_GC_REAPING_DEAD_1   0x10    /* - We need to mark dead keys */
 180 #define KEY_GC_REAPING_DEAD_2   0x20    /* - We need to reap dead key links */
 181 #define KEY_GC_REAPING_DEAD_3   0x40    /* - We need to reap dead keys */
 182 #define KEY_GC_FOUND_DEAD_KEY   0x80    /* - We found at least one dead key */
 183
 184         struct rb_node *cursor;
 185         struct key *key;
 186         time64_t new_timer, limit;
 187
 188         kenter("[%lx,%x]", key_gc_flags, gc_state);
 189
 190         limit = ktime_get_real_seconds();
 191         if (limit > key_gc_delay)
 192                 limit -= key_gc_delay;
 193         else
 194                 limit = key_gc_delay;
 195
 196         /* Work out what we're going to be doing in this pass */
 197         gc_state &= KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2;
 198         gc_state <<= 1;
 199         if (test_and_clear_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags))
 200                 gc_state |= KEY_GC_REAPING_LINKS | KEY_GC_SET_TIMER;
 201
 202         if (test_and_clear_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags))
 203                 gc_state |= KEY_GC_REAPING_DEAD_1;
 204         kdebug("new pass %x", gc_state);
 205
 206         new_timer = TIME64_MAX;
 207
 208         /* As only this function is permitted to remove things from the key
 209          * serial tree, if cursor is non-NULL then it will always point to a
 210          * valid node in the tree - even if lock got dropped.
 211          */
 212         spin_lock(&key_serial_lock);
 213         cursor = rb_first(&key_serial_tree);
 214
 215 continue_scanning:
 216         while (cursor) {
 217                 key = rb_entry(cursor, struct key, serial_node);
 218                 cursor = rb_next(cursor);
 219
 220                 if (refcount_read(&key->usage) == 0)
 221                         goto found_unreferenced_key;
 222
 223                 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_1)) {
 224                         if (key->type == key_gc_dead_keytype) {
 225                                 gc_state |= KEY_GC_FOUND_DEAD_KEY;
 226                                 set_bit(KEY_FLAG_DEAD, &key->flags);
 227                                 key->perm = 0;
 228                                 goto skip_dead_key;
 229                         } else if (key->type == &key_type_keyring &&
 230                                    key->restrict_link) {
 231                                 goto found_restricted_keyring;
 232                         }
 233                 }
 234
 235                 if (gc_state & KEY_GC_SET_TIMER) {
 236                         if (key->expiry > limit && key->expiry < new_timer) {
 237                                 kdebug("will expire %x in %lld",
 238                                        key_serial(key), key->expiry - limit);
 239                                 new_timer = key->expiry;
 240                         }
 241                 }
 242
 243                 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2))
 244                         if (key->type == key_gc_dead_keytype)
 245                                 gc_state |= KEY_GC_FOUND_DEAD_KEY;
 246
 247                 if ((gc_state & KEY_GC_REAPING_LINKS) ||
 248                     unlikely(gc_state & KEY_GC_REAPING_DEAD_2)) {
 249                         if (key->type == &key_type_keyring)
 250                                 goto found_keyring;
 251                 }
 252
 253                 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3))
 254                         if (key->type == key_gc_dead_keytype)
 255                                 goto destroy_dead_key;
 256
 257         skip_dead_key:
 258                 if (spin_is_contended(&key_serial_lock) || need_resched())
 259                         goto contended;
 260         }
 261
 262 contended:
 263         spin_unlock(&key_serial_lock);
 264
 265 maybe_resched:
 266         if (cursor) {
 267                 cond_resched();
 268                 spin_lock(&key_serial_lock);
 269                 goto continue_scanning;
 270         }
 271
 272         /* We've completed the pass.  Set the timer if we need to and queue a
 273          * new cycle if necessary.  We keep executing cycles until we find one
 274          * where we didn't reap any keys.
 275          */
 276         kdebug("pass complete");
 277
 278         if (gc_state & KEY_GC_SET_TIMER && new_timer != (time64_t)TIME64_MAX) {
 279                 new_timer += key_gc_delay;
 280                 key_schedule_gc(new_timer);
 281         }
 282
 283         if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2) ||
 284             !list_empty(&graveyard)) {
 285                 /* Make sure that all pending keyring payload destructions are
 286                  * fulfilled and that people aren't now looking at dead or
 287                  * dying keys that they don't have a reference upon or a link
 288                  * to.
 289                  */
 290                 kdebug("gc sync");
 291                 synchronize_rcu();
 292         }
 293
 294         if (!list_empty(&graveyard)) {
 295                 kdebug("gc keys");
 296                 key_gc_unused_keys(&graveyard);
 297         }
 298
 299         if (unlikely(gc_state & (KEY_GC_REAPING_DEAD_1 |
 300                                  KEY_GC_REAPING_DEAD_2))) {
 301                 if (!(gc_state & KEY_GC_FOUND_DEAD_KEY)) {
 302                         /* No remaining dead keys: short circuit the remaining
 303                          * keytype reap cycles.
 304                          */
 305                         kdebug("dead short");
 306                         gc_state &= ~(KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2);
 307                         gc_state |= KEY_GC_REAPING_DEAD_3;
 308                 } else {
 309                         gc_state |= KEY_GC_REAP_AGAIN;
 310                 }
 311         }
 312
 313         if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3)) {
 314                 kdebug("dead wake");
 315                 smp_mb();
 316                 clear_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
 317                 wake_up_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE);
 318         }
 319
 320         if (gc_state & KEY_GC_REAP_AGAIN)
 321                 schedule_work(&key_gc_work);
 322         kleave(" [end %x]", gc_state);
 323         return;
 324
 325         /* We found an unreferenced key - once we've removed it from the tree,
 326          * we can safely drop the lock.
 327          */
 328 found_unreferenced_key:
 329         kdebug("unrefd key %d", key->serial);
 330         rb_erase(&key->serial_node, &key_serial_tree);
 331         spin_unlock(&key_serial_lock);
 332
 333         list_add_tail(&key->graveyard_link, &graveyard);
 334         gc_state |= KEY_GC_REAP_AGAIN;
 335         goto maybe_resched;
 336
 337         /* We found a restricted keyring and need to update the restriction if
 338          * it is associated with the dead key type.
 339          */
 340 found_restricted_keyring:
 341         spin_unlock(&key_serial_lock);
 342         keyring_restriction_gc(key, key_gc_dead_keytype);
 343         goto maybe_resched;
 344
 345         /* We found a keyring and we need to check the payload for links to
 346          * dead or expired keys.  We don't flag another reap immediately as we
 347          * have to wait for the old payload to be destroyed by RCU before we
 348          * can reap the keys to which it refers.
 349          */
 350 found_keyring:
 351         spin_unlock(&key_serial_lock);
 352         keyring_gc(key, limit);
 353         goto maybe_resched;
 354
 355         /* We found a dead key that is still referenced.  Reset its type and
 356          * destroy its payload with its semaphore held.
 357          */
 358 destroy_dead_key:
 359         spin_unlock(&key_serial_lock);
 360         kdebug("destroy key %d", key->serial);
 361         down_write(&key->sem);
 362         key->type = &key_type_dead;
 363         if (key_gc_dead_keytype->destroy)
 364                 key_gc_dead_keytype->destroy(key);
 365         memset(&key->payload, KEY_DESTROY, sizeof(key->payload));
 366         up_write(&key->sem);
 367         goto maybe_resched;
 368 }