security/keys/gc.c

   1 /* Key garbage collector
   2  *
   3  * Copyright (C) 2009-2011 Red Hat, Inc. All Rights Reserved.
   4  * Written by David Howells (dhowells@redhat.com)
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public Licence
   8  * as published by the Free Software Foundation; either version
   9  * 2 of the Licence, or (at your option) any later version.
  10  */
  11
  12 #include <linux/module.h>
  13 #include <linux/slab.h>
  14 #include <linux/security.h>
  15 #include <keys/keyring-type.h>
  16 #include "internal.h"
  17
  18 /*
  19  * Delay between key revocation/expiry in seconds
  20  */
  21 unsigned key_gc_delay = 5 * 60;
  22
  23 /*
  24  * Reaper for unused keys.
  25  */
  26 static void key_garbage_collector(struct work_struct *work);
  27 DECLARE_WORK(key_gc_work, key_garbage_collector);
  28
  29 /*
  30  * Reaper for links from keyrings to dead keys.
  31  */
  32 static void key_gc_timer_func(unsigned long);
  33 static DEFINE_TIMER(key_gc_timer, key_gc_timer_func, 0, 0);
  34
  35 static time_t key_gc_next_run = LONG_MAX;
  36 static struct key_type *key_gc_dead_keytype;
  37
  38 static unsigned long key_gc_flags;
  39 #define KEY_GC_KEY_EXPIRED      0       /* A key expired and needs unlinking */
  40 #define KEY_GC_REAP_KEYTYPE     1       /* A keytype is being unregistered */
  41 #define KEY_GC_REAPING_KEYTYPE  2       /* Cleared when keytype reaped */
  42
  43
  44 /*
  45  * Any key whose type gets unregistered will be re-typed to this if it can't be
  46  * immediately unlinked.
  47  */
  48 struct key_type key_type_dead = {
  49         .name = "dead",
  50 };
  51
  52 /*
  53  * Schedule a garbage collection run.
  54  * - time precision isn't particularly important
  55  */
  56 void key_schedule_gc(time_t gc_at)
  57 {
  58         unsigned long expires;
  59         time_t now = current_kernel_time().tv_sec;
  60
  61         kenter("%ld", gc_at - now);
  62
  63         if (gc_at <= now || test_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags)) {
  64                 kdebug("IMMEDIATE");
  65                 schedule_work(&key_gc_work);
  66         } else if (gc_at < key_gc_next_run) {
  67                 kdebug("DEFERRED");
  68                 key_gc_next_run = gc_at;
  69                 expires = jiffies + (gc_at - now) * HZ;
  70                 mod_timer(&key_gc_timer, expires);
  71         }
  72 }
  73
  74 /*
  75  * Schedule a dead links collection run.
  76  */
  77 void key_schedule_gc_links(void)
  78 {
  79         set_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags);
  80         schedule_work(&key_gc_work);
  81 }
  82
  83 /*
  84  * Some key's cleanup time was met after it expired, so we need to get the
  85  * reaper to go through a cycle finding expired keys.
  86  */
  87 static void key_gc_timer_func(unsigned long data)
  88 {
  89         kenter("");
  90         key_gc_next_run = LONG_MAX;
  91         key_schedule_gc_links();
  92 }
  93
  94 /*
  95  * wait_on_bit() sleep function for uninterruptible waiting
  96  */
  97 static int key_gc_wait_bit(void *flags)
  98 {
  99         schedule();
 100         return 0;
 101 }
 102
 103 /*
 104  * Reap keys of dead type.
 105  *
 106  * We use three flags to make sure we see three complete cycles of the garbage
 107  * collector: the first to mark keys of that type as being dead, the second to
 108  * collect dead links and the third to clean up the dead keys.  We have to be
 109  * careful as there may already be a cycle in progress.
 110  *
 111  * The caller must be holding key_types_sem.
 112  */
 113 void key_gc_keytype(struct key_type *ktype)
 114 {
 115         kenter("%s", ktype->name);
 116
 117         key_gc_dead_keytype = ktype;
 118         set_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
 119         smp_mb();
 120         set_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags);
 121
 122         kdebug("schedule");
 123         schedule_work(&key_gc_work);
 124
 125         kdebug("sleep");
 126         wait_on_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE, key_gc_wait_bit,
 127                     TASK_UNINTERRUPTIBLE);
 128
 129         key_gc_dead_keytype = NULL;
 130         kleave("");
 131 }
 132
 133 static int key_gc_keyring_func(const void *object, void *iterator_data)
 134 {
 135         const struct key *key = object;
 136         time_t *limit = iterator_data;
 137         return key_is_dead(key, *limit);
 138 }
 139
 140 /*
 141  * Garbage collect pointers from a keyring.
 142  *
 143  * Not called with any locks held.  The keyring's key struct will not be
 144  * deallocated under us as only our caller may deallocate it.
 145  */
 146 static void key_gc_keyring(struct key *keyring, time_t limit)
 147 {
 148         int result;
 149
 150         kenter("%x{%s}", keyring->serial, keyring->description ?: "");
 151
 152         if (keyring->flags & ((1 << KEY_FLAG_INVALIDATED) |
 153                               (1 << KEY_FLAG_REVOKED)))
 154                 goto dont_gc;
 155
 156         /* scan the keyring looking for dead keys */
 157         rcu_read_lock();
 158         result = assoc_array_iterate(&keyring->keys,
 159                                      key_gc_keyring_func, &limit);
 160         rcu_read_unlock();
 161         if (result == true)
 162                 goto do_gc;
 163
 164 dont_gc:
 165         kleave(" [no gc]");
 166         return;
 167
 168 do_gc:
 169         keyring_gc(keyring, limit);
 170         kleave(" [gc]");
 171 }
 172
 173 /*
 174  * Garbage collect a list of unreferenced, detached keys
 175  */
 176 static noinline void key_gc_unused_keys(struct list_head *keys)
 177 {
 178         while (!list_empty(keys)) {
 179                 struct key *key =
 180                         list_entry(keys->next, struct key, graveyard_link);
 181                 list_del(&key->graveyard_link);
 182
 183                 kdebug("- %u", key->serial);
 184                 key_check(key);
 185
 186                 security_key_free(key);
 187
 188                 /* deal with the user's key tracking and quota */
 189                 if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) {
 190                         spin_lock(&key->user->lock);
 191                         key->user->qnkeys--;
 192                         key->user->qnbytes -= key->quotalen;
 193                         spin_unlock(&key->user->lock);
 194                 }
 195
 196                 atomic_dec(&key->user->nkeys);
 197                 if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
 198                         atomic_dec(&key->user->nikeys);
 199
 200                 key_user_put(key->user);
 201
 202                 /* now throw away the key memory */
 203                 if (key->type->destroy)
 204                         key->type->destroy(key);
 205
 206                 kfree(key->description);
 207
 208 #ifdef KEY_DEBUGGING
 209                 key->magic = KEY_DEBUG_MAGIC_X;
 210 #endif
 211                 kmem_cache_free(key_jar, key);
 212         }
 213 }
 214
 215 /*
 216  * Garbage collector for unused keys.
 217  *
 218  * This is done in process context so that we don't have to disable interrupts
 219  * all over the place.  key_put() schedules this rather than trying to do the
 220  * cleanup itself, which means key_put() doesn't have to sleep.
 221  */
 222 static void key_garbage_collector(struct work_struct *work)
 223 {
 224         static LIST_HEAD(graveyard);
 225         static u8 gc_state;             /* Internal persistent state */
 226 #define KEY_GC_REAP_AGAIN       0x01    /* - Need another cycle */
 227 #define KEY_GC_REAPING_LINKS    0x02    /* - We need to reap links */
 228 #define KEY_GC_SET_TIMER        0x04    /* - We need to restart the timer */
 229 #define KEY_GC_REAPING_DEAD_1   0x10    /* - We need to mark dead keys */
 230 #define KEY_GC_REAPING_DEAD_2   0x20    /* - We need to reap dead key links */
 231 #define KEY_GC_REAPING_DEAD_3   0x40    /* - We need to reap dead keys */
 232 #define KEY_GC_FOUND_DEAD_KEY   0x80    /* - We found at least one dead key */
 233
 234         struct rb_node *cursor;
 235         struct key *key;
 236         time_t new_timer, limit;
 237
 238         kenter("[%lx,%x]", key_gc_flags, gc_state);
 239
 240         limit = current_kernel_time().tv_sec;
 241         if (limit > key_gc_delay)
 242                 limit -= key_gc_delay;
 243         else
 244                 limit = key_gc_delay;
 245
 246         /* Work out what we're going to be doing in this pass */
 247         gc_state &= KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2;
 248         gc_state <<= 1;
 249         if (test_and_clear_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags))
 250                 gc_state |= KEY_GC_REAPING_LINKS | KEY_GC_SET_TIMER;
 251
 252         if (test_and_clear_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags))
 253                 gc_state |= KEY_GC_REAPING_DEAD_1;
 254         kdebug("new pass %x", gc_state);
 255
 256         new_timer = LONG_MAX;
 257
 258         /* As only this function is permitted to remove things from the key
 259          * serial tree, if cursor is non-NULL then it will always point to a
 260          * valid node in the tree - even if lock got dropped.
 261          */
 262         spin_lock(&key_serial_lock);
 263         cursor = rb_first(&key_serial_tree);
 264
 265 continue_scanning:
 266         while (cursor) {
 267                 key = rb_entry(cursor, struct key, serial_node);
 268                 cursor = rb_next(cursor);
 269
 270                 if (atomic_read(&key->usage) == 0)
 271                         goto found_unreferenced_key;
 272
 273                 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_1)) {
 274                         if (key->type == key_gc_dead_keytype) {
 275                                 gc_state |= KEY_GC_FOUND_DEAD_KEY;
 276                                 set_bit(KEY_FLAG_DEAD, &key->flags);
 277                                 key->perm = 0;
 278                                 goto skip_dead_key;
 279                         }
 280                 }
 281
 282                 if (gc_state & KEY_GC_SET_TIMER) {
 283                         if (key->expiry > limit && key->expiry < new_timer) {
 284                                 kdebug("will expire %x in %ld",
 285                                        key_serial(key), key->expiry - limit);
 286                                 new_timer = key->expiry;
 287                         }
 288                 }
 289
 290                 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2))
 291                         if (key->type == key_gc_dead_keytype)
 292                                 gc_state |= KEY_GC_FOUND_DEAD_KEY;
 293
 294                 if ((gc_state & KEY_GC_REAPING_LINKS) ||
 295                     unlikely(gc_state & KEY_GC_REAPING_DEAD_2)) {
 296                         if (key->type == &key_type_keyring)
 297                                 goto found_keyring;
 298                 }
 299
 300                 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3))
 301                         if (key->type == key_gc_dead_keytype)
 302                                 goto destroy_dead_key;
 303
 304         skip_dead_key:
 305                 if (spin_is_contended(&key_serial_lock) || need_resched())
 306                         goto contended;
 307         }
 308
 309 contended:
 310         spin_unlock(&key_serial_lock);
 311
 312 maybe_resched:
 313         if (cursor) {
 314                 cond_resched();
 315                 spin_lock(&key_serial_lock);
 316                 goto continue_scanning;
 317         }
 318
 319         /* We've completed the pass.  Set the timer if we need to and queue a
 320          * new cycle if necessary.  We keep executing cycles until we find one
 321          * where we didn't reap any keys.
 322          */
 323         kdebug("pass complete");
 324
 325         if (gc_state & KEY_GC_SET_TIMER && new_timer != (time_t)LONG_MAX) {
 326                 new_timer += key_gc_delay;
 327                 key_schedule_gc(new_timer);
 328         }
 329
 330         if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2) ||
 331             !list_empty(&graveyard)) {
 332                 /* Make sure that all pending keyring payload destructions are
 333                  * fulfilled and that people aren't now looking at dead or
 334                  * dying keys that they don't have a reference upon or a link
 335                  * to.
 336                  */
 337                 kdebug("gc sync");
 338                 synchronize_rcu();
 339         }
 340
 341         if (!list_empty(&graveyard)) {
 342                 kdebug("gc keys");
 343                 key_gc_unused_keys(&graveyard);
 344         }
 345
 346         if (unlikely(gc_state & (KEY_GC_REAPING_DEAD_1 |
 347                                  KEY_GC_REAPING_DEAD_2))) {
 348                 if (!(gc_state & KEY_GC_FOUND_DEAD_KEY)) {
 349                         /* No remaining dead keys: short circuit the remaining
 350                          * keytype reap cycles.
 351                          */
 352                         kdebug("dead short");
 353                         gc_state &= ~(KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2);
 354                         gc_state |= KEY_GC_REAPING_DEAD_3;
 355                 } else {
 356                         gc_state |= KEY_GC_REAP_AGAIN;
 357                 }
 358         }
 359
 360         if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3)) {
 361                 kdebug("dead wake");
 362                 smp_mb();
 363                 clear_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
 364                 wake_up_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE);
 365         }
 366
 367         if (gc_state & KEY_GC_REAP_AGAIN)
 368                 schedule_work(&key_gc_work);
 369         kleave(" [end %x]", gc_state);
 370         return;
 371
 372         /* We found an unreferenced key - once we've removed it from the tree,
 373          * we can safely drop the lock.
 374          */
 375 found_unreferenced_key:
 376         kdebug("unrefd key %d", key->serial);
 377         rb_erase(&key->serial_node, &key_serial_tree);
 378         spin_unlock(&key_serial_lock);
 379
 380         list_add_tail(&key->graveyard_link, &graveyard);
 381         gc_state |= KEY_GC_REAP_AGAIN;
 382         goto maybe_resched;
 383
 384         /* We found a keyring and we need to check the payload for links to
 385          * dead or expired keys.  We don't flag another reap immediately as we
 386          * have to wait for the old payload to be destroyed by RCU before we
 387          * can reap the keys to which it refers.
 388          */
 389 found_keyring:
 390         spin_unlock(&key_serial_lock);
 391         key_gc_keyring(key, limit);
 392         goto maybe_resched;
 393
 394         /* We found a dead key that is still referenced.  Reset its type and
 395          * destroy its payload with its semaphore held.
 396          */
 397 destroy_dead_key:
 398         spin_unlock(&key_serial_lock);
 399         kdebug("destroy key %d", key->serial);
 400         down_write(&key->sem);
 401         key->type = &key_type_dead;
 402         if (key_gc_dead_keytype->destroy)
 403                 key_gc_dead_keytype->destroy(key);
 404         memset(&key->payload, KEY_DESTROY, sizeof(key->payload));
 405         up_write(&key->sem);
 406         goto maybe_resched;
 407 }