1 | // SPDX-License-Identifier: GPL-2.0-or-later |
2 | /* Key garbage collector |
3 | * |
4 | * Copyright (C) 2009-2011 Red Hat, Inc. All Rights Reserved. |
5 | * Written by David Howells (dhowells@redhat.com) |
6 | */ |
7 | |
8 | #include <linux/slab.h> |
9 | #include <linux/security.h> |
10 | #include <keys/keyring-type.h> |
11 | #include "internal.h" |
12 | |
13 | /* |
14 | * Delay between key revocation/expiry in seconds |
15 | */ |
16 | unsigned key_gc_delay = 5 * 60; |
17 | |
18 | /* |
19 | * Reaper for unused keys. |
20 | */ |
21 | static void key_garbage_collector(struct work_struct *work); |
22 | DECLARE_WORK(key_gc_work, key_garbage_collector); |
23 | |
24 | /* |
25 | * Reaper for links from keyrings to dead keys. |
26 | */ |
27 | static void key_gc_timer_func(struct timer_list *); |
28 | static DEFINE_TIMER(key_gc_timer, key_gc_timer_func); |
29 | |
30 | static time64_t key_gc_next_run = TIME64_MAX; |
31 | static struct key_type *key_gc_dead_keytype; |
32 | |
33 | static unsigned long key_gc_flags; |
34 | #define KEY_GC_KEY_EXPIRED 0 /* A key expired and needs unlinking */ |
35 | #define KEY_GC_REAP_KEYTYPE 1 /* A keytype is being unregistered */ |
36 | #define KEY_GC_REAPING_KEYTYPE 2 /* Cleared when keytype reaped */ |
37 | |
38 | |
39 | /* |
40 | * Any key whose type gets unregistered will be re-typed to this if it can't be |
41 | * immediately unlinked. |
42 | */ |
43 | struct key_type key_type_dead = { |
44 | .name = ".dead" , |
45 | }; |
46 | |
47 | /* |
48 | * Schedule a garbage collection run. |
49 | * - time precision isn't particularly important |
50 | */ |
51 | void key_schedule_gc(time64_t gc_at) |
52 | { |
53 | unsigned long expires; |
54 | time64_t now = ktime_get_real_seconds(); |
55 | |
56 | kenter("%lld" , gc_at - now); |
57 | |
58 | if (gc_at <= now || test_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags)) { |
59 | kdebug("IMMEDIATE" ); |
60 | schedule_work(work: &key_gc_work); |
61 | } else if (gc_at < key_gc_next_run) { |
62 | kdebug("DEFERRED" ); |
63 | key_gc_next_run = gc_at; |
64 | expires = jiffies + (gc_at - now) * HZ; |
65 | mod_timer(timer: &key_gc_timer, expires); |
66 | } |
67 | } |
68 | |
69 | /* |
70 | * Set the expiration time on a key. |
71 | */ |
72 | void key_set_expiry(struct key *key, time64_t expiry) |
73 | { |
74 | key->expiry = expiry; |
75 | if (expiry != TIME64_MAX) { |
76 | if (!(key->type->flags & KEY_TYPE_INSTANT_REAP)) |
77 | expiry += key_gc_delay; |
78 | key_schedule_gc(gc_at: expiry); |
79 | } |
80 | } |
81 | |
82 | /* |
83 | * Schedule a dead links collection run. |
84 | */ |
85 | void key_schedule_gc_links(void) |
86 | { |
87 | set_bit(KEY_GC_KEY_EXPIRED, addr: &key_gc_flags); |
88 | schedule_work(work: &key_gc_work); |
89 | } |
90 | |
91 | /* |
92 | * Some key's cleanup time was met after it expired, so we need to get the |
93 | * reaper to go through a cycle finding expired keys. |
94 | */ |
95 | static void key_gc_timer_func(struct timer_list *unused) |
96 | { |
97 | kenter("" ); |
98 | key_gc_next_run = TIME64_MAX; |
99 | key_schedule_gc_links(); |
100 | } |
101 | |
102 | /* |
103 | * Reap keys of dead type. |
104 | * |
105 | * We use three flags to make sure we see three complete cycles of the garbage |
106 | * collector: the first to mark keys of that type as being dead, the second to |
107 | * collect dead links and the third to clean up the dead keys. We have to be |
108 | * careful as there may already be a cycle in progress. |
109 | * |
110 | * The caller must be holding key_types_sem. |
111 | */ |
112 | void key_gc_keytype(struct key_type *ktype) |
113 | { |
114 | kenter("%s" , ktype->name); |
115 | |
116 | key_gc_dead_keytype = ktype; |
117 | set_bit(KEY_GC_REAPING_KEYTYPE, addr: &key_gc_flags); |
118 | smp_mb(); |
119 | set_bit(KEY_GC_REAP_KEYTYPE, addr: &key_gc_flags); |
120 | |
121 | kdebug("schedule" ); |
122 | schedule_work(work: &key_gc_work); |
123 | |
124 | kdebug("sleep" ); |
125 | wait_on_bit(word: &key_gc_flags, KEY_GC_REAPING_KEYTYPE, |
126 | TASK_UNINTERRUPTIBLE); |
127 | |
128 | key_gc_dead_keytype = NULL; |
129 | kleave("" ); |
130 | } |
131 | |
132 | /* |
133 | * Garbage collect a list of unreferenced, detached keys |
134 | */ |
135 | static noinline void key_gc_unused_keys(struct list_head *keys) |
136 | { |
137 | while (!list_empty(head: keys)) { |
138 | struct key *key = |
139 | list_entry(keys->next, struct key, graveyard_link); |
140 | short state = key->state; |
141 | |
142 | list_del(entry: &key->graveyard_link); |
143 | |
144 | kdebug("- %u" , key->serial); |
145 | key_check(key); |
146 | |
147 | #ifdef CONFIG_KEY_NOTIFICATIONS |
148 | remove_watch_list(wlist: key->watchers, id: key->serial); |
149 | key->watchers = NULL; |
150 | #endif |
151 | |
152 | /* Throw away the key data if the key is instantiated */ |
153 | if (state == KEY_IS_POSITIVE && key->type->destroy) |
154 | key->type->destroy(key); |
155 | |
156 | security_key_free(key); |
157 | |
158 | /* deal with the user's key tracking and quota */ |
159 | if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) { |
160 | spin_lock(lock: &key->user->lock); |
161 | key->user->qnkeys--; |
162 | key->user->qnbytes -= key->quotalen; |
163 | spin_unlock(lock: &key->user->lock); |
164 | } |
165 | |
166 | atomic_dec(v: &key->user->nkeys); |
167 | if (state != KEY_IS_UNINSTANTIATED) |
168 | atomic_dec(v: &key->user->nikeys); |
169 | |
170 | key_user_put(user: key->user); |
171 | key_put_tag(tag: key->domain_tag); |
172 | kfree(objp: key->description); |
173 | |
174 | memzero_explicit(s: key, count: sizeof(*key)); |
175 | kmem_cache_free(s: key_jar, objp: key); |
176 | } |
177 | } |
178 | |
179 | /* |
180 | * Garbage collector for unused keys. |
181 | * |
182 | * This is done in process context so that we don't have to disable interrupts |
183 | * all over the place. key_put() schedules this rather than trying to do the |
184 | * cleanup itself, which means key_put() doesn't have to sleep. |
185 | */ |
186 | static void key_garbage_collector(struct work_struct *work) |
187 | { |
188 | static LIST_HEAD(graveyard); |
189 | static u8 gc_state; /* Internal persistent state */ |
190 | #define KEY_GC_REAP_AGAIN 0x01 /* - Need another cycle */ |
191 | #define KEY_GC_REAPING_LINKS 0x02 /* - We need to reap links */ |
192 | #define KEY_GC_REAPING_DEAD_1 0x10 /* - We need to mark dead keys */ |
193 | #define KEY_GC_REAPING_DEAD_2 0x20 /* - We need to reap dead key links */ |
194 | #define KEY_GC_REAPING_DEAD_3 0x40 /* - We need to reap dead keys */ |
195 | #define KEY_GC_FOUND_DEAD_KEY 0x80 /* - We found at least one dead key */ |
196 | |
197 | struct rb_node *cursor; |
198 | struct key *key; |
199 | time64_t new_timer, limit, expiry; |
200 | |
201 | kenter("[%lx,%x]" , key_gc_flags, gc_state); |
202 | |
203 | limit = ktime_get_real_seconds(); |
204 | |
205 | /* Work out what we're going to be doing in this pass */ |
206 | gc_state &= KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2; |
207 | gc_state <<= 1; |
208 | if (test_and_clear_bit(KEY_GC_KEY_EXPIRED, addr: &key_gc_flags)) |
209 | gc_state |= KEY_GC_REAPING_LINKS; |
210 | |
211 | if (test_and_clear_bit(KEY_GC_REAP_KEYTYPE, addr: &key_gc_flags)) |
212 | gc_state |= KEY_GC_REAPING_DEAD_1; |
213 | kdebug("new pass %x" , gc_state); |
214 | |
215 | new_timer = TIME64_MAX; |
216 | |
217 | /* As only this function is permitted to remove things from the key |
218 | * serial tree, if cursor is non-NULL then it will always point to a |
219 | * valid node in the tree - even if lock got dropped. |
220 | */ |
221 | spin_lock(lock: &key_serial_lock); |
222 | cursor = rb_first(&key_serial_tree); |
223 | |
224 | continue_scanning: |
225 | while (cursor) { |
226 | key = rb_entry(cursor, struct key, serial_node); |
227 | cursor = rb_next(cursor); |
228 | |
229 | if (refcount_read(r: &key->usage) == 0) |
230 | goto found_unreferenced_key; |
231 | |
232 | if (unlikely(gc_state & KEY_GC_REAPING_DEAD_1)) { |
233 | if (key->type == key_gc_dead_keytype) { |
234 | gc_state |= KEY_GC_FOUND_DEAD_KEY; |
235 | set_bit(KEY_FLAG_DEAD, addr: &key->flags); |
236 | key->perm = 0; |
237 | goto skip_dead_key; |
238 | } else if (key->type == &key_type_keyring && |
239 | key->restrict_link) { |
240 | goto found_restricted_keyring; |
241 | } |
242 | } |
243 | |
244 | expiry = key->expiry; |
245 | if (expiry != TIME64_MAX) { |
246 | if (!(key->type->flags & KEY_TYPE_INSTANT_REAP)) |
247 | expiry += key_gc_delay; |
248 | if (expiry > limit && expiry < new_timer) { |
249 | kdebug("will expire %x in %lld" , |
250 | key_serial(key), key->expiry - limit); |
251 | new_timer = key->expiry; |
252 | } |
253 | } |
254 | |
255 | if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2)) |
256 | if (key->type == key_gc_dead_keytype) |
257 | gc_state |= KEY_GC_FOUND_DEAD_KEY; |
258 | |
259 | if ((gc_state & KEY_GC_REAPING_LINKS) || |
260 | unlikely(gc_state & KEY_GC_REAPING_DEAD_2)) { |
261 | if (key->type == &key_type_keyring) |
262 | goto found_keyring; |
263 | } |
264 | |
265 | if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3)) |
266 | if (key->type == key_gc_dead_keytype) |
267 | goto destroy_dead_key; |
268 | |
269 | skip_dead_key: |
270 | if (spin_is_contended(lock: &key_serial_lock) || need_resched()) |
271 | goto contended; |
272 | } |
273 | |
274 | contended: |
275 | spin_unlock(lock: &key_serial_lock); |
276 | |
277 | maybe_resched: |
278 | if (cursor) { |
279 | cond_resched(); |
280 | spin_lock(lock: &key_serial_lock); |
281 | goto continue_scanning; |
282 | } |
283 | |
284 | /* We've completed the pass. Set the timer if we need to and queue a |
285 | * new cycle if necessary. We keep executing cycles until we find one |
286 | * where we didn't reap any keys. |
287 | */ |
288 | kdebug("pass complete" ); |
289 | |
290 | if (new_timer != TIME64_MAX) { |
291 | new_timer += key_gc_delay; |
292 | key_schedule_gc(gc_at: new_timer); |
293 | } |
294 | |
295 | if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2) || |
296 | !list_empty(head: &graveyard)) { |
297 | /* Make sure that all pending keyring payload destructions are |
298 | * fulfilled and that people aren't now looking at dead or |
299 | * dying keys that they don't have a reference upon or a link |
300 | * to. |
301 | */ |
302 | kdebug("gc sync" ); |
303 | synchronize_rcu(); |
304 | } |
305 | |
306 | if (!list_empty(head: &graveyard)) { |
307 | kdebug("gc keys" ); |
308 | key_gc_unused_keys(keys: &graveyard); |
309 | } |
310 | |
311 | if (unlikely(gc_state & (KEY_GC_REAPING_DEAD_1 | |
312 | KEY_GC_REAPING_DEAD_2))) { |
313 | if (!(gc_state & KEY_GC_FOUND_DEAD_KEY)) { |
314 | /* No remaining dead keys: short circuit the remaining |
315 | * keytype reap cycles. |
316 | */ |
317 | kdebug("dead short" ); |
318 | gc_state &= ~(KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2); |
319 | gc_state |= KEY_GC_REAPING_DEAD_3; |
320 | } else { |
321 | gc_state |= KEY_GC_REAP_AGAIN; |
322 | } |
323 | } |
324 | |
325 | if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3)) { |
326 | kdebug("dead wake" ); |
327 | smp_mb(); |
328 | clear_bit(KEY_GC_REAPING_KEYTYPE, addr: &key_gc_flags); |
329 | wake_up_bit(word: &key_gc_flags, KEY_GC_REAPING_KEYTYPE); |
330 | } |
331 | |
332 | if (gc_state & KEY_GC_REAP_AGAIN) |
333 | schedule_work(work: &key_gc_work); |
334 | kleave(" [end %x]" , gc_state); |
335 | return; |
336 | |
337 | /* We found an unreferenced key - once we've removed it from the tree, |
338 | * we can safely drop the lock. |
339 | */ |
340 | found_unreferenced_key: |
341 | kdebug("unrefd key %d" , key->serial); |
342 | rb_erase(&key->serial_node, &key_serial_tree); |
343 | spin_unlock(lock: &key_serial_lock); |
344 | |
345 | list_add_tail(new: &key->graveyard_link, head: &graveyard); |
346 | gc_state |= KEY_GC_REAP_AGAIN; |
347 | goto maybe_resched; |
348 | |
349 | /* We found a restricted keyring and need to update the restriction if |
350 | * it is associated with the dead key type. |
351 | */ |
352 | found_restricted_keyring: |
353 | spin_unlock(lock: &key_serial_lock); |
354 | keyring_restriction_gc(keyring: key, dead_type: key_gc_dead_keytype); |
355 | goto maybe_resched; |
356 | |
357 | /* We found a keyring and we need to check the payload for links to |
358 | * dead or expired keys. We don't flag another reap immediately as we |
359 | * have to wait for the old payload to be destroyed by RCU before we |
360 | * can reap the keys to which it refers. |
361 | */ |
362 | found_keyring: |
363 | spin_unlock(lock: &key_serial_lock); |
364 | keyring_gc(keyring: key, limit); |
365 | goto maybe_resched; |
366 | |
367 | /* We found a dead key that is still referenced. Reset its type and |
368 | * destroy its payload with its semaphore held. |
369 | */ |
370 | destroy_dead_key: |
371 | spin_unlock(lock: &key_serial_lock); |
372 | kdebug("destroy key %d" , key->serial); |
373 | down_write(sem: &key->sem); |
374 | key->type = &key_type_dead; |
375 | if (key_gc_dead_keytype->destroy) |
376 | key_gc_dead_keytype->destroy(key); |
377 | memset(&key->payload, KEY_DESTROY, sizeof(key->payload)); |
378 | up_write(sem: &key->sem); |
379 | goto maybe_resched; |
380 | } |
381 | |