1// SPDX-License-Identifier: GPL-2.0-or-later
2/* Key garbage collector
3 *
4 * Copyright (C) 2009-2011 Red Hat, Inc. All Rights Reserved.
5 * Written by David Howells (dhowells@redhat.com)
6 */
7
8#include <linux/slab.h>
9#include <linux/security.h>
10#include <keys/keyring-type.h>
11#include "internal.h"
12
13/*
14 * Delay between key revocation/expiry in seconds
15 */
16unsigned key_gc_delay = 5 * 60;
17
18/*
19 * Reaper for unused keys.
20 */
21static void key_garbage_collector(struct work_struct *work);
22DECLARE_WORK(key_gc_work, key_garbage_collector);
23
24/*
25 * Reaper for links from keyrings to dead keys.
26 */
27static void key_gc_timer_func(struct timer_list *);
28static DEFINE_TIMER(key_gc_timer, key_gc_timer_func);
29
30static time64_t key_gc_next_run = TIME64_MAX;
31static struct key_type *key_gc_dead_keytype;
32
33static unsigned long key_gc_flags;
34#define KEY_GC_KEY_EXPIRED 0 /* A key expired and needs unlinking */
35#define KEY_GC_REAP_KEYTYPE 1 /* A keytype is being unregistered */
36#define KEY_GC_REAPING_KEYTYPE 2 /* Cleared when keytype reaped */
37
38
39/*
40 * Any key whose type gets unregistered will be re-typed to this if it can't be
41 * immediately unlinked.
42 */
43struct key_type key_type_dead = {
44 .name = ".dead",
45};
46
47/*
48 * Schedule a garbage collection run.
49 * - time precision isn't particularly important
50 */
51void key_schedule_gc(time64_t gc_at)
52{
53 unsigned long expires;
54 time64_t now = ktime_get_real_seconds();
55
56 kenter("%lld", gc_at - now);
57
58 if (gc_at <= now || test_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags)) {
59 kdebug("IMMEDIATE");
60 schedule_work(work: &key_gc_work);
61 } else if (gc_at < key_gc_next_run) {
62 kdebug("DEFERRED");
63 key_gc_next_run = gc_at;
64 expires = jiffies + (gc_at - now) * HZ;
65 mod_timer(timer: &key_gc_timer, expires);
66 }
67}
68
69/*
70 * Set the expiration time on a key.
71 */
72void key_set_expiry(struct key *key, time64_t expiry)
73{
74 key->expiry = expiry;
75 if (expiry != TIME64_MAX) {
76 if (!(key->type->flags & KEY_TYPE_INSTANT_REAP))
77 expiry += key_gc_delay;
78 key_schedule_gc(gc_at: expiry);
79 }
80}
81
82/*
83 * Schedule a dead links collection run.
84 */
85void key_schedule_gc_links(void)
86{
87 set_bit(KEY_GC_KEY_EXPIRED, addr: &key_gc_flags);
88 schedule_work(work: &key_gc_work);
89}
90
91/*
92 * Some key's cleanup time was met after it expired, so we need to get the
93 * reaper to go through a cycle finding expired keys.
94 */
95static void key_gc_timer_func(struct timer_list *unused)
96{
97 kenter("");
98 key_gc_next_run = TIME64_MAX;
99 key_schedule_gc_links();
100}
101
102/*
103 * Reap keys of dead type.
104 *
105 * We use three flags to make sure we see three complete cycles of the garbage
106 * collector: the first to mark keys of that type as being dead, the second to
107 * collect dead links and the third to clean up the dead keys. We have to be
108 * careful as there may already be a cycle in progress.
109 *
110 * The caller must be holding key_types_sem.
111 */
112void key_gc_keytype(struct key_type *ktype)
113{
114 kenter("%s", ktype->name);
115
116 key_gc_dead_keytype = ktype;
117 set_bit(KEY_GC_REAPING_KEYTYPE, addr: &key_gc_flags);
118 smp_mb();
119 set_bit(KEY_GC_REAP_KEYTYPE, addr: &key_gc_flags);
120
121 kdebug("schedule");
122 schedule_work(work: &key_gc_work);
123
124 kdebug("sleep");
125 wait_on_bit(word: &key_gc_flags, KEY_GC_REAPING_KEYTYPE,
126 TASK_UNINTERRUPTIBLE);
127
128 key_gc_dead_keytype = NULL;
129 kleave("");
130}
131
132/*
133 * Garbage collect a list of unreferenced, detached keys
134 */
135static noinline void key_gc_unused_keys(struct list_head *keys)
136{
137 while (!list_empty(head: keys)) {
138 struct key *key =
139 list_entry(keys->next, struct key, graveyard_link);
140 short state = key->state;
141
142 list_del(entry: &key->graveyard_link);
143
144 kdebug("- %u", key->serial);
145 key_check(key);
146
147#ifdef CONFIG_KEY_NOTIFICATIONS
148 remove_watch_list(wlist: key->watchers, id: key->serial);
149 key->watchers = NULL;
150#endif
151
152 /* Throw away the key data if the key is instantiated */
153 if (state == KEY_IS_POSITIVE && key->type->destroy)
154 key->type->destroy(key);
155
156 security_key_free(key);
157
158 /* deal with the user's key tracking and quota */
159 if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) {
160 spin_lock(lock: &key->user->lock);
161 key->user->qnkeys--;
162 key->user->qnbytes -= key->quotalen;
163 spin_unlock(lock: &key->user->lock);
164 }
165
166 atomic_dec(v: &key->user->nkeys);
167 if (state != KEY_IS_UNINSTANTIATED)
168 atomic_dec(v: &key->user->nikeys);
169
170 key_user_put(user: key->user);
171 key_put_tag(tag: key->domain_tag);
172 kfree(objp: key->description);
173
174 memzero_explicit(s: key, count: sizeof(*key));
175 kmem_cache_free(s: key_jar, objp: key);
176 }
177}
178
179/*
180 * Garbage collector for unused keys.
181 *
182 * This is done in process context so that we don't have to disable interrupts
183 * all over the place. key_put() schedules this rather than trying to do the
184 * cleanup itself, which means key_put() doesn't have to sleep.
185 */
186static void key_garbage_collector(struct work_struct *work)
187{
188 static LIST_HEAD(graveyard);
189 static u8 gc_state; /* Internal persistent state */
190#define KEY_GC_REAP_AGAIN 0x01 /* - Need another cycle */
191#define KEY_GC_REAPING_LINKS 0x02 /* - We need to reap links */
192#define KEY_GC_REAPING_DEAD_1 0x10 /* - We need to mark dead keys */
193#define KEY_GC_REAPING_DEAD_2 0x20 /* - We need to reap dead key links */
194#define KEY_GC_REAPING_DEAD_3 0x40 /* - We need to reap dead keys */
195#define KEY_GC_FOUND_DEAD_KEY 0x80 /* - We found at least one dead key */
196
197 struct rb_node *cursor;
198 struct key *key;
199 time64_t new_timer, limit, expiry;
200
201 kenter("[%lx,%x]", key_gc_flags, gc_state);
202
203 limit = ktime_get_real_seconds();
204
205 /* Work out what we're going to be doing in this pass */
206 gc_state &= KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2;
207 gc_state <<= 1;
208 if (test_and_clear_bit(KEY_GC_KEY_EXPIRED, addr: &key_gc_flags))
209 gc_state |= KEY_GC_REAPING_LINKS;
210
211 if (test_and_clear_bit(KEY_GC_REAP_KEYTYPE, addr: &key_gc_flags))
212 gc_state |= KEY_GC_REAPING_DEAD_1;
213 kdebug("new pass %x", gc_state);
214
215 new_timer = TIME64_MAX;
216
217 /* As only this function is permitted to remove things from the key
218 * serial tree, if cursor is non-NULL then it will always point to a
219 * valid node in the tree - even if lock got dropped.
220 */
221 spin_lock(lock: &key_serial_lock);
222 cursor = rb_first(&key_serial_tree);
223
224continue_scanning:
225 while (cursor) {
226 key = rb_entry(cursor, struct key, serial_node);
227 cursor = rb_next(cursor);
228
229 if (refcount_read(r: &key->usage) == 0)
230 goto found_unreferenced_key;
231
232 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_1)) {
233 if (key->type == key_gc_dead_keytype) {
234 gc_state |= KEY_GC_FOUND_DEAD_KEY;
235 set_bit(KEY_FLAG_DEAD, addr: &key->flags);
236 key->perm = 0;
237 goto skip_dead_key;
238 } else if (key->type == &key_type_keyring &&
239 key->restrict_link) {
240 goto found_restricted_keyring;
241 }
242 }
243
244 expiry = key->expiry;
245 if (expiry != TIME64_MAX) {
246 if (!(key->type->flags & KEY_TYPE_INSTANT_REAP))
247 expiry += key_gc_delay;
248 if (expiry > limit && expiry < new_timer) {
249 kdebug("will expire %x in %lld",
250 key_serial(key), key->expiry - limit);
251 new_timer = key->expiry;
252 }
253 }
254
255 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2))
256 if (key->type == key_gc_dead_keytype)
257 gc_state |= KEY_GC_FOUND_DEAD_KEY;
258
259 if ((gc_state & KEY_GC_REAPING_LINKS) ||
260 unlikely(gc_state & KEY_GC_REAPING_DEAD_2)) {
261 if (key->type == &key_type_keyring)
262 goto found_keyring;
263 }
264
265 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3))
266 if (key->type == key_gc_dead_keytype)
267 goto destroy_dead_key;
268
269 skip_dead_key:
270 if (spin_is_contended(lock: &key_serial_lock) || need_resched())
271 goto contended;
272 }
273
274contended:
275 spin_unlock(lock: &key_serial_lock);
276
277maybe_resched:
278 if (cursor) {
279 cond_resched();
280 spin_lock(lock: &key_serial_lock);
281 goto continue_scanning;
282 }
283
284 /* We've completed the pass. Set the timer if we need to and queue a
285 * new cycle if necessary. We keep executing cycles until we find one
286 * where we didn't reap any keys.
287 */
288 kdebug("pass complete");
289
290 if (new_timer != TIME64_MAX) {
291 new_timer += key_gc_delay;
292 key_schedule_gc(gc_at: new_timer);
293 }
294
295 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2) ||
296 !list_empty(head: &graveyard)) {
297 /* Make sure that all pending keyring payload destructions are
298 * fulfilled and that people aren't now looking at dead or
299 * dying keys that they don't have a reference upon or a link
300 * to.
301 */
302 kdebug("gc sync");
303 synchronize_rcu();
304 }
305
306 if (!list_empty(head: &graveyard)) {
307 kdebug("gc keys");
308 key_gc_unused_keys(keys: &graveyard);
309 }
310
311 if (unlikely(gc_state & (KEY_GC_REAPING_DEAD_1 |
312 KEY_GC_REAPING_DEAD_2))) {
313 if (!(gc_state & KEY_GC_FOUND_DEAD_KEY)) {
314 /* No remaining dead keys: short circuit the remaining
315 * keytype reap cycles.
316 */
317 kdebug("dead short");
318 gc_state &= ~(KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2);
319 gc_state |= KEY_GC_REAPING_DEAD_3;
320 } else {
321 gc_state |= KEY_GC_REAP_AGAIN;
322 }
323 }
324
325 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3)) {
326 kdebug("dead wake");
327 smp_mb();
328 clear_bit(KEY_GC_REAPING_KEYTYPE, addr: &key_gc_flags);
329 wake_up_bit(word: &key_gc_flags, KEY_GC_REAPING_KEYTYPE);
330 }
331
332 if (gc_state & KEY_GC_REAP_AGAIN)
333 schedule_work(work: &key_gc_work);
334 kleave(" [end %x]", gc_state);
335 return;
336
337 /* We found an unreferenced key - once we've removed it from the tree,
338 * we can safely drop the lock.
339 */
340found_unreferenced_key:
341 kdebug("unrefd key %d", key->serial);
342 rb_erase(&key->serial_node, &key_serial_tree);
343 spin_unlock(lock: &key_serial_lock);
344
345 list_add_tail(new: &key->graveyard_link, head: &graveyard);
346 gc_state |= KEY_GC_REAP_AGAIN;
347 goto maybe_resched;
348
349 /* We found a restricted keyring and need to update the restriction if
350 * it is associated with the dead key type.
351 */
352found_restricted_keyring:
353 spin_unlock(lock: &key_serial_lock);
354 keyring_restriction_gc(keyring: key, dead_type: key_gc_dead_keytype);
355 goto maybe_resched;
356
357 /* We found a keyring and we need to check the payload for links to
358 * dead or expired keys. We don't flag another reap immediately as we
359 * have to wait for the old payload to be destroyed by RCU before we
360 * can reap the keys to which it refers.
361 */
362found_keyring:
363 spin_unlock(lock: &key_serial_lock);
364 keyring_gc(keyring: key, limit);
365 goto maybe_resched;
366
367 /* We found a dead key that is still referenced. Reset its type and
368 * destroy its payload with its semaphore held.
369 */
370destroy_dead_key:
371 spin_unlock(lock: &key_serial_lock);
372 kdebug("destroy key %d", key->serial);
373 down_write(sem: &key->sem);
374 key->type = &key_type_dead;
375 if (key_gc_dead_keytype->destroy)
376 key_gc_dead_keytype->destroy(key);
377 memset(&key->payload, KEY_DESTROY, sizeof(key->payload));
378 up_write(sem: &key->sem);
379 goto maybe_resched;
380}
381

source code of linux/security/keys/gc.c