1/* Key garbage collector
2 *
3 * Copyright (C) 2009-2011 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public Licence
8 * as published by the Free Software Foundation; either version
9 * 2 of the Licence, or (at your option) any later version.
10 */
11
12#include <linux/module.h>
13#include <linux/slab.h>
14#include <linux/security.h>
15#include <keys/keyring-type.h>
16#include "internal.h"
17
18/*
19 * Delay between key revocation/expiry in seconds
20 */
21unsigned key_gc_delay = 5 * 60;
22
23/*
24 * Reaper for unused keys.
25 */
26static void key_garbage_collector(struct work_struct *work);
27DECLARE_WORK(key_gc_work, key_garbage_collector);
28
29/*
30 * Reaper for links from keyrings to dead keys.
31 */
32static void key_gc_timer_func(unsigned long);
33static DEFINE_TIMER(key_gc_timer, key_gc_timer_func, 0, 0);
34
35static time_t key_gc_next_run = LONG_MAX;
36static struct key_type *key_gc_dead_keytype;
37
38static unsigned long key_gc_flags;
39#define KEY_GC_KEY_EXPIRED	0	/* A key expired and needs unlinking */
40#define KEY_GC_REAP_KEYTYPE	1	/* A keytype is being unregistered */
41#define KEY_GC_REAPING_KEYTYPE	2	/* Cleared when keytype reaped */
42
43
44/*
45 * Any key whose type gets unregistered will be re-typed to this if it can't be
46 * immediately unlinked.
47 */
48struct key_type key_type_dead = {
49	.name = "dead",
50};
51
52/*
53 * Schedule a garbage collection run.
54 * - time precision isn't particularly important
55 */
56void key_schedule_gc(time_t gc_at)
57{
58	unsigned long expires;
59	time_t now = current_kernel_time().tv_sec;
60
61	kenter("%ld", gc_at - now);
62
63	if (gc_at <= now || test_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags)) {
64		kdebug("IMMEDIATE");
65		schedule_work(&key_gc_work);
66	} else if (gc_at < key_gc_next_run) {
67		kdebug("DEFERRED");
68		key_gc_next_run = gc_at;
69		expires = jiffies + (gc_at - now) * HZ;
70		mod_timer(&key_gc_timer, expires);
71	}
72}
73
74/*
75 * Schedule a dead links collection run.
76 */
77void key_schedule_gc_links(void)
78{
79	set_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags);
80	schedule_work(&key_gc_work);
81}
82
83/*
84 * Some key's cleanup time was met after it expired, so we need to get the
85 * reaper to go through a cycle finding expired keys.
86 */
87static void key_gc_timer_func(unsigned long data)
88{
89	kenter("");
90	key_gc_next_run = LONG_MAX;
91	key_schedule_gc_links();
92}
93
94/*
95 * Reap keys of dead type.
96 *
97 * We use three flags to make sure we see three complete cycles of the garbage
98 * collector: the first to mark keys of that type as being dead, the second to
99 * collect dead links and the third to clean up the dead keys.  We have to be
100 * careful as there may already be a cycle in progress.
101 *
102 * The caller must be holding key_types_sem.
103 */
104void key_gc_keytype(struct key_type *ktype)
105{
106	kenter("%s", ktype->name);
107
108	key_gc_dead_keytype = ktype;
109	set_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
110	smp_mb();
111	set_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags);
112
113	kdebug("schedule");
114	schedule_work(&key_gc_work);
115
116	kdebug("sleep");
117	wait_on_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE,
118		    TASK_UNINTERRUPTIBLE);
119
120	key_gc_dead_keytype = NULL;
121	kleave("");
122}
123
124/*
125 * Garbage collect a list of unreferenced, detached keys
126 */
127static noinline void key_gc_unused_keys(struct list_head *keys)
128{
129	while (!list_empty(keys)) {
130		struct key *key =
131			list_entry(keys->next, struct key, graveyard_link);
132		list_del(&key->graveyard_link);
133
134		kdebug("- %u", key->serial);
135		key_check(key);
136
137		/* Throw away the key data if the key is instantiated */
138		if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags) &&
139		    !test_bit(KEY_FLAG_NEGATIVE, &key->flags) &&
140		    key->type->destroy)
141			key->type->destroy(key);
142
143		security_key_free(key);
144
145		/* deal with the user's key tracking and quota */
146		if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) {
147			spin_lock(&key->user->lock);
148			key->user->qnkeys--;
149			key->user->qnbytes -= key->quotalen;
150			spin_unlock(&key->user->lock);
151		}
152
153		atomic_dec(&key->user->nkeys);
154		if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
155			atomic_dec(&key->user->nikeys);
156
157		key_user_put(key->user);
158
159		kfree(key->description);
160
161#ifdef KEY_DEBUGGING
162		key->magic = KEY_DEBUG_MAGIC_X;
163#endif
164		kmem_cache_free(key_jar, key);
165	}
166}
167
168/*
169 * Garbage collector for unused keys.
170 *
171 * This is done in process context so that we don't have to disable interrupts
172 * all over the place.  key_put() schedules this rather than trying to do the
173 * cleanup itself, which means key_put() doesn't have to sleep.
174 */
175static void key_garbage_collector(struct work_struct *work)
176{
177	static LIST_HEAD(graveyard);
178	static u8 gc_state;		/* Internal persistent state */
179#define KEY_GC_REAP_AGAIN	0x01	/* - Need another cycle */
180#define KEY_GC_REAPING_LINKS	0x02	/* - We need to reap links */
181#define KEY_GC_SET_TIMER	0x04	/* - We need to restart the timer */
182#define KEY_GC_REAPING_DEAD_1	0x10	/* - We need to mark dead keys */
183#define KEY_GC_REAPING_DEAD_2	0x20	/* - We need to reap dead key links */
184#define KEY_GC_REAPING_DEAD_3	0x40	/* - We need to reap dead keys */
185#define KEY_GC_FOUND_DEAD_KEY	0x80	/* - We found at least one dead key */
186
187	struct rb_node *cursor;
188	struct key *key;
189	time_t new_timer, limit;
190
191	kenter("[%lx,%x]", key_gc_flags, gc_state);
192
193	limit = current_kernel_time().tv_sec;
194	if (limit > key_gc_delay)
195		limit -= key_gc_delay;
196	else
197		limit = key_gc_delay;
198
199	/* Work out what we're going to be doing in this pass */
200	gc_state &= KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2;
201	gc_state <<= 1;
202	if (test_and_clear_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags))
203		gc_state |= KEY_GC_REAPING_LINKS | KEY_GC_SET_TIMER;
204
205	if (test_and_clear_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags))
206		gc_state |= KEY_GC_REAPING_DEAD_1;
207	kdebug("new pass %x", gc_state);
208
209	new_timer = LONG_MAX;
210
211	/* As only this function is permitted to remove things from the key
212	 * serial tree, if cursor is non-NULL then it will always point to a
213	 * valid node in the tree - even if lock got dropped.
214	 */
215	spin_lock(&key_serial_lock);
216	cursor = rb_first(&key_serial_tree);
217
218continue_scanning:
219	while (cursor) {
220		key = rb_entry(cursor, struct key, serial_node);
221		cursor = rb_next(cursor);
222
223		if (atomic_read(&key->usage) == 0)
224			goto found_unreferenced_key;
225
226		if (unlikely(gc_state & KEY_GC_REAPING_DEAD_1)) {
227			if (key->type == key_gc_dead_keytype) {
228				gc_state |= KEY_GC_FOUND_DEAD_KEY;
229				set_bit(KEY_FLAG_DEAD, &key->flags);
230				key->perm = 0;
231				goto skip_dead_key;
232			}
233		}
234
235		if (gc_state & KEY_GC_SET_TIMER) {
236			if (key->expiry > limit && key->expiry < new_timer) {
237				kdebug("will expire %x in %ld",
238				       key_serial(key), key->expiry - limit);
239				new_timer = key->expiry;
240			}
241		}
242
243		if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2))
244			if (key->type == key_gc_dead_keytype)
245				gc_state |= KEY_GC_FOUND_DEAD_KEY;
246
247		if ((gc_state & KEY_GC_REAPING_LINKS) ||
248		    unlikely(gc_state & KEY_GC_REAPING_DEAD_2)) {
249			if (key->type == &key_type_keyring)
250				goto found_keyring;
251		}
252
253		if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3))
254			if (key->type == key_gc_dead_keytype)
255				goto destroy_dead_key;
256
257	skip_dead_key:
258		if (spin_is_contended(&key_serial_lock) || need_resched())
259			goto contended;
260	}
261
262contended:
263	spin_unlock(&key_serial_lock);
264
265maybe_resched:
266	if (cursor) {
267		cond_resched();
268		spin_lock(&key_serial_lock);
269		goto continue_scanning;
270	}
271
272	/* We've completed the pass.  Set the timer if we need to and queue a
273	 * new cycle if necessary.  We keep executing cycles until we find one
274	 * where we didn't reap any keys.
275	 */
276	kdebug("pass complete");
277
278	if (gc_state & KEY_GC_SET_TIMER && new_timer != (time_t)LONG_MAX) {
279		new_timer += key_gc_delay;
280		key_schedule_gc(new_timer);
281	}
282
283	if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2) ||
284	    !list_empty(&graveyard)) {
285		/* Make sure that all pending keyring payload destructions are
286		 * fulfilled and that people aren't now looking at dead or
287		 * dying keys that they don't have a reference upon or a link
288		 * to.
289		 */
290		kdebug("gc sync");
291		synchronize_rcu();
292	}
293
294	if (!list_empty(&graveyard)) {
295		kdebug("gc keys");
296		key_gc_unused_keys(&graveyard);
297	}
298
299	if (unlikely(gc_state & (KEY_GC_REAPING_DEAD_1 |
300				 KEY_GC_REAPING_DEAD_2))) {
301		if (!(gc_state & KEY_GC_FOUND_DEAD_KEY)) {
302			/* No remaining dead keys: short circuit the remaining
303			 * keytype reap cycles.
304			 */
305			kdebug("dead short");
306			gc_state &= ~(KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2);
307			gc_state |= KEY_GC_REAPING_DEAD_3;
308		} else {
309			gc_state |= KEY_GC_REAP_AGAIN;
310		}
311	}
312
313	if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3)) {
314		kdebug("dead wake");
315		smp_mb();
316		clear_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
317		wake_up_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE);
318	}
319
320	if (gc_state & KEY_GC_REAP_AGAIN)
321		schedule_work(&key_gc_work);
322	kleave(" [end %x]", gc_state);
323	return;
324
325	/* We found an unreferenced key - once we've removed it from the tree,
326	 * we can safely drop the lock.
327	 */
328found_unreferenced_key:
329	kdebug("unrefd key %d", key->serial);
330	rb_erase(&key->serial_node, &key_serial_tree);
331	spin_unlock(&key_serial_lock);
332
333	list_add_tail(&key->graveyard_link, &graveyard);
334	gc_state |= KEY_GC_REAP_AGAIN;
335	goto maybe_resched;
336
337	/* We found a keyring and we need to check the payload for links to
338	 * dead or expired keys.  We don't flag another reap immediately as we
339	 * have to wait for the old payload to be destroyed by RCU before we
340	 * can reap the keys to which it refers.
341	 */
342found_keyring:
343	spin_unlock(&key_serial_lock);
344	keyring_gc(key, limit);
345	goto maybe_resched;
346
347	/* We found a dead key that is still referenced.  Reset its type and
348	 * destroy its payload with its semaphore held.
349	 */
350destroy_dead_key:
351	spin_unlock(&key_serial_lock);
352	kdebug("destroy key %d", key->serial);
353	down_write(&key->sem);
354	key->type = &key_type_dead;
355	if (key_gc_dead_keytype->destroy)
356		key_gc_dead_keytype->destroy(key);
357	memset(&key->payload, KEY_DESTROY, sizeof(key->payload));
358	up_write(&key->sem);
359	goto maybe_resched;
360}
361