1/* Keyring handling
   2 *
   3 * Copyright (C) 2004-2005, 2008, 2013 Red Hat, Inc. All Rights Reserved.
   4 * Written by David Howells (dhowells@redhat.com)
   5 *
   6 * This program is free software; you can redistribute it and/or
   7 * modify it under the terms of the GNU General Public License
   8 * as published by the Free Software Foundation; either version
   9 * 2 of the License, or (at your option) any later version.
  10 */
  11
  12#include <linux/module.h>
  13#include <linux/init.h>
  14#include <linux/sched.h>
  15#include <linux/slab.h>
  16#include <linux/security.h>
  17#include <linux/seq_file.h>
  18#include <linux/err.h>
  19#include <keys/keyring-type.h>
  20#include <keys/user-type.h>
  21#include <linux/assoc_array_priv.h>
  22#include <linux/uaccess.h>
  23#include "internal.h"
  24
  25/*
  26 * When plumbing the depths of the key tree, this sets a hard limit
  27 * set on how deep we're willing to go.
  28 */
  29#define KEYRING_SEARCH_MAX_DEPTH 6
  30
  31/*
  32 * We keep all named keyrings in a hash to speed looking them up.
  33 */
  34#define KEYRING_NAME_HASH_SIZE	(1 << 5)
  35
  36/*
  37 * We mark pointers we pass to the associative array with bit 1 set if
  38 * they're keyrings and clear otherwise.
  39 */
  40#define KEYRING_PTR_SUBTYPE	0x2UL
  41
  42static inline bool keyring_ptr_is_keyring(const struct assoc_array_ptr *x)
  43{
  44	return (unsigned long)x & KEYRING_PTR_SUBTYPE;
  45}
  46static inline struct key *keyring_ptr_to_key(const struct assoc_array_ptr *x)
  47{
  48	void *object = assoc_array_ptr_to_leaf(x);
  49	return (struct key *)((unsigned long)object & ~KEYRING_PTR_SUBTYPE);
  50}
  51static inline void *keyring_key_to_ptr(struct key *key)
  52{
  53	if (key->type == &key_type_keyring)
  54		return (void *)((unsigned long)key | KEYRING_PTR_SUBTYPE);
  55	return key;
  56}
  57
  58static struct list_head	keyring_name_hash[KEYRING_NAME_HASH_SIZE];
  59static DEFINE_RWLOCK(keyring_name_lock);
  60
  61static inline unsigned keyring_hash(const char *desc)
  62{
  63	unsigned bucket = 0;
  64
  65	for (; *desc; desc++)
  66		bucket += (unsigned char)*desc;
  67
  68	return bucket & (KEYRING_NAME_HASH_SIZE - 1);
  69}
  70
  71/*
  72 * The keyring key type definition.  Keyrings are simply keys of this type and
  73 * can be treated as ordinary keys in addition to having their own special
  74 * operations.
  75 */
 
 
  76static int keyring_instantiate(struct key *keyring,
  77			       struct key_preparsed_payload *prep);
  78static void keyring_revoke(struct key *keyring);
  79static void keyring_destroy(struct key *keyring);
  80static void keyring_describe(const struct key *keyring, struct seq_file *m);
  81static long keyring_read(const struct key *keyring,
  82			 char __user *buffer, size_t buflen);
  83
  84struct key_type key_type_keyring = {
  85	.name		= "keyring",
  86	.def_datalen	= 0,
 
 
  87	.instantiate	= keyring_instantiate,
  88	.match		= user_match,
  89	.revoke		= keyring_revoke,
  90	.destroy	= keyring_destroy,
  91	.describe	= keyring_describe,
  92	.read		= keyring_read,
  93};
  94EXPORT_SYMBOL(key_type_keyring);
  95
  96/*
  97 * Semaphore to serialise link/link calls to prevent two link calls in parallel
  98 * introducing a cycle.
  99 */
 100static DECLARE_RWSEM(keyring_serialise_link_sem);
 101
 102/*
 103 * Publish the name of a keyring so that it can be found by name (if it has
 104 * one).
 105 */
 106static void keyring_publish_name(struct key *keyring)
 107{
 108	int bucket;
 109
 110	if (keyring->description) {
 111		bucket = keyring_hash(keyring->description);
 112
 113		write_lock(&keyring_name_lock);
 114
 115		if (!keyring_name_hash[bucket].next)
 116			INIT_LIST_HEAD(&keyring_name_hash[bucket]);
 117
 118		list_add_tail(&keyring->type_data.link,
 119			      &keyring_name_hash[bucket]);
 120
 121		write_unlock(&keyring_name_lock);
 122	}
 123}
 124
 125/*
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 126 * Initialise a keyring.
 127 *
 128 * Returns 0 on success, -EINVAL if given any data.
 129 */
 130static int keyring_instantiate(struct key *keyring,
 131			       struct key_preparsed_payload *prep)
 132{
 133	int ret;
 134
 135	ret = -EINVAL;
 136	if (prep->datalen == 0) {
 137		assoc_array_init(&keyring->keys);
 138		/* make the keyring available by name if it has one */
 139		keyring_publish_name(keyring);
 140		ret = 0;
 141	}
 142
 143	return ret;
 144}
 145
 146/*
 147 * Multiply 64-bits by 32-bits to 96-bits and fold back to 64-bit.  Ideally we'd
 148 * fold the carry back too, but that requires inline asm.
 149 */
 150static u64 mult_64x32_and_fold(u64 x, u32 y)
 151{
 152	u64 hi = (u64)(u32)(x >> 32) * y;
 153	u64 lo = (u64)(u32)(x) * y;
 154	return lo + ((u64)(u32)hi << 32) + (u32)(hi >> 32);
 155}
 156
 157/*
 158 * Hash a key type and description.
 159 */
 160static unsigned long hash_key_type_and_desc(const struct keyring_index_key *index_key)
 161{
 162	const unsigned level_shift = ASSOC_ARRAY_LEVEL_STEP;
 163	const unsigned long fan_mask = ASSOC_ARRAY_FAN_MASK;
 164	const char *description = index_key->description;
 165	unsigned long hash, type;
 166	u32 piece;
 167	u64 acc;
 168	int n, desc_len = index_key->desc_len;
 169
 170	type = (unsigned long)index_key->type;
 171
 172	acc = mult_64x32_and_fold(type, desc_len + 13);
 173	acc = mult_64x32_and_fold(acc, 9207);
 174	for (;;) {
 175		n = desc_len;
 176		if (n <= 0)
 177			break;
 178		if (n > 4)
 179			n = 4;
 180		piece = 0;
 181		memcpy(&piece, description, n);
 182		description += n;
 183		desc_len -= n;
 184		acc = mult_64x32_and_fold(acc, piece);
 185		acc = mult_64x32_and_fold(acc, 9207);
 186	}
 187
 188	/* Fold the hash down to 32 bits if need be. */
 189	hash = acc;
 190	if (ASSOC_ARRAY_KEY_CHUNK_SIZE == 32)
 191		hash ^= acc >> 32;
 192
 193	/* Squidge all the keyrings into a separate part of the tree to
 194	 * ordinary keys by making sure the lowest level segment in the hash is
 195	 * zero for keyrings and non-zero otherwise.
 196	 */
 197	if (index_key->type != &key_type_keyring && (hash & fan_mask) == 0)
 198		return hash | (hash >> (ASSOC_ARRAY_KEY_CHUNK_SIZE - level_shift)) | 1;
 199	if (index_key->type == &key_type_keyring && (hash & fan_mask) != 0)
 200		return (hash + (hash << level_shift)) & ~fan_mask;
 201	return hash;
 202}
 203
 204/*
 205 * Build the next index key chunk.
 206 *
 207 * On 32-bit systems the index key is laid out as:
 208 *
 209 *	0	4	5	9...
 210 *	hash	desclen	typeptr	desc[]
 211 *
 212 * On 64-bit systems:
 213 *
 214 *	0	8	9	17...
 215 *	hash	desclen	typeptr	desc[]
 216 *
 217 * We return it one word-sized chunk at a time.
 218 */
 219static unsigned long keyring_get_key_chunk(const void *data, int level)
 220{
 221	const struct keyring_index_key *index_key = data;
 222	unsigned long chunk = 0;
 223	long offset = 0;
 224	int desc_len = index_key->desc_len, n = sizeof(chunk);
 225
 226	level /= ASSOC_ARRAY_KEY_CHUNK_SIZE;
 227	switch (level) {
 228	case 0:
 229		return hash_key_type_and_desc(index_key);
 230	case 1:
 231		return ((unsigned long)index_key->type << 8) | desc_len;
 232	case 2:
 233		if (desc_len == 0)
 234			return (u8)((unsigned long)index_key->type >>
 235				    (ASSOC_ARRAY_KEY_CHUNK_SIZE - 8));
 236		n--;
 237		offset = 1;
 238	default:
 239		offset += sizeof(chunk) - 1;
 240		offset += (level - 3) * sizeof(chunk);
 241		if (offset >= desc_len)
 242			return 0;
 243		desc_len -= offset;
 244		if (desc_len > n)
 245			desc_len = n;
 246		offset += desc_len;
 247		do {
 248			chunk <<= 8;
 249			chunk |= ((u8*)index_key->description)[--offset];
 250		} while (--desc_len > 0);
 251
 252		if (level == 2) {
 253			chunk <<= 8;
 254			chunk |= (u8)((unsigned long)index_key->type >>
 255				      (ASSOC_ARRAY_KEY_CHUNK_SIZE - 8));
 256		}
 257		return chunk;
 258	}
 259}
 260
 261static unsigned long keyring_get_object_key_chunk(const void *object, int level)
 262{
 263	const struct key *key = keyring_ptr_to_key(object);
 264	return keyring_get_key_chunk(&key->index_key, level);
 265}
 266
 267static bool keyring_compare_object(const void *object, const void *data)
 268{
 269	const struct keyring_index_key *index_key = data;
 270	const struct key *key = keyring_ptr_to_key(object);
 271
 272	return key->index_key.type == index_key->type &&
 273		key->index_key.desc_len == index_key->desc_len &&
 274		memcmp(key->index_key.description, index_key->description,
 275		       index_key->desc_len) == 0;
 276}
 277
 278/*
 279 * Compare the index keys of a pair of objects and determine the bit position
 280 * at which they differ - if they differ.
 281 */
 282static int keyring_diff_objects(const void *object, const void *data)
 283{
 284	const struct key *key_a = keyring_ptr_to_key(object);
 285	const struct keyring_index_key *a = &key_a->index_key;
 286	const struct keyring_index_key *b = data;
 287	unsigned long seg_a, seg_b;
 288	int level, i;
 289
 290	level = 0;
 291	seg_a = hash_key_type_and_desc(a);
 292	seg_b = hash_key_type_and_desc(b);
 293	if ((seg_a ^ seg_b) != 0)
 294		goto differ;
 295
 296	/* The number of bits contributed by the hash is controlled by a
 297	 * constant in the assoc_array headers.  Everything else thereafter we
 298	 * can deal with as being machine word-size dependent.
 299	 */
 300	level += ASSOC_ARRAY_KEY_CHUNK_SIZE / 8;
 301	seg_a = a->desc_len;
 302	seg_b = b->desc_len;
 303	if ((seg_a ^ seg_b) != 0)
 304		goto differ;
 305
 306	/* The next bit may not work on big endian */
 307	level++;
 308	seg_a = (unsigned long)a->type;
 309	seg_b = (unsigned long)b->type;
 310	if ((seg_a ^ seg_b) != 0)
 311		goto differ;
 312
 313	level += sizeof(unsigned long);
 314	if (a->desc_len == 0)
 315		goto same;
 316
 317	i = 0;
 318	if (((unsigned long)a->description | (unsigned long)b->description) &
 319	    (sizeof(unsigned long) - 1)) {
 320		do {
 321			seg_a = *(unsigned long *)(a->description + i);
 322			seg_b = *(unsigned long *)(b->description + i);
 323			if ((seg_a ^ seg_b) != 0)
 324				goto differ_plus_i;
 325			i += sizeof(unsigned long);
 326		} while (i < (a->desc_len & (sizeof(unsigned long) - 1)));
 327	}
 328
 329	for (; i < a->desc_len; i++) {
 330		seg_a = *(unsigned char *)(a->description + i);
 331		seg_b = *(unsigned char *)(b->description + i);
 332		if ((seg_a ^ seg_b) != 0)
 333			goto differ_plus_i;
 334	}
 335
 336same:
 337	return -1;
 338
 339differ_plus_i:
 340	level += i;
 341differ:
 342	i = level * 8 + __ffs(seg_a ^ seg_b);
 343	return i;
 344}
 345
 346/*
 347 * Free an object after stripping the keyring flag off of the pointer.
 348 */
 349static void keyring_free_object(void *object)
 350{
 351	key_put(keyring_ptr_to_key(object));
 352}
 353
 354/*
 355 * Operations for keyring management by the index-tree routines.
 356 */
 357static const struct assoc_array_ops keyring_assoc_array_ops = {
 358	.get_key_chunk		= keyring_get_key_chunk,
 359	.get_object_key_chunk	= keyring_get_object_key_chunk,
 360	.compare_object		= keyring_compare_object,
 361	.diff_objects		= keyring_diff_objects,
 362	.free_object		= keyring_free_object,
 363};
 364
 365/*
 366 * Clean up a keyring when it is destroyed.  Unpublish its name if it had one
 367 * and dispose of its data.
 368 *
 369 * The garbage collector detects the final key_put(), removes the keyring from
 370 * the serial number tree and then does RCU synchronisation before coming here,
 371 * so we shouldn't need to worry about code poking around here with the RCU
 372 * readlock held by this time.
 373 */
 374static void keyring_destroy(struct key *keyring)
 375{
 376	if (keyring->description) {
 377		write_lock(&keyring_name_lock);
 378
 379		if (keyring->type_data.link.next != NULL &&
 380		    !list_empty(&keyring->type_data.link))
 381			list_del(&keyring->type_data.link);
 382
 383		write_unlock(&keyring_name_lock);
 384	}
 385
 386	assoc_array_destroy(&keyring->keys, &keyring_assoc_array_ops);
 387}
 388
 389/*
 390 * Describe a keyring for /proc.
 391 */
 392static void keyring_describe(const struct key *keyring, struct seq_file *m)
 393{
 394	if (keyring->description)
 395		seq_puts(m, keyring->description);
 396	else
 397		seq_puts(m, "[anon]");
 398
 399	if (key_is_instantiated(keyring)) {
 400		if (keyring->keys.nr_leaves_on_tree != 0)
 401			seq_printf(m, ": %lu", keyring->keys.nr_leaves_on_tree);
 402		else
 403			seq_puts(m, ": empty");
 404	}
 405}
 406
 407struct keyring_read_iterator_context {
 408	size_t			qty;
 409	size_t			count;
 410	key_serial_t __user	*buffer;
 411};
 412
 413static int keyring_read_iterator(const void *object, void *data)
 414{
 415	struct keyring_read_iterator_context *ctx = data;
 416	const struct key *key = keyring_ptr_to_key(object);
 417	int ret;
 418
 419	kenter("{%s,%d},,{%zu/%zu}",
 420	       key->type->name, key->serial, ctx->count, ctx->qty);
 421
 422	if (ctx->count >= ctx->qty)
 423		return 1;
 424
 425	ret = put_user(key->serial, ctx->buffer);
 426	if (ret < 0)
 427		return ret;
 428	ctx->buffer++;
 429	ctx->count += sizeof(key->serial);
 430	return 0;
 431}
 432
 433/*
 434 * Read a list of key IDs from the keyring's contents in binary form
 435 *
 436 * The keyring's semaphore is read-locked by the caller.  This prevents someone
 437 * from modifying it under us - which could cause us to read key IDs multiple
 438 * times.
 439 */
 440static long keyring_read(const struct key *keyring,
 441			 char __user *buffer, size_t buflen)
 442{
 443	struct keyring_read_iterator_context ctx;
 444	unsigned long nr_keys;
 445	int ret;
 446
 447	kenter("{%d},,%zu", key_serial(keyring), buflen);
 448
 449	if (buflen & (sizeof(key_serial_t) - 1))
 450		return -EINVAL;
 451
 452	nr_keys = keyring->keys.nr_leaves_on_tree;
 453	if (nr_keys == 0)
 454		return 0;
 455
 456	/* Calculate how much data we could return */
 457	ctx.qty = nr_keys * sizeof(key_serial_t);
 458
 459	if (!buffer || !buflen)
 460		return ctx.qty;
 461
 462	if (buflen > ctx.qty)
 463		ctx.qty = buflen;
 464
 465	/* Copy the IDs of the subscribed keys into the buffer */
 466	ctx.buffer = (key_serial_t __user *)buffer;
 467	ctx.count = 0;
 468	ret = assoc_array_iterate(&keyring->keys, keyring_read_iterator, &ctx);
 469	if (ret < 0) {
 470		kleave(" = %d [iterate]", ret);
 471		return ret;
 472	}
 473
 474	kleave(" = %zu [ok]", ctx.count);
 475	return ctx.count;
 476}
 477
 478/*
 479 * Allocate a keyring and link into the destination keyring.
 480 */
 481struct key *keyring_alloc(const char *description, kuid_t uid, kgid_t gid,
 482			  const struct cred *cred, key_perm_t perm,
 483			  unsigned long flags, struct key *dest)
 
 
 
 
 484{
 485	struct key *keyring;
 486	int ret;
 487
 488	keyring = key_alloc(&key_type_keyring, description,
 489			    uid, gid, cred, perm, flags);
 490	if (!IS_ERR(keyring)) {
 491		ret = key_instantiate_and_link(keyring, NULL, 0, dest, NULL);
 492		if (ret < 0) {
 493			key_put(keyring);
 494			keyring = ERR_PTR(ret);
 495		}
 496	}
 497
 498	return keyring;
 499}
 500EXPORT_SYMBOL(keyring_alloc);
 501
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 502/*
 503 * Iteration function to consider each key found.
 504 */
 505static int keyring_search_iterator(const void *object, void *iterator_data)
 506{
 507	struct keyring_search_context *ctx = iterator_data;
 508	const struct key *key = keyring_ptr_to_key(object);
 509	unsigned long kflags = key->flags;
 510
 511	kenter("{%d}", key->serial);
 512
 513	/* ignore keys not of this type */
 514	if (key->type != ctx->index_key.type) {
 515		kleave(" = 0 [!type]");
 516		return 0;
 517	}
 518
 519	/* skip invalidated, revoked and expired keys */
 520	if (ctx->flags & KEYRING_SEARCH_DO_STATE_CHECK) {
 521		if (kflags & ((1 << KEY_FLAG_INVALIDATED) |
 522			      (1 << KEY_FLAG_REVOKED))) {
 523			ctx->result = ERR_PTR(-EKEYREVOKED);
 524			kleave(" = %d [invrev]", ctx->skipped_ret);
 525			goto skipped;
 526		}
 527
 528		if (key->expiry && ctx->now.tv_sec >= key->expiry) {
 529			ctx->result = ERR_PTR(-EKEYEXPIRED);
 
 530			kleave(" = %d [expire]", ctx->skipped_ret);
 531			goto skipped;
 532		}
 533	}
 534
 535	/* keys that don't match */
 536	if (!ctx->match(key, ctx->match_data)) {
 537		kleave(" = 0 [!match]");
 538		return 0;
 539	}
 540
 541	/* key must have search permissions */
 542	if (!(ctx->flags & KEYRING_SEARCH_NO_CHECK_PERM) &&
 543	    key_task_permission(make_key_ref(key, ctx->possessed),
 544				ctx->cred, KEY_SEARCH) < 0) {
 545		ctx->result = ERR_PTR(-EACCES);
 546		kleave(" = %d [!perm]", ctx->skipped_ret);
 547		goto skipped;
 548	}
 549
 550	if (ctx->flags & KEYRING_SEARCH_DO_STATE_CHECK) {
 551		/* we set a different error code if we pass a negative key */
 552		if (kflags & (1 << KEY_FLAG_NEGATIVE)) {
 553			smp_rmb();
 554			ctx->result = ERR_PTR(key->type_data.reject_error);
 555			kleave(" = %d [neg]", ctx->skipped_ret);
 556			goto skipped;
 557		}
 558	}
 559
 560	/* Found */
 561	ctx->result = make_key_ref(key, ctx->possessed);
 562	kleave(" = 1 [found]");
 563	return 1;
 564
 565skipped:
 566	return ctx->skipped_ret;
 567}
 568
 569/*
 570 * Search inside a keyring for a key.  We can search by walking to it
 571 * directly based on its index-key or we can iterate over the entire
 572 * tree looking for it, based on the match function.
 573 */
 574static int search_keyring(struct key *keyring, struct keyring_search_context *ctx)
 575{
 576	if ((ctx->flags & KEYRING_SEARCH_LOOKUP_TYPE) ==
 577	    KEYRING_SEARCH_LOOKUP_DIRECT) {
 578		const void *object;
 579
 580		object = assoc_array_find(&keyring->keys,
 581					  &keyring_assoc_array_ops,
 582					  &ctx->index_key);
 583		return object ? ctx->iterator(object, ctx) : 0;
 584	}
 585	return assoc_array_iterate(&keyring->keys, ctx->iterator, ctx);
 586}
 587
 588/*
 589 * Search a tree of keyrings that point to other keyrings up to the maximum
 590 * depth.
 591 */
 592static bool search_nested_keyrings(struct key *keyring,
 593				   struct keyring_search_context *ctx)
 594{
 595	struct {
 596		struct key *keyring;
 597		struct assoc_array_node *node;
 598		int slot;
 599	} stack[KEYRING_SEARCH_MAX_DEPTH];
 600
 601	struct assoc_array_shortcut *shortcut;
 602	struct assoc_array_node *node;
 603	struct assoc_array_ptr *ptr;
 604	struct key *key;
 605	int sp = 0, slot;
 606
 607	kenter("{%d},{%s,%s}",
 608	       keyring->serial,
 609	       ctx->index_key.type->name,
 610	       ctx->index_key.description);
 611
 
 
 
 
 612	if (ctx->index_key.description)
 613		ctx->index_key.desc_len = strlen(ctx->index_key.description);
 614
 615	/* Check to see if this top-level keyring is what we are looking for
 616	 * and whether it is valid or not.
 617	 */
 618	if (ctx->flags & KEYRING_SEARCH_LOOKUP_ITERATE ||
 619	    keyring_compare_object(keyring, &ctx->index_key)) {
 620		ctx->skipped_ret = 2;
 621		ctx->flags |= KEYRING_SEARCH_DO_STATE_CHECK;
 622		switch (ctx->iterator(keyring_key_to_ptr(keyring), ctx)) {
 623		case 1:
 624			goto found;
 625		case 2:
 626			return false;
 627		default:
 628			break;
 629		}
 630	}
 631
 632	ctx->skipped_ret = 0;
 633	if (ctx->flags & KEYRING_SEARCH_NO_STATE_CHECK)
 634		ctx->flags &= ~KEYRING_SEARCH_DO_STATE_CHECK;
 635
 636	/* Start processing a new keyring */
 637descend_to_keyring:
 638	kdebug("descend to %d", keyring->serial);
 639	if (keyring->flags & ((1 << KEY_FLAG_INVALIDATED) |
 640			      (1 << KEY_FLAG_REVOKED)))
 641		goto not_this_keyring;
 642
 643	/* Search through the keys in this keyring before its searching its
 644	 * subtrees.
 645	 */
 646	if (search_keyring(keyring, ctx))
 647		goto found;
 648
 649	/* Then manually iterate through the keyrings nested in this one.
 650	 *
 651	 * Start from the root node of the index tree.  Because of the way the
 652	 * hash function has been set up, keyrings cluster on the leftmost
 653	 * branch of the root node (root slot 0) or in the root node itself.
 654	 * Non-keyrings avoid the leftmost branch of the root entirely (root
 655	 * slots 1-15).
 656	 */
 657	ptr = ACCESS_ONCE(keyring->keys.root);
 658	if (!ptr)
 659		goto not_this_keyring;
 660
 661	if (assoc_array_ptr_is_shortcut(ptr)) {
 662		/* If the root is a shortcut, either the keyring only contains
 663		 * keyring pointers (everything clusters behind root slot 0) or
 664		 * doesn't contain any keyring pointers.
 665		 */
 666		shortcut = assoc_array_ptr_to_shortcut(ptr);
 667		smp_read_barrier_depends();
 668		if ((shortcut->index_key[0] & ASSOC_ARRAY_FAN_MASK) != 0)
 669			goto not_this_keyring;
 670
 671		ptr = ACCESS_ONCE(shortcut->next_node);
 672		node = assoc_array_ptr_to_node(ptr);
 673		goto begin_node;
 674	}
 675
 676	node = assoc_array_ptr_to_node(ptr);
 677	smp_read_barrier_depends();
 678
 679	ptr = node->slots[0];
 680	if (!assoc_array_ptr_is_meta(ptr))
 681		goto begin_node;
 682
 683descend_to_node:
 684	/* Descend to a more distal node in this keyring's content tree and go
 685	 * through that.
 686	 */
 687	kdebug("descend");
 688	if (assoc_array_ptr_is_shortcut(ptr)) {
 689		shortcut = assoc_array_ptr_to_shortcut(ptr);
 690		smp_read_barrier_depends();
 691		ptr = ACCESS_ONCE(shortcut->next_node);
 692		BUG_ON(!assoc_array_ptr_is_node(ptr));
 693	}
 694	node = assoc_array_ptr_to_node(ptr);
 695
 696begin_node:
 697	kdebug("begin_node");
 698	smp_read_barrier_depends();
 699	slot = 0;
 700ascend_to_node:
 701	/* Go through the slots in a node */
 702	for (; slot < ASSOC_ARRAY_FAN_OUT; slot++) {
 703		ptr = ACCESS_ONCE(node->slots[slot]);
 704
 705		if (assoc_array_ptr_is_meta(ptr) && node->back_pointer)
 706			goto descend_to_node;
 707
 708		if (!keyring_ptr_is_keyring(ptr))
 709			continue;
 710
 711		key = keyring_ptr_to_key(ptr);
 712
 713		if (sp >= KEYRING_SEARCH_MAX_DEPTH) {
 714			if (ctx->flags & KEYRING_SEARCH_DETECT_TOO_DEEP) {
 715				ctx->result = ERR_PTR(-ELOOP);
 716				return false;
 717			}
 718			goto not_this_keyring;
 719		}
 720
 721		/* Search a nested keyring */
 722		if (!(ctx->flags & KEYRING_SEARCH_NO_CHECK_PERM) &&
 723		    key_task_permission(make_key_ref(key, ctx->possessed),
 724					ctx->cred, KEY_SEARCH) < 0)
 725			continue;
 726
 727		/* stack the current position */
 728		stack[sp].keyring = keyring;
 729		stack[sp].node = node;
 730		stack[sp].slot = slot;
 731		sp++;
 732
 733		/* begin again with the new keyring */
 734		keyring = key;
 735		goto descend_to_keyring;
 736	}
 737
 738	/* We've dealt with all the slots in the current node, so now we need
 739	 * to ascend to the parent and continue processing there.
 740	 */
 741	ptr = ACCESS_ONCE(node->back_pointer);
 742	slot = node->parent_slot;
 743
 744	if (ptr && assoc_array_ptr_is_shortcut(ptr)) {
 745		shortcut = assoc_array_ptr_to_shortcut(ptr);
 746		smp_read_barrier_depends();
 747		ptr = ACCESS_ONCE(shortcut->back_pointer);
 748		slot = shortcut->parent_slot;
 749	}
 750	if (!ptr)
 751		goto not_this_keyring;
 752	node = assoc_array_ptr_to_node(ptr);
 753	smp_read_barrier_depends();
 754	slot++;
 755
 756	/* If we've ascended to the root (zero backpointer), we must have just
 757	 * finished processing the leftmost branch rather than the root slots -
 758	 * so there can't be any more keyrings for us to find.
 759	 */
 760	if (node->back_pointer) {
 761		kdebug("ascend %d", slot);
 762		goto ascend_to_node;
 763	}
 764
 765	/* The keyring we're looking at was disqualified or didn't contain a
 766	 * matching key.
 767	 */
 768not_this_keyring:
 769	kdebug("not_this_keyring %d", sp);
 770	if (sp <= 0) {
 771		kleave(" = false");
 772		return false;
 773	}
 774
 775	/* Resume the processing of a keyring higher up in the tree */
 776	sp--;
 777	keyring = stack[sp].keyring;
 778	node = stack[sp].node;
 779	slot = stack[sp].slot + 1;
 780	kdebug("ascend to %d [%d]", keyring->serial, slot);
 781	goto ascend_to_node;
 782
 783	/* We found a viable match */
 784found:
 785	key = key_ref_to_ptr(ctx->result);
 786	key_check(key);
 787	if (!(ctx->flags & KEYRING_SEARCH_NO_UPDATE_TIME)) {
 788		key->last_used_at = ctx->now.tv_sec;
 789		keyring->last_used_at = ctx->now.tv_sec;
 790		while (sp > 0)
 791			stack[--sp].keyring->last_used_at = ctx->now.tv_sec;
 792	}
 793	kleave(" = true");
 794	return true;
 795}
 796
 797/**
 798 * keyring_search_aux - Search a keyring tree for a key matching some criteria
 799 * @keyring_ref: A pointer to the keyring with possession indicator.
 800 * @ctx: The keyring search context.
 801 *
 802 * Search the supplied keyring tree for a key that matches the criteria given.
 803 * The root keyring and any linked keyrings must grant Search permission to the
 804 * caller to be searchable and keys can only be found if they too grant Search
 805 * to the caller. The possession flag on the root keyring pointer controls use
 806 * of the possessor bits in permissions checking of the entire tree.  In
 807 * addition, the LSM gets to forbid keyring searches and key matches.
 808 *
 809 * The search is performed as a breadth-then-depth search up to the prescribed
 810 * limit (KEYRING_SEARCH_MAX_DEPTH).
 811 *
 812 * Keys are matched to the type provided and are then filtered by the match
 813 * function, which is given the description to use in any way it sees fit.  The
 814 * match function may use any attributes of a key that it wishes to to
 815 * determine the match.  Normally the match function from the key type would be
 816 * used.
 817 *
 818 * RCU can be used to prevent the keyring key lists from disappearing without
 819 * the need to take lots of locks.
 820 *
 821 * Returns a pointer to the found key and increments the key usage count if
 822 * successful; -EAGAIN if no matching keys were found, or if expired or revoked
 823 * keys were found; -ENOKEY if only negative keys were found; -ENOTDIR if the
 824 * specified keyring wasn't a keyring.
 825 *
 826 * In the case of a successful return, the possession attribute from
 827 * @keyring_ref is propagated to the returned key reference.
 828 */
 829key_ref_t keyring_search_aux(key_ref_t keyring_ref,
 830			     struct keyring_search_context *ctx)
 831{
 832	struct key *keyring;
 833	long err;
 834
 835	ctx->iterator = keyring_search_iterator;
 836	ctx->possessed = is_key_possessed(keyring_ref);
 837	ctx->result = ERR_PTR(-EAGAIN);
 838
 839	keyring = key_ref_to_ptr(keyring_ref);
 840	key_check(keyring);
 841
 842	if (keyring->type != &key_type_keyring)
 843		return ERR_PTR(-ENOTDIR);
 844
 845	if (!(ctx->flags & KEYRING_SEARCH_NO_CHECK_PERM)) {
 846		err = key_task_permission(keyring_ref, ctx->cred, KEY_SEARCH);
 847		if (err < 0)
 848			return ERR_PTR(err);
 849	}
 850
 851	rcu_read_lock();
 852	ctx->now = current_kernel_time();
 853	if (search_nested_keyrings(keyring, ctx))
 854		__key_get(key_ref_to_ptr(ctx->result));
 855	rcu_read_unlock();
 856	return ctx->result;
 857}
 858
 859/**
 860 * keyring_search - Search the supplied keyring tree for a matching key
 861 * @keyring: The root of the keyring tree to be searched.
 862 * @type: The type of keyring we want to find.
 863 * @description: The name of the keyring we want to find.
 864 *
 865 * As keyring_search_aux() above, but using the current task's credentials and
 866 * type's default matching function and preferred search method.
 867 */
 868key_ref_t keyring_search(key_ref_t keyring,
 869			 struct key_type *type,
 870			 const char *description)
 871{
 872	struct keyring_search_context ctx = {
 873		.index_key.type		= type,
 874		.index_key.description	= description,
 875		.cred			= current_cred(),
 876		.match			= type->match,
 877		.match_data		= description,
 878		.flags			= (type->def_lookup_type |
 879					   KEYRING_SEARCH_DO_STATE_CHECK),
 880	};
 
 
 
 
 
 
 
 
 881
 882	if (!ctx.match)
 883		return ERR_PTR(-ENOKEY);
 884
 885	return keyring_search_aux(keyring, &ctx);
 
 
 886}
 887EXPORT_SYMBOL(keyring_search);
 888
 889/*
 890 * Search the given keyring for a key that might be updated.
 891 *
 892 * The caller must guarantee that the keyring is a keyring and that the
 893 * permission is granted to modify the keyring as no check is made here.  The
 894 * caller must also hold a lock on the keyring semaphore.
 895 *
 896 * Returns a pointer to the found key with usage count incremented if
 897 * successful and returns NULL if not found.  Revoked and invalidated keys are
 898 * skipped over.
 899 *
 900 * If successful, the possession indicator is propagated from the keyring ref
 901 * to the returned key reference.
 902 */
 903key_ref_t find_key_to_update(key_ref_t keyring_ref,
 904			     const struct keyring_index_key *index_key)
 905{
 906	struct key *keyring, *key;
 907	const void *object;
 908
 909	keyring = key_ref_to_ptr(keyring_ref);
 910
 911	kenter("{%d},{%s,%s}",
 912	       keyring->serial, index_key->type->name, index_key->description);
 913
 914	object = assoc_array_find(&keyring->keys, &keyring_assoc_array_ops,
 915				  index_key);
 916
 917	if (object)
 918		goto found;
 919
 920	kleave(" = NULL");
 921	return NULL;
 922
 923found:
 924	key = keyring_ptr_to_key(object);
 925	if (key->flags & ((1 << KEY_FLAG_INVALIDATED) |
 926			  (1 << KEY_FLAG_REVOKED))) {
 927		kleave(" = NULL [x]");
 928		return NULL;
 929	}
 930	__key_get(key);
 931	kleave(" = {%d}", key->serial);
 932	return make_key_ref(key, is_key_possessed(keyring_ref));
 933}
 934
 935/*
 936 * Find a keyring with the specified name.
 937 *
 938 * All named keyrings in the current user namespace are searched, provided they
 939 * grant Search permission directly to the caller (unless this check is
 940 * skipped).  Keyrings whose usage points have reached zero or who have been
 941 * revoked are skipped.
 942 *
 943 * Returns a pointer to the keyring with the keyring's refcount having being
 944 * incremented on success.  -ENOKEY is returned if a key could not be found.
 945 */
 946struct key *find_keyring_by_name(const char *name, bool skip_perm_check)
 947{
 948	struct key *keyring;
 949	int bucket;
 950
 951	if (!name)
 952		return ERR_PTR(-EINVAL);
 953
 954	bucket = keyring_hash(name);
 955
 956	read_lock(&keyring_name_lock);
 957
 958	if (keyring_name_hash[bucket].next) {
 959		/* search this hash bucket for a keyring with a matching name
 960		 * that's readable and that hasn't been revoked */
 961		list_for_each_entry(keyring,
 962				    &keyring_name_hash[bucket],
 963				    type_data.link
 964				    ) {
 965			if (!kuid_has_mapping(current_user_ns(), keyring->user->uid))
 966				continue;
 967
 968			if (test_bit(KEY_FLAG_REVOKED, &keyring->flags))
 969				continue;
 970
 971			if (strcmp(keyring->description, name) != 0)
 972				continue;
 973
 974			if (!skip_perm_check &&
 975			    key_permission(make_key_ref(keyring, 0),
 976					   KEY_SEARCH) < 0)
 977				continue;
 978
 979			/* we've got a match but we might end up racing with
 980			 * key_cleanup() if the keyring is currently 'dead'
 981			 * (ie. it has a zero usage count) */
 982			if (!atomic_inc_not_zero(&keyring->usage))
 983				continue;
 984			keyring->last_used_at = current_kernel_time().tv_sec;
 985			goto out;
 986		}
 987	}
 988
 989	keyring = ERR_PTR(-ENOKEY);
 990out:
 991	read_unlock(&keyring_name_lock);
 992	return keyring;
 993}
 994
 995static int keyring_detect_cycle_iterator(const void *object,
 996					 void *iterator_data)
 997{
 998	struct keyring_search_context *ctx = iterator_data;
 999	const struct key *key = keyring_ptr_to_key(object);
1000
1001	kenter("{%d}", key->serial);
1002
1003	/* We might get a keyring with matching index-key that is nonetheless a
1004	 * different keyring. */
1005	if (key != ctx->match_data)
1006		return 0;
1007
1008	ctx->result = ERR_PTR(-EDEADLK);
1009	return 1;
1010}
1011
1012/*
1013 * See if a cycle will will be created by inserting acyclic tree B in acyclic
1014 * tree A at the topmost level (ie: as a direct child of A).
1015 *
1016 * Since we are adding B to A at the top level, checking for cycles should just
1017 * be a matter of seeing if node A is somewhere in tree B.
1018 */
1019static int keyring_detect_cycle(struct key *A, struct key *B)
1020{
1021	struct keyring_search_context ctx = {
1022		.index_key	= A->index_key,
1023		.match_data	= A,
1024		.iterator	= keyring_detect_cycle_iterator,
1025		.flags		= (KEYRING_SEARCH_LOOKUP_DIRECT |
1026				   KEYRING_SEARCH_NO_STATE_CHECK |
1027				   KEYRING_SEARCH_NO_UPDATE_TIME |
1028				   KEYRING_SEARCH_NO_CHECK_PERM |
1029				   KEYRING_SEARCH_DETECT_TOO_DEEP),
1030	};
1031
1032	rcu_read_lock();
1033	search_nested_keyrings(B, &ctx);
1034	rcu_read_unlock();
1035	return PTR_ERR(ctx.result) == -EAGAIN ? 0 : PTR_ERR(ctx.result);
1036}
1037
1038/*
1039 * Preallocate memory so that a key can be linked into to a keyring.
1040 */
1041int __key_link_begin(struct key *keyring,
1042		     const struct keyring_index_key *index_key,
1043		     struct assoc_array_edit **_edit)
1044	__acquires(&keyring->sem)
1045	__acquires(&keyring_serialise_link_sem)
1046{
1047	struct assoc_array_edit *edit;
1048	int ret;
1049
1050	kenter("%d,%s,%s,",
1051	       keyring->serial, index_key->type->name, index_key->description);
1052
1053	BUG_ON(index_key->desc_len == 0);
1054
1055	if (keyring->type != &key_type_keyring)
1056		return -ENOTDIR;
1057
1058	down_write(&keyring->sem);
1059
1060	ret = -EKEYREVOKED;
1061	if (test_bit(KEY_FLAG_REVOKED, &keyring->flags))
1062		goto error_krsem;
1063
1064	/* serialise link/link calls to prevent parallel calls causing a cycle
1065	 * when linking two keyring in opposite orders */
1066	if (index_key->type == &key_type_keyring)
1067		down_write(&keyring_serialise_link_sem);
1068
1069	/* Create an edit script that will insert/replace the key in the
1070	 * keyring tree.
1071	 */
1072	edit = assoc_array_insert(&keyring->keys,
1073				  &keyring_assoc_array_ops,
1074				  index_key,
1075				  NULL);
1076	if (IS_ERR(edit)) {
1077		ret = PTR_ERR(edit);
1078		goto error_sem;
1079	}
1080
1081	/* If we're not replacing a link in-place then we're going to need some
1082	 * extra quota.
1083	 */
1084	if (!edit->dead_leaf) {
1085		ret = key_payload_reserve(keyring,
1086					  keyring->datalen + KEYQUOTA_LINK_BYTES);
1087		if (ret < 0)
1088			goto error_cancel;
1089	}
1090
1091	*_edit = edit;
1092	kleave(" = 0");
1093	return 0;
1094
1095error_cancel:
1096	assoc_array_cancel_edit(edit);
1097error_sem:
1098	if (index_key->type == &key_type_keyring)
1099		up_write(&keyring_serialise_link_sem);
1100error_krsem:
1101	up_write(&keyring->sem);
1102	kleave(" = %d", ret);
1103	return ret;
1104}
1105
1106/*
1107 * Check already instantiated keys aren't going to be a problem.
1108 *
1109 * The caller must have called __key_link_begin(). Don't need to call this for
1110 * keys that were created since __key_link_begin() was called.
1111 */
1112int __key_link_check_live_key(struct key *keyring, struct key *key)
1113{
1114	if (key->type == &key_type_keyring)
1115		/* check that we aren't going to create a cycle by linking one
1116		 * keyring to another */
1117		return keyring_detect_cycle(keyring, key);
1118	return 0;
1119}
1120
1121/*
1122 * Link a key into to a keyring.
1123 *
1124 * Must be called with __key_link_begin() having being called.  Discards any
1125 * already extant link to matching key if there is one, so that each keyring
1126 * holds at most one link to any given key of a particular type+description
1127 * combination.
1128 */
1129void __key_link(struct key *key, struct assoc_array_edit **_edit)
1130{
1131	__key_get(key);
1132	assoc_array_insert_set_object(*_edit, keyring_key_to_ptr(key));
1133	assoc_array_apply_edit(*_edit);
1134	*_edit = NULL;
1135}
1136
1137/*
1138 * Finish linking a key into to a keyring.
1139 *
1140 * Must be called with __key_link_begin() having being called.
1141 */
1142void __key_link_end(struct key *keyring,
1143		    const struct keyring_index_key *index_key,
1144		    struct assoc_array_edit *edit)
1145	__releases(&keyring->sem)
1146	__releases(&keyring_serialise_link_sem)
1147{
1148	BUG_ON(index_key->type == NULL);
1149	kenter("%d,%s,", keyring->serial, index_key->type->name);
1150
1151	if (index_key->type == &key_type_keyring)
1152		up_write(&keyring_serialise_link_sem);
1153
1154	if (edit && !edit->dead_leaf) {
1155		key_payload_reserve(keyring,
1156				    keyring->datalen - KEYQUOTA_LINK_BYTES);
 
 
1157		assoc_array_cancel_edit(edit);
1158	}
1159	up_write(&keyring->sem);
1160}
1161
 
 
 
 
 
 
 
 
 
 
1162/**
1163 * key_link - Link a key to a keyring
1164 * @keyring: The keyring to make the link in.
1165 * @key: The key to link to.
1166 *
1167 * Make a link in a keyring to a key, such that the keyring holds a reference
1168 * on that key and the key can potentially be found by searching that keyring.
1169 *
1170 * This function will write-lock the keyring's semaphore and will consume some
1171 * of the user's key data quota to hold the link.
1172 *
1173 * Returns 0 if successful, -ENOTDIR if the keyring isn't a keyring,
1174 * -EKEYREVOKED if the keyring has been revoked, -ENFILE if the keyring is
1175 * full, -EDQUOT if there is insufficient key data quota remaining to add
1176 * another link or -ENOMEM if there's insufficient memory.
1177 *
1178 * It is assumed that the caller has checked that it is permitted for a link to
1179 * be made (the keyring should have Write permission and the key Link
1180 * permission).
1181 */
1182int key_link(struct key *keyring, struct key *key)
1183{
1184	struct assoc_array_edit *edit;
1185	int ret;
1186
1187	kenter("{%d,%d}", keyring->serial, atomic_read(&keyring->usage));
1188
1189	key_check(keyring);
1190	key_check(key);
1191
1192	if (test_bit(KEY_FLAG_TRUSTED_ONLY, &keyring->flags) &&
1193	    !test_bit(KEY_FLAG_TRUSTED, &key->flags))
1194		return -EPERM;
1195
1196	ret = __key_link_begin(keyring, &key->index_key, &edit);
1197	if (ret == 0) {
1198		kdebug("begun {%d,%d}", keyring->serial, atomic_read(&keyring->usage));
1199		ret = __key_link_check_live_key(keyring, key);
 
 
1200		if (ret == 0)
1201			__key_link(key, &edit);
1202		__key_link_end(keyring, &key->index_key, edit);
1203	}
1204
1205	kleave(" = %d {%d,%d}", ret, keyring->serial, atomic_read(&keyring->usage));
1206	return ret;
1207}
1208EXPORT_SYMBOL(key_link);
1209
1210/**
1211 * key_unlink - Unlink the first link to a key from a keyring.
1212 * @keyring: The keyring to remove the link from.
1213 * @key: The key the link is to.
1214 *
1215 * Remove a link from a keyring to a key.
1216 *
1217 * This function will write-lock the keyring's semaphore.
1218 *
1219 * Returns 0 if successful, -ENOTDIR if the keyring isn't a keyring, -ENOENT if
1220 * the key isn't linked to by the keyring or -ENOMEM if there's insufficient
1221 * memory.
1222 *
1223 * It is assumed that the caller has checked that it is permitted for a link to
1224 * be removed (the keyring should have Write permission; no permissions are
1225 * required on the key).
1226 */
1227int key_unlink(struct key *keyring, struct key *key)
1228{
1229	struct assoc_array_edit *edit;
1230	int ret;
1231
1232	key_check(keyring);
1233	key_check(key);
1234
1235	if (keyring->type != &key_type_keyring)
1236		return -ENOTDIR;
1237
1238	down_write(&keyring->sem);
1239
1240	edit = assoc_array_delete(&keyring->keys, &keyring_assoc_array_ops,
1241				  &key->index_key);
1242	if (IS_ERR(edit)) {
1243		ret = PTR_ERR(edit);
1244		goto error;
1245	}
1246	ret = -ENOENT;
1247	if (edit == NULL)
1248		goto error;
1249
1250	assoc_array_apply_edit(edit);
1251	key_payload_reserve(keyring, keyring->datalen - KEYQUOTA_LINK_BYTES);
1252	ret = 0;
1253
1254error:
1255	up_write(&keyring->sem);
1256	return ret;
1257}
1258EXPORT_SYMBOL(key_unlink);
1259
1260/**
1261 * keyring_clear - Clear a keyring
1262 * @keyring: The keyring to clear.
1263 *
1264 * Clear the contents of the specified keyring.
1265 *
1266 * Returns 0 if successful or -ENOTDIR if the keyring isn't a keyring.
1267 */
1268int keyring_clear(struct key *keyring)
1269{
1270	struct assoc_array_edit *edit;
1271	int ret;
1272
1273	if (keyring->type != &key_type_keyring)
1274		return -ENOTDIR;
1275
1276	down_write(&keyring->sem);
1277
1278	edit = assoc_array_clear(&keyring->keys, &keyring_assoc_array_ops);
1279	if (IS_ERR(edit)) {
1280		ret = PTR_ERR(edit);
1281	} else {
1282		if (edit)
1283			assoc_array_apply_edit(edit);
1284		key_payload_reserve(keyring, 0);
1285		ret = 0;
1286	}
1287
1288	up_write(&keyring->sem);
1289	return ret;
1290}
1291EXPORT_SYMBOL(keyring_clear);
1292
1293/*
1294 * Dispose of the links from a revoked keyring.
1295 *
1296 * This is called with the key sem write-locked.
1297 */
1298static void keyring_revoke(struct key *keyring)
1299{
1300	struct assoc_array_edit *edit;
1301
1302	edit = assoc_array_clear(&keyring->keys, &keyring_assoc_array_ops);
1303	if (!IS_ERR(edit)) {
1304		if (edit)
1305			assoc_array_apply_edit(edit);
1306		key_payload_reserve(keyring, 0);
1307	}
1308}
1309
1310static bool keyring_gc_select_iterator(void *object, void *iterator_data)
1311{
1312	struct key *key = keyring_ptr_to_key(object);
1313	time_t *limit = iterator_data;
1314
1315	if (key_is_dead(key, *limit))
1316		return false;
1317	key_get(key);
1318	return true;
1319}
1320
1321static int keyring_gc_check_iterator(const void *object, void *iterator_data)
1322{
1323	const struct key *key = keyring_ptr_to_key(object);
1324	time_t *limit = iterator_data;
1325
1326	key_check(key);
1327	return key_is_dead(key, *limit);
1328}
1329
1330/*
1331 * Garbage collect pointers from a keyring.
1332 *
1333 * Not called with any locks held.  The keyring's key struct will not be
1334 * deallocated under us as only our caller may deallocate it.
1335 */
1336void keyring_gc(struct key *keyring, time_t limit)
1337{
1338	int result;
1339
1340	kenter("%x{%s}", keyring->serial, keyring->description ?: "");
1341
1342	if (keyring->flags & ((1 << KEY_FLAG_INVALIDATED) |
1343			      (1 << KEY_FLAG_REVOKED)))
1344		goto dont_gc;
1345
1346	/* scan the keyring looking for dead keys */
1347	rcu_read_lock();
1348	result = assoc_array_iterate(&keyring->keys,
1349				     keyring_gc_check_iterator, &limit);
1350	rcu_read_unlock();
1351	if (result == true)
1352		goto do_gc;
1353
1354dont_gc:
1355	kleave(" [no gc]");
1356	return;
1357
1358do_gc:
1359	down_write(&keyring->sem);
1360	assoc_array_gc(&keyring->keys, &keyring_assoc_array_ops,
1361		       keyring_gc_select_iterator, &limit);
1362	up_write(&keyring->sem);
1363	kleave(" [gc]");
1364}