Loading...
1// SPDX-License-Identifier: GPL-2.0-or-later
2/* Key garbage collector
3 *
4 * Copyright (C) 2009-2011 Red Hat, Inc. All Rights Reserved.
5 * Written by David Howells (dhowells@redhat.com)
6 */
7
8#include <linux/slab.h>
9#include <linux/security.h>
10#include <keys/keyring-type.h>
11#include "internal.h"
12
13/*
14 * Delay between key revocation/expiry in seconds
15 */
16unsigned key_gc_delay = 5 * 60;
17
18/*
19 * Reaper for unused keys.
20 */
21static void key_garbage_collector(struct work_struct *work);
22DECLARE_WORK(key_gc_work, key_garbage_collector);
23
24/*
25 * Reaper for links from keyrings to dead keys.
26 */
27static void key_gc_timer_func(struct timer_list *);
28static DEFINE_TIMER(key_gc_timer, key_gc_timer_func);
29
30static time64_t key_gc_next_run = TIME64_MAX;
31static struct key_type *key_gc_dead_keytype;
32
33static unsigned long key_gc_flags;
34#define KEY_GC_KEY_EXPIRED 0 /* A key expired and needs unlinking */
35#define KEY_GC_REAP_KEYTYPE 1 /* A keytype is being unregistered */
36#define KEY_GC_REAPING_KEYTYPE 2 /* Cleared when keytype reaped */
37
38
39/*
40 * Any key whose type gets unregistered will be re-typed to this if it can't be
41 * immediately unlinked.
42 */
43struct key_type key_type_dead = {
44 .name = ".dead",
45};
46
47/*
48 * Schedule a garbage collection run.
49 * - time precision isn't particularly important
50 */
51void key_schedule_gc(time64_t gc_at)
52{
53 unsigned long expires;
54 time64_t now = ktime_get_real_seconds();
55
56 kenter("%lld", gc_at - now);
57
58 if (gc_at <= now || test_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags)) {
59 kdebug("IMMEDIATE");
60 schedule_work(&key_gc_work);
61 } else if (gc_at < key_gc_next_run) {
62 kdebug("DEFERRED");
63 key_gc_next_run = gc_at;
64 expires = jiffies + (gc_at - now) * HZ;
65 mod_timer(&key_gc_timer, expires);
66 }
67}
68
69/*
70 * Schedule a dead links collection run.
71 */
72void key_schedule_gc_links(void)
73{
74 set_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags);
75 schedule_work(&key_gc_work);
76}
77
78/*
79 * Some key's cleanup time was met after it expired, so we need to get the
80 * reaper to go through a cycle finding expired keys.
81 */
82static void key_gc_timer_func(struct timer_list *unused)
83{
84 kenter("");
85 key_gc_next_run = TIME64_MAX;
86 key_schedule_gc_links();
87}
88
89/*
90 * Reap keys of dead type.
91 *
92 * We use three flags to make sure we see three complete cycles of the garbage
93 * collector: the first to mark keys of that type as being dead, the second to
94 * collect dead links and the third to clean up the dead keys. We have to be
95 * careful as there may already be a cycle in progress.
96 *
97 * The caller must be holding key_types_sem.
98 */
99void key_gc_keytype(struct key_type *ktype)
100{
101 kenter("%s", ktype->name);
102
103 key_gc_dead_keytype = ktype;
104 set_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
105 smp_mb();
106 set_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags);
107
108 kdebug("schedule");
109 schedule_work(&key_gc_work);
110
111 kdebug("sleep");
112 wait_on_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE,
113 TASK_UNINTERRUPTIBLE);
114
115 key_gc_dead_keytype = NULL;
116 kleave("");
117}
118
119/*
120 * Garbage collect a list of unreferenced, detached keys
121 */
122static noinline void key_gc_unused_keys(struct list_head *keys)
123{
124 while (!list_empty(keys)) {
125 struct key *key =
126 list_entry(keys->next, struct key, graveyard_link);
127 short state = key->state;
128
129 list_del(&key->graveyard_link);
130
131 kdebug("- %u", key->serial);
132 key_check(key);
133
134 /* Throw away the key data if the key is instantiated */
135 if (state == KEY_IS_POSITIVE && key->type->destroy)
136 key->type->destroy(key);
137
138 security_key_free(key);
139
140 /* deal with the user's key tracking and quota */
141 if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) {
142 spin_lock(&key->user->lock);
143 key->user->qnkeys--;
144 key->user->qnbytes -= key->quotalen;
145 spin_unlock(&key->user->lock);
146 }
147
148 atomic_dec(&key->user->nkeys);
149 if (state != KEY_IS_UNINSTANTIATED)
150 atomic_dec(&key->user->nikeys);
151
152 key_user_put(key->user);
153 key_put_tag(key->domain_tag);
154 kfree(key->description);
155
156 memzero_explicit(key, sizeof(*key));
157 kmem_cache_free(key_jar, key);
158 }
159}
160
161/*
162 * Garbage collector for unused keys.
163 *
164 * This is done in process context so that we don't have to disable interrupts
165 * all over the place. key_put() schedules this rather than trying to do the
166 * cleanup itself, which means key_put() doesn't have to sleep.
167 */
168static void key_garbage_collector(struct work_struct *work)
169{
170 static LIST_HEAD(graveyard);
171 static u8 gc_state; /* Internal persistent state */
172#define KEY_GC_REAP_AGAIN 0x01 /* - Need another cycle */
173#define KEY_GC_REAPING_LINKS 0x02 /* - We need to reap links */
174#define KEY_GC_SET_TIMER 0x04 /* - We need to restart the timer */
175#define KEY_GC_REAPING_DEAD_1 0x10 /* - We need to mark dead keys */
176#define KEY_GC_REAPING_DEAD_2 0x20 /* - We need to reap dead key links */
177#define KEY_GC_REAPING_DEAD_3 0x40 /* - We need to reap dead keys */
178#define KEY_GC_FOUND_DEAD_KEY 0x80 /* - We found at least one dead key */
179
180 struct rb_node *cursor;
181 struct key *key;
182 time64_t new_timer, limit;
183
184 kenter("[%lx,%x]", key_gc_flags, gc_state);
185
186 limit = ktime_get_real_seconds();
187 if (limit > key_gc_delay)
188 limit -= key_gc_delay;
189 else
190 limit = key_gc_delay;
191
192 /* Work out what we're going to be doing in this pass */
193 gc_state &= KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2;
194 gc_state <<= 1;
195 if (test_and_clear_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags))
196 gc_state |= KEY_GC_REAPING_LINKS | KEY_GC_SET_TIMER;
197
198 if (test_and_clear_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags))
199 gc_state |= KEY_GC_REAPING_DEAD_1;
200 kdebug("new pass %x", gc_state);
201
202 new_timer = TIME64_MAX;
203
204 /* As only this function is permitted to remove things from the key
205 * serial tree, if cursor is non-NULL then it will always point to a
206 * valid node in the tree - even if lock got dropped.
207 */
208 spin_lock(&key_serial_lock);
209 cursor = rb_first(&key_serial_tree);
210
211continue_scanning:
212 while (cursor) {
213 key = rb_entry(cursor, struct key, serial_node);
214 cursor = rb_next(cursor);
215
216 if (refcount_read(&key->usage) == 0)
217 goto found_unreferenced_key;
218
219 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_1)) {
220 if (key->type == key_gc_dead_keytype) {
221 gc_state |= KEY_GC_FOUND_DEAD_KEY;
222 set_bit(KEY_FLAG_DEAD, &key->flags);
223 key->perm = 0;
224 goto skip_dead_key;
225 } else if (key->type == &key_type_keyring &&
226 key->restrict_link) {
227 goto found_restricted_keyring;
228 }
229 }
230
231 if (gc_state & KEY_GC_SET_TIMER) {
232 if (key->expiry > limit && key->expiry < new_timer) {
233 kdebug("will expire %x in %lld",
234 key_serial(key), key->expiry - limit);
235 new_timer = key->expiry;
236 }
237 }
238
239 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2))
240 if (key->type == key_gc_dead_keytype)
241 gc_state |= KEY_GC_FOUND_DEAD_KEY;
242
243 if ((gc_state & KEY_GC_REAPING_LINKS) ||
244 unlikely(gc_state & KEY_GC_REAPING_DEAD_2)) {
245 if (key->type == &key_type_keyring)
246 goto found_keyring;
247 }
248
249 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3))
250 if (key->type == key_gc_dead_keytype)
251 goto destroy_dead_key;
252
253 skip_dead_key:
254 if (spin_is_contended(&key_serial_lock) || need_resched())
255 goto contended;
256 }
257
258contended:
259 spin_unlock(&key_serial_lock);
260
261maybe_resched:
262 if (cursor) {
263 cond_resched();
264 spin_lock(&key_serial_lock);
265 goto continue_scanning;
266 }
267
268 /* We've completed the pass. Set the timer if we need to and queue a
269 * new cycle if necessary. We keep executing cycles until we find one
270 * where we didn't reap any keys.
271 */
272 kdebug("pass complete");
273
274 if (gc_state & KEY_GC_SET_TIMER && new_timer != (time64_t)TIME64_MAX) {
275 new_timer += key_gc_delay;
276 key_schedule_gc(new_timer);
277 }
278
279 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2) ||
280 !list_empty(&graveyard)) {
281 /* Make sure that all pending keyring payload destructions are
282 * fulfilled and that people aren't now looking at dead or
283 * dying keys that they don't have a reference upon or a link
284 * to.
285 */
286 kdebug("gc sync");
287 synchronize_rcu();
288 }
289
290 if (!list_empty(&graveyard)) {
291 kdebug("gc keys");
292 key_gc_unused_keys(&graveyard);
293 }
294
295 if (unlikely(gc_state & (KEY_GC_REAPING_DEAD_1 |
296 KEY_GC_REAPING_DEAD_2))) {
297 if (!(gc_state & KEY_GC_FOUND_DEAD_KEY)) {
298 /* No remaining dead keys: short circuit the remaining
299 * keytype reap cycles.
300 */
301 kdebug("dead short");
302 gc_state &= ~(KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2);
303 gc_state |= KEY_GC_REAPING_DEAD_3;
304 } else {
305 gc_state |= KEY_GC_REAP_AGAIN;
306 }
307 }
308
309 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3)) {
310 kdebug("dead wake");
311 smp_mb();
312 clear_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
313 wake_up_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE);
314 }
315
316 if (gc_state & KEY_GC_REAP_AGAIN)
317 schedule_work(&key_gc_work);
318 kleave(" [end %x]", gc_state);
319 return;
320
321 /* We found an unreferenced key - once we've removed it from the tree,
322 * we can safely drop the lock.
323 */
324found_unreferenced_key:
325 kdebug("unrefd key %d", key->serial);
326 rb_erase(&key->serial_node, &key_serial_tree);
327 spin_unlock(&key_serial_lock);
328
329 list_add_tail(&key->graveyard_link, &graveyard);
330 gc_state |= KEY_GC_REAP_AGAIN;
331 goto maybe_resched;
332
333 /* We found a restricted keyring and need to update the restriction if
334 * it is associated with the dead key type.
335 */
336found_restricted_keyring:
337 spin_unlock(&key_serial_lock);
338 keyring_restriction_gc(key, key_gc_dead_keytype);
339 goto maybe_resched;
340
341 /* We found a keyring and we need to check the payload for links to
342 * dead or expired keys. We don't flag another reap immediately as we
343 * have to wait for the old payload to be destroyed by RCU before we
344 * can reap the keys to which it refers.
345 */
346found_keyring:
347 spin_unlock(&key_serial_lock);
348 keyring_gc(key, limit);
349 goto maybe_resched;
350
351 /* We found a dead key that is still referenced. Reset its type and
352 * destroy its payload with its semaphore held.
353 */
354destroy_dead_key:
355 spin_unlock(&key_serial_lock);
356 kdebug("destroy key %d", key->serial);
357 down_write(&key->sem);
358 key->type = &key_type_dead;
359 if (key_gc_dead_keytype->destroy)
360 key_gc_dead_keytype->destroy(key);
361 memset(&key->payload, KEY_DESTROY, sizeof(key->payload));
362 up_write(&key->sem);
363 goto maybe_resched;
364}
1/* Key garbage collector
2 *
3 * Copyright (C) 2009-2011 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public Licence
8 * as published by the Free Software Foundation; either version
9 * 2 of the Licence, or (at your option) any later version.
10 */
11
12#include <linux/module.h>
13#include <linux/slab.h>
14#include <linux/security.h>
15#include <keys/keyring-type.h>
16#include "internal.h"
17
18/*
19 * Delay between key revocation/expiry in seconds
20 */
21unsigned key_gc_delay = 5 * 60;
22
23/*
24 * Reaper for unused keys.
25 */
26static void key_garbage_collector(struct work_struct *work);
27DECLARE_WORK(key_gc_work, key_garbage_collector);
28
29/*
30 * Reaper for links from keyrings to dead keys.
31 */
32static void key_gc_timer_func(unsigned long);
33static DEFINE_TIMER(key_gc_timer, key_gc_timer_func, 0, 0);
34
35static time_t key_gc_next_run = LONG_MAX;
36static struct key_type *key_gc_dead_keytype;
37
38static unsigned long key_gc_flags;
39#define KEY_GC_KEY_EXPIRED 0 /* A key expired and needs unlinking */
40#define KEY_GC_REAP_KEYTYPE 1 /* A keytype is being unregistered */
41#define KEY_GC_REAPING_KEYTYPE 2 /* Cleared when keytype reaped */
42
43
44/*
45 * Any key whose type gets unregistered will be re-typed to this if it can't be
46 * immediately unlinked.
47 */
48struct key_type key_type_dead = {
49 .name = "dead",
50};
51
52/*
53 * Schedule a garbage collection run.
54 * - time precision isn't particularly important
55 */
56void key_schedule_gc(time_t gc_at)
57{
58 unsigned long expires;
59 time_t now = current_kernel_time().tv_sec;
60
61 kenter("%ld", gc_at - now);
62
63 if (gc_at <= now || test_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags)) {
64 kdebug("IMMEDIATE");
65 schedule_work(&key_gc_work);
66 } else if (gc_at < key_gc_next_run) {
67 kdebug("DEFERRED");
68 key_gc_next_run = gc_at;
69 expires = jiffies + (gc_at - now) * HZ;
70 mod_timer(&key_gc_timer, expires);
71 }
72}
73
74/*
75 * Schedule a dead links collection run.
76 */
77void key_schedule_gc_links(void)
78{
79 set_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags);
80 schedule_work(&key_gc_work);
81}
82
83/*
84 * Some key's cleanup time was met after it expired, so we need to get the
85 * reaper to go through a cycle finding expired keys.
86 */
87static void key_gc_timer_func(unsigned long data)
88{
89 kenter("");
90 key_gc_next_run = LONG_MAX;
91 key_schedule_gc_links();
92}
93
94/*
95 * wait_on_bit() sleep function for uninterruptible waiting
96 */
97static int key_gc_wait_bit(void *flags)
98{
99 schedule();
100 return 0;
101}
102
103/*
104 * Reap keys of dead type.
105 *
106 * We use three flags to make sure we see three complete cycles of the garbage
107 * collector: the first to mark keys of that type as being dead, the second to
108 * collect dead links and the third to clean up the dead keys. We have to be
109 * careful as there may already be a cycle in progress.
110 *
111 * The caller must be holding key_types_sem.
112 */
113void key_gc_keytype(struct key_type *ktype)
114{
115 kenter("%s", ktype->name);
116
117 key_gc_dead_keytype = ktype;
118 set_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
119 smp_mb();
120 set_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags);
121
122 kdebug("schedule");
123 schedule_work(&key_gc_work);
124
125 kdebug("sleep");
126 wait_on_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE, key_gc_wait_bit,
127 TASK_UNINTERRUPTIBLE);
128
129 key_gc_dead_keytype = NULL;
130 kleave("");
131}
132
133/*
134 * Garbage collect a list of unreferenced, detached keys
135 */
136static noinline void key_gc_unused_keys(struct list_head *keys)
137{
138 while (!list_empty(keys)) {
139 struct key *key =
140 list_entry(keys->next, struct key, graveyard_link);
141 list_del(&key->graveyard_link);
142
143 kdebug("- %u", key->serial);
144 key_check(key);
145
146 security_key_free(key);
147
148 /* deal with the user's key tracking and quota */
149 if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) {
150 spin_lock(&key->user->lock);
151 key->user->qnkeys--;
152 key->user->qnbytes -= key->quotalen;
153 spin_unlock(&key->user->lock);
154 }
155
156 atomic_dec(&key->user->nkeys);
157 if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
158 atomic_dec(&key->user->nikeys);
159
160 key_user_put(key->user);
161
162 /* now throw away the key memory */
163 if (key->type->destroy)
164 key->type->destroy(key);
165
166 kfree(key->description);
167
168#ifdef KEY_DEBUGGING
169 key->magic = KEY_DEBUG_MAGIC_X;
170#endif
171 kmem_cache_free(key_jar, key);
172 }
173}
174
175/*
176 * Garbage collector for unused keys.
177 *
178 * This is done in process context so that we don't have to disable interrupts
179 * all over the place. key_put() schedules this rather than trying to do the
180 * cleanup itself, which means key_put() doesn't have to sleep.
181 */
182static void key_garbage_collector(struct work_struct *work)
183{
184 static LIST_HEAD(graveyard);
185 static u8 gc_state; /* Internal persistent state */
186#define KEY_GC_REAP_AGAIN 0x01 /* - Need another cycle */
187#define KEY_GC_REAPING_LINKS 0x02 /* - We need to reap links */
188#define KEY_GC_SET_TIMER 0x04 /* - We need to restart the timer */
189#define KEY_GC_REAPING_DEAD_1 0x10 /* - We need to mark dead keys */
190#define KEY_GC_REAPING_DEAD_2 0x20 /* - We need to reap dead key links */
191#define KEY_GC_REAPING_DEAD_3 0x40 /* - We need to reap dead keys */
192#define KEY_GC_FOUND_DEAD_KEY 0x80 /* - We found at least one dead key */
193
194 struct rb_node *cursor;
195 struct key *key;
196 time_t new_timer, limit;
197
198 kenter("[%lx,%x]", key_gc_flags, gc_state);
199
200 limit = current_kernel_time().tv_sec;
201 if (limit > key_gc_delay)
202 limit -= key_gc_delay;
203 else
204 limit = key_gc_delay;
205
206 /* Work out what we're going to be doing in this pass */
207 gc_state &= KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2;
208 gc_state <<= 1;
209 if (test_and_clear_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags))
210 gc_state |= KEY_GC_REAPING_LINKS | KEY_GC_SET_TIMER;
211
212 if (test_and_clear_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags))
213 gc_state |= KEY_GC_REAPING_DEAD_1;
214 kdebug("new pass %x", gc_state);
215
216 new_timer = LONG_MAX;
217
218 /* As only this function is permitted to remove things from the key
219 * serial tree, if cursor is non-NULL then it will always point to a
220 * valid node in the tree - even if lock got dropped.
221 */
222 spin_lock(&key_serial_lock);
223 cursor = rb_first(&key_serial_tree);
224
225continue_scanning:
226 while (cursor) {
227 key = rb_entry(cursor, struct key, serial_node);
228 cursor = rb_next(cursor);
229
230 if (atomic_read(&key->usage) == 0)
231 goto found_unreferenced_key;
232
233 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_1)) {
234 if (key->type == key_gc_dead_keytype) {
235 gc_state |= KEY_GC_FOUND_DEAD_KEY;
236 set_bit(KEY_FLAG_DEAD, &key->flags);
237 key->perm = 0;
238 goto skip_dead_key;
239 }
240 }
241
242 if (gc_state & KEY_GC_SET_TIMER) {
243 if (key->expiry > limit && key->expiry < new_timer) {
244 kdebug("will expire %x in %ld",
245 key_serial(key), key->expiry - limit);
246 new_timer = key->expiry;
247 }
248 }
249
250 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2))
251 if (key->type == key_gc_dead_keytype)
252 gc_state |= KEY_GC_FOUND_DEAD_KEY;
253
254 if ((gc_state & KEY_GC_REAPING_LINKS) ||
255 unlikely(gc_state & KEY_GC_REAPING_DEAD_2)) {
256 if (key->type == &key_type_keyring)
257 goto found_keyring;
258 }
259
260 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3))
261 if (key->type == key_gc_dead_keytype)
262 goto destroy_dead_key;
263
264 skip_dead_key:
265 if (spin_is_contended(&key_serial_lock) || need_resched())
266 goto contended;
267 }
268
269contended:
270 spin_unlock(&key_serial_lock);
271
272maybe_resched:
273 if (cursor) {
274 cond_resched();
275 spin_lock(&key_serial_lock);
276 goto continue_scanning;
277 }
278
279 /* We've completed the pass. Set the timer if we need to and queue a
280 * new cycle if necessary. We keep executing cycles until we find one
281 * where we didn't reap any keys.
282 */
283 kdebug("pass complete");
284
285 if (gc_state & KEY_GC_SET_TIMER && new_timer != (time_t)LONG_MAX) {
286 new_timer += key_gc_delay;
287 key_schedule_gc(new_timer);
288 }
289
290 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2) ||
291 !list_empty(&graveyard)) {
292 /* Make sure that all pending keyring payload destructions are
293 * fulfilled and that people aren't now looking at dead or
294 * dying keys that they don't have a reference upon or a link
295 * to.
296 */
297 kdebug("gc sync");
298 synchronize_rcu();
299 }
300
301 if (!list_empty(&graveyard)) {
302 kdebug("gc keys");
303 key_gc_unused_keys(&graveyard);
304 }
305
306 if (unlikely(gc_state & (KEY_GC_REAPING_DEAD_1 |
307 KEY_GC_REAPING_DEAD_2))) {
308 if (!(gc_state & KEY_GC_FOUND_DEAD_KEY)) {
309 /* No remaining dead keys: short circuit the remaining
310 * keytype reap cycles.
311 */
312 kdebug("dead short");
313 gc_state &= ~(KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2);
314 gc_state |= KEY_GC_REAPING_DEAD_3;
315 } else {
316 gc_state |= KEY_GC_REAP_AGAIN;
317 }
318 }
319
320 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3)) {
321 kdebug("dead wake");
322 smp_mb();
323 clear_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
324 wake_up_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE);
325 }
326
327 if (gc_state & KEY_GC_REAP_AGAIN)
328 schedule_work(&key_gc_work);
329 kleave(" [end %x]", gc_state);
330 return;
331
332 /* We found an unreferenced key - once we've removed it from the tree,
333 * we can safely drop the lock.
334 */
335found_unreferenced_key:
336 kdebug("unrefd key %d", key->serial);
337 rb_erase(&key->serial_node, &key_serial_tree);
338 spin_unlock(&key_serial_lock);
339
340 list_add_tail(&key->graveyard_link, &graveyard);
341 gc_state |= KEY_GC_REAP_AGAIN;
342 goto maybe_resched;
343
344 /* We found a keyring and we need to check the payload for links to
345 * dead or expired keys. We don't flag another reap immediately as we
346 * have to wait for the old payload to be destroyed by RCU before we
347 * can reap the keys to which it refers.
348 */
349found_keyring:
350 spin_unlock(&key_serial_lock);
351 keyring_gc(key, limit);
352 goto maybe_resched;
353
354 /* We found a dead key that is still referenced. Reset its type and
355 * destroy its payload with its semaphore held.
356 */
357destroy_dead_key:
358 spin_unlock(&key_serial_lock);
359 kdebug("destroy key %d", key->serial);
360 down_write(&key->sem);
361 key->type = &key_type_dead;
362 if (key_gc_dead_keytype->destroy)
363 key_gc_dead_keytype->destroy(key);
364 memset(&key->payload, KEY_DESTROY, sizeof(key->payload));
365 up_write(&key->sem);
366 goto maybe_resched;
367}