Loading...
1// SPDX-License-Identifier: GPL-2.0-or-later
2/* Key garbage collector
3 *
4 * Copyright (C) 2009-2011 Red Hat, Inc. All Rights Reserved.
5 * Written by David Howells (dhowells@redhat.com)
6 */
7
8#include <linux/slab.h>
9#include <linux/security.h>
10#include <keys/keyring-type.h>
11#include "internal.h"
12
13/*
14 * Delay between key revocation/expiry in seconds
15 */
16unsigned key_gc_delay = 5 * 60;
17
18/*
19 * Reaper for unused keys.
20 */
21static void key_garbage_collector(struct work_struct *work);
22DECLARE_WORK(key_gc_work, key_garbage_collector);
23
24/*
25 * Reaper for links from keyrings to dead keys.
26 */
27static void key_gc_timer_func(struct timer_list *);
28static DEFINE_TIMER(key_gc_timer, key_gc_timer_func);
29
30static time64_t key_gc_next_run = TIME64_MAX;
31static struct key_type *key_gc_dead_keytype;
32
33static unsigned long key_gc_flags;
34#define KEY_GC_KEY_EXPIRED 0 /* A key expired and needs unlinking */
35#define KEY_GC_REAP_KEYTYPE 1 /* A keytype is being unregistered */
36#define KEY_GC_REAPING_KEYTYPE 2 /* Cleared when keytype reaped */
37
38
39/*
40 * Any key whose type gets unregistered will be re-typed to this if it can't be
41 * immediately unlinked.
42 */
43struct key_type key_type_dead = {
44 .name = ".dead",
45};
46
47/*
48 * Schedule a garbage collection run.
49 * - time precision isn't particularly important
50 */
51void key_schedule_gc(time64_t gc_at)
52{
53 unsigned long expires;
54 time64_t now = ktime_get_real_seconds();
55
56 kenter("%lld", gc_at - now);
57
58 if (gc_at <= now || test_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags)) {
59 kdebug("IMMEDIATE");
60 schedule_work(&key_gc_work);
61 } else if (gc_at < key_gc_next_run) {
62 kdebug("DEFERRED");
63 key_gc_next_run = gc_at;
64 expires = jiffies + (gc_at - now) * HZ;
65 mod_timer(&key_gc_timer, expires);
66 }
67}
68
69/*
70 * Schedule a dead links collection run.
71 */
72void key_schedule_gc_links(void)
73{
74 set_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags);
75 schedule_work(&key_gc_work);
76}
77
78/*
79 * Some key's cleanup time was met after it expired, so we need to get the
80 * reaper to go through a cycle finding expired keys.
81 */
82static void key_gc_timer_func(struct timer_list *unused)
83{
84 kenter("");
85 key_gc_next_run = TIME64_MAX;
86 key_schedule_gc_links();
87}
88
89/*
90 * Reap keys of dead type.
91 *
92 * We use three flags to make sure we see three complete cycles of the garbage
93 * collector: the first to mark keys of that type as being dead, the second to
94 * collect dead links and the third to clean up the dead keys. We have to be
95 * careful as there may already be a cycle in progress.
96 *
97 * The caller must be holding key_types_sem.
98 */
99void key_gc_keytype(struct key_type *ktype)
100{
101 kenter("%s", ktype->name);
102
103 key_gc_dead_keytype = ktype;
104 set_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
105 smp_mb();
106 set_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags);
107
108 kdebug("schedule");
109 schedule_work(&key_gc_work);
110
111 kdebug("sleep");
112 wait_on_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE,
113 TASK_UNINTERRUPTIBLE);
114
115 key_gc_dead_keytype = NULL;
116 kleave("");
117}
118
119/*
120 * Garbage collect a list of unreferenced, detached keys
121 */
122static noinline void key_gc_unused_keys(struct list_head *keys)
123{
124 while (!list_empty(keys)) {
125 struct key *key =
126 list_entry(keys->next, struct key, graveyard_link);
127 short state = key->state;
128
129 list_del(&key->graveyard_link);
130
131 kdebug("- %u", key->serial);
132 key_check(key);
133
134#ifdef CONFIG_KEY_NOTIFICATIONS
135 remove_watch_list(key->watchers, key->serial);
136 key->watchers = NULL;
137#endif
138
139 /* Throw away the key data if the key is instantiated */
140 if (state == KEY_IS_POSITIVE && key->type->destroy)
141 key->type->destroy(key);
142
143 security_key_free(key);
144
145 /* deal with the user's key tracking and quota */
146 if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) {
147 spin_lock(&key->user->lock);
148 key->user->qnkeys--;
149 key->user->qnbytes -= key->quotalen;
150 spin_unlock(&key->user->lock);
151 }
152
153 atomic_dec(&key->user->nkeys);
154 if (state != KEY_IS_UNINSTANTIATED)
155 atomic_dec(&key->user->nikeys);
156
157 key_user_put(key->user);
158 key_put_tag(key->domain_tag);
159 kfree(key->description);
160
161 memzero_explicit(key, sizeof(*key));
162 kmem_cache_free(key_jar, key);
163 }
164}
165
166/*
167 * Garbage collector for unused keys.
168 *
169 * This is done in process context so that we don't have to disable interrupts
170 * all over the place. key_put() schedules this rather than trying to do the
171 * cleanup itself, which means key_put() doesn't have to sleep.
172 */
173static void key_garbage_collector(struct work_struct *work)
174{
175 static LIST_HEAD(graveyard);
176 static u8 gc_state; /* Internal persistent state */
177#define KEY_GC_REAP_AGAIN 0x01 /* - Need another cycle */
178#define KEY_GC_REAPING_LINKS 0x02 /* - We need to reap links */
179#define KEY_GC_SET_TIMER 0x04 /* - We need to restart the timer */
180#define KEY_GC_REAPING_DEAD_1 0x10 /* - We need to mark dead keys */
181#define KEY_GC_REAPING_DEAD_2 0x20 /* - We need to reap dead key links */
182#define KEY_GC_REAPING_DEAD_3 0x40 /* - We need to reap dead keys */
183#define KEY_GC_FOUND_DEAD_KEY 0x80 /* - We found at least one dead key */
184
185 struct rb_node *cursor;
186 struct key *key;
187 time64_t new_timer, limit;
188
189 kenter("[%lx,%x]", key_gc_flags, gc_state);
190
191 limit = ktime_get_real_seconds();
192 if (limit > key_gc_delay)
193 limit -= key_gc_delay;
194 else
195 limit = key_gc_delay;
196
197 /* Work out what we're going to be doing in this pass */
198 gc_state &= KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2;
199 gc_state <<= 1;
200 if (test_and_clear_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags))
201 gc_state |= KEY_GC_REAPING_LINKS | KEY_GC_SET_TIMER;
202
203 if (test_and_clear_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags))
204 gc_state |= KEY_GC_REAPING_DEAD_1;
205 kdebug("new pass %x", gc_state);
206
207 new_timer = TIME64_MAX;
208
209 /* As only this function is permitted to remove things from the key
210 * serial tree, if cursor is non-NULL then it will always point to a
211 * valid node in the tree - even if lock got dropped.
212 */
213 spin_lock(&key_serial_lock);
214 cursor = rb_first(&key_serial_tree);
215
216continue_scanning:
217 while (cursor) {
218 key = rb_entry(cursor, struct key, serial_node);
219 cursor = rb_next(cursor);
220
221 if (refcount_read(&key->usage) == 0)
222 goto found_unreferenced_key;
223
224 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_1)) {
225 if (key->type == key_gc_dead_keytype) {
226 gc_state |= KEY_GC_FOUND_DEAD_KEY;
227 set_bit(KEY_FLAG_DEAD, &key->flags);
228 key->perm = 0;
229 goto skip_dead_key;
230 } else if (key->type == &key_type_keyring &&
231 key->restrict_link) {
232 goto found_restricted_keyring;
233 }
234 }
235
236 if (gc_state & KEY_GC_SET_TIMER) {
237 if (key->expiry > limit && key->expiry < new_timer) {
238 kdebug("will expire %x in %lld",
239 key_serial(key), key->expiry - limit);
240 new_timer = key->expiry;
241 }
242 }
243
244 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2))
245 if (key->type == key_gc_dead_keytype)
246 gc_state |= KEY_GC_FOUND_DEAD_KEY;
247
248 if ((gc_state & KEY_GC_REAPING_LINKS) ||
249 unlikely(gc_state & KEY_GC_REAPING_DEAD_2)) {
250 if (key->type == &key_type_keyring)
251 goto found_keyring;
252 }
253
254 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3))
255 if (key->type == key_gc_dead_keytype)
256 goto destroy_dead_key;
257
258 skip_dead_key:
259 if (spin_is_contended(&key_serial_lock) || need_resched())
260 goto contended;
261 }
262
263contended:
264 spin_unlock(&key_serial_lock);
265
266maybe_resched:
267 if (cursor) {
268 cond_resched();
269 spin_lock(&key_serial_lock);
270 goto continue_scanning;
271 }
272
273 /* We've completed the pass. Set the timer if we need to and queue a
274 * new cycle if necessary. We keep executing cycles until we find one
275 * where we didn't reap any keys.
276 */
277 kdebug("pass complete");
278
279 if (gc_state & KEY_GC_SET_TIMER && new_timer != (time64_t)TIME64_MAX) {
280 new_timer += key_gc_delay;
281 key_schedule_gc(new_timer);
282 }
283
284 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2) ||
285 !list_empty(&graveyard)) {
286 /* Make sure that all pending keyring payload destructions are
287 * fulfilled and that people aren't now looking at dead or
288 * dying keys that they don't have a reference upon or a link
289 * to.
290 */
291 kdebug("gc sync");
292 synchronize_rcu();
293 }
294
295 if (!list_empty(&graveyard)) {
296 kdebug("gc keys");
297 key_gc_unused_keys(&graveyard);
298 }
299
300 if (unlikely(gc_state & (KEY_GC_REAPING_DEAD_1 |
301 KEY_GC_REAPING_DEAD_2))) {
302 if (!(gc_state & KEY_GC_FOUND_DEAD_KEY)) {
303 /* No remaining dead keys: short circuit the remaining
304 * keytype reap cycles.
305 */
306 kdebug("dead short");
307 gc_state &= ~(KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2);
308 gc_state |= KEY_GC_REAPING_DEAD_3;
309 } else {
310 gc_state |= KEY_GC_REAP_AGAIN;
311 }
312 }
313
314 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3)) {
315 kdebug("dead wake");
316 smp_mb();
317 clear_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
318 wake_up_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE);
319 }
320
321 if (gc_state & KEY_GC_REAP_AGAIN)
322 schedule_work(&key_gc_work);
323 kleave(" [end %x]", gc_state);
324 return;
325
326 /* We found an unreferenced key - once we've removed it from the tree,
327 * we can safely drop the lock.
328 */
329found_unreferenced_key:
330 kdebug("unrefd key %d", key->serial);
331 rb_erase(&key->serial_node, &key_serial_tree);
332 spin_unlock(&key_serial_lock);
333
334 list_add_tail(&key->graveyard_link, &graveyard);
335 gc_state |= KEY_GC_REAP_AGAIN;
336 goto maybe_resched;
337
338 /* We found a restricted keyring and need to update the restriction if
339 * it is associated with the dead key type.
340 */
341found_restricted_keyring:
342 spin_unlock(&key_serial_lock);
343 keyring_restriction_gc(key, key_gc_dead_keytype);
344 goto maybe_resched;
345
346 /* We found a keyring and we need to check the payload for links to
347 * dead or expired keys. We don't flag another reap immediately as we
348 * have to wait for the old payload to be destroyed by RCU before we
349 * can reap the keys to which it refers.
350 */
351found_keyring:
352 spin_unlock(&key_serial_lock);
353 keyring_gc(key, limit);
354 goto maybe_resched;
355
356 /* We found a dead key that is still referenced. Reset its type and
357 * destroy its payload with its semaphore held.
358 */
359destroy_dead_key:
360 spin_unlock(&key_serial_lock);
361 kdebug("destroy key %d", key->serial);
362 down_write(&key->sem);
363 key->type = &key_type_dead;
364 if (key_gc_dead_keytype->destroy)
365 key_gc_dead_keytype->destroy(key);
366 memset(&key->payload, KEY_DESTROY, sizeof(key->payload));
367 up_write(&key->sem);
368 goto maybe_resched;
369}
1// SPDX-License-Identifier: GPL-2.0-or-later
2/* Key garbage collector
3 *
4 * Copyright (C) 2009-2011 Red Hat, Inc. All Rights Reserved.
5 * Written by David Howells (dhowells@redhat.com)
6 */
7
8#include <linux/slab.h>
9#include <linux/security.h>
10#include <keys/keyring-type.h>
11#include "internal.h"
12
13/*
14 * Delay between key revocation/expiry in seconds
15 */
16unsigned key_gc_delay = 5 * 60;
17
18/*
19 * Reaper for unused keys.
20 */
21static void key_garbage_collector(struct work_struct *work);
22DECLARE_WORK(key_gc_work, key_garbage_collector);
23
24/*
25 * Reaper for links from keyrings to dead keys.
26 */
27static void key_gc_timer_func(struct timer_list *);
28static DEFINE_TIMER(key_gc_timer, key_gc_timer_func);
29
30static time64_t key_gc_next_run = TIME64_MAX;
31static struct key_type *key_gc_dead_keytype;
32
33static unsigned long key_gc_flags;
34#define KEY_GC_KEY_EXPIRED 0 /* A key expired and needs unlinking */
35#define KEY_GC_REAP_KEYTYPE 1 /* A keytype is being unregistered */
36#define KEY_GC_REAPING_KEYTYPE 2 /* Cleared when keytype reaped */
37
38
39/*
40 * Any key whose type gets unregistered will be re-typed to this if it can't be
41 * immediately unlinked.
42 */
43struct key_type key_type_dead = {
44 .name = ".dead",
45};
46
47/*
48 * Schedule a garbage collection run.
49 * - time precision isn't particularly important
50 */
51void key_schedule_gc(time64_t gc_at)
52{
53 unsigned long expires;
54 time64_t now = ktime_get_real_seconds();
55
56 kenter("%lld", gc_at - now);
57
58 if (gc_at <= now || test_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags)) {
59 kdebug("IMMEDIATE");
60 schedule_work(&key_gc_work);
61 } else if (gc_at < key_gc_next_run) {
62 kdebug("DEFERRED");
63 key_gc_next_run = gc_at;
64 expires = jiffies + (gc_at - now) * HZ;
65 mod_timer(&key_gc_timer, expires);
66 }
67}
68
69/*
70 * Schedule a dead links collection run.
71 */
72void key_schedule_gc_links(void)
73{
74 set_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags);
75 schedule_work(&key_gc_work);
76}
77
78/*
79 * Some key's cleanup time was met after it expired, so we need to get the
80 * reaper to go through a cycle finding expired keys.
81 */
82static void key_gc_timer_func(struct timer_list *unused)
83{
84 kenter("");
85 key_gc_next_run = TIME64_MAX;
86 key_schedule_gc_links();
87}
88
89/*
90 * Reap keys of dead type.
91 *
92 * We use three flags to make sure we see three complete cycles of the garbage
93 * collector: the first to mark keys of that type as being dead, the second to
94 * collect dead links and the third to clean up the dead keys. We have to be
95 * careful as there may already be a cycle in progress.
96 *
97 * The caller must be holding key_types_sem.
98 */
99void key_gc_keytype(struct key_type *ktype)
100{
101 kenter("%s", ktype->name);
102
103 key_gc_dead_keytype = ktype;
104 set_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
105 smp_mb();
106 set_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags);
107
108 kdebug("schedule");
109 schedule_work(&key_gc_work);
110
111 kdebug("sleep");
112 wait_on_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE,
113 TASK_UNINTERRUPTIBLE);
114
115 key_gc_dead_keytype = NULL;
116 kleave("");
117}
118
119/*
120 * Garbage collect a list of unreferenced, detached keys
121 */
122static noinline void key_gc_unused_keys(struct list_head *keys)
123{
124 while (!list_empty(keys)) {
125 struct key *key =
126 list_entry(keys->next, struct key, graveyard_link);
127 short state = key->state;
128
129 list_del(&key->graveyard_link);
130
131 kdebug("- %u", key->serial);
132 key_check(key);
133
134#ifdef CONFIG_KEY_NOTIFICATIONS
135 remove_watch_list(key->watchers, key->serial);
136 key->watchers = NULL;
137#endif
138
139 /* Throw away the key data if the key is instantiated */
140 if (state == KEY_IS_POSITIVE && key->type->destroy)
141 key->type->destroy(key);
142
143 security_key_free(key);
144
145 /* deal with the user's key tracking and quota */
146 if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) {
147 spin_lock(&key->user->lock);
148 key->user->qnkeys--;
149 key->user->qnbytes -= key->quotalen;
150 spin_unlock(&key->user->lock);
151 }
152
153 atomic_dec(&key->user->nkeys);
154 if (state != KEY_IS_UNINSTANTIATED)
155 atomic_dec(&key->user->nikeys);
156
157 key_user_put(key->user);
158 key_put_tag(key->domain_tag);
159 kfree(key->description);
160
161 memzero_explicit(key, sizeof(*key));
162 kmem_cache_free(key_jar, key);
163 }
164}
165
166/*
167 * Garbage collector for unused keys.
168 *
169 * This is done in process context so that we don't have to disable interrupts
170 * all over the place. key_put() schedules this rather than trying to do the
171 * cleanup itself, which means key_put() doesn't have to sleep.
172 */
173static void key_garbage_collector(struct work_struct *work)
174{
175 static LIST_HEAD(graveyard);
176 static u8 gc_state; /* Internal persistent state */
177#define KEY_GC_REAP_AGAIN 0x01 /* - Need another cycle */
178#define KEY_GC_REAPING_LINKS 0x02 /* - We need to reap links */
179#define KEY_GC_SET_TIMER 0x04 /* - We need to restart the timer */
180#define KEY_GC_REAPING_DEAD_1 0x10 /* - We need to mark dead keys */
181#define KEY_GC_REAPING_DEAD_2 0x20 /* - We need to reap dead key links */
182#define KEY_GC_REAPING_DEAD_3 0x40 /* - We need to reap dead keys */
183#define KEY_GC_FOUND_DEAD_KEY 0x80 /* - We found at least one dead key */
184
185 struct rb_node *cursor;
186 struct key *key;
187 time64_t new_timer, limit;
188
189 kenter("[%lx,%x]", key_gc_flags, gc_state);
190
191 limit = ktime_get_real_seconds();
192 if (limit > key_gc_delay)
193 limit -= key_gc_delay;
194 else
195 limit = key_gc_delay;
196
197 /* Work out what we're going to be doing in this pass */
198 gc_state &= KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2;
199 gc_state <<= 1;
200 if (test_and_clear_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags))
201 gc_state |= KEY_GC_REAPING_LINKS | KEY_GC_SET_TIMER;
202
203 if (test_and_clear_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags))
204 gc_state |= KEY_GC_REAPING_DEAD_1;
205 kdebug("new pass %x", gc_state);
206
207 new_timer = TIME64_MAX;
208
209 /* As only this function is permitted to remove things from the key
210 * serial tree, if cursor is non-NULL then it will always point to a
211 * valid node in the tree - even if lock got dropped.
212 */
213 spin_lock(&key_serial_lock);
214 cursor = rb_first(&key_serial_tree);
215
216continue_scanning:
217 while (cursor) {
218 key = rb_entry(cursor, struct key, serial_node);
219 cursor = rb_next(cursor);
220
221 if (refcount_read(&key->usage) == 0)
222 goto found_unreferenced_key;
223
224 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_1)) {
225 if (key->type == key_gc_dead_keytype) {
226 gc_state |= KEY_GC_FOUND_DEAD_KEY;
227 set_bit(KEY_FLAG_DEAD, &key->flags);
228 key->perm = 0;
229 goto skip_dead_key;
230 } else if (key->type == &key_type_keyring &&
231 key->restrict_link) {
232 goto found_restricted_keyring;
233 }
234 }
235
236 if (gc_state & KEY_GC_SET_TIMER) {
237 if (key->expiry > limit && key->expiry < new_timer) {
238 kdebug("will expire %x in %lld",
239 key_serial(key), key->expiry - limit);
240 new_timer = key->expiry;
241 }
242 }
243
244 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2))
245 if (key->type == key_gc_dead_keytype)
246 gc_state |= KEY_GC_FOUND_DEAD_KEY;
247
248 if ((gc_state & KEY_GC_REAPING_LINKS) ||
249 unlikely(gc_state & KEY_GC_REAPING_DEAD_2)) {
250 if (key->type == &key_type_keyring)
251 goto found_keyring;
252 }
253
254 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3))
255 if (key->type == key_gc_dead_keytype)
256 goto destroy_dead_key;
257
258 skip_dead_key:
259 if (spin_is_contended(&key_serial_lock) || need_resched())
260 goto contended;
261 }
262
263contended:
264 spin_unlock(&key_serial_lock);
265
266maybe_resched:
267 if (cursor) {
268 cond_resched();
269 spin_lock(&key_serial_lock);
270 goto continue_scanning;
271 }
272
273 /* We've completed the pass. Set the timer if we need to and queue a
274 * new cycle if necessary. We keep executing cycles until we find one
275 * where we didn't reap any keys.
276 */
277 kdebug("pass complete");
278
279 if (gc_state & KEY_GC_SET_TIMER && new_timer != (time64_t)TIME64_MAX) {
280 new_timer += key_gc_delay;
281 key_schedule_gc(new_timer);
282 }
283
284 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2) ||
285 !list_empty(&graveyard)) {
286 /* Make sure that all pending keyring payload destructions are
287 * fulfilled and that people aren't now looking at dead or
288 * dying keys that they don't have a reference upon or a link
289 * to.
290 */
291 kdebug("gc sync");
292 synchronize_rcu();
293 }
294
295 if (!list_empty(&graveyard)) {
296 kdebug("gc keys");
297 key_gc_unused_keys(&graveyard);
298 }
299
300 if (unlikely(gc_state & (KEY_GC_REAPING_DEAD_1 |
301 KEY_GC_REAPING_DEAD_2))) {
302 if (!(gc_state & KEY_GC_FOUND_DEAD_KEY)) {
303 /* No remaining dead keys: short circuit the remaining
304 * keytype reap cycles.
305 */
306 kdebug("dead short");
307 gc_state &= ~(KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2);
308 gc_state |= KEY_GC_REAPING_DEAD_3;
309 } else {
310 gc_state |= KEY_GC_REAP_AGAIN;
311 }
312 }
313
314 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3)) {
315 kdebug("dead wake");
316 smp_mb();
317 clear_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
318 wake_up_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE);
319 }
320
321 if (gc_state & KEY_GC_REAP_AGAIN)
322 schedule_work(&key_gc_work);
323 kleave(" [end %x]", gc_state);
324 return;
325
326 /* We found an unreferenced key - once we've removed it from the tree,
327 * we can safely drop the lock.
328 */
329found_unreferenced_key:
330 kdebug("unrefd key %d", key->serial);
331 rb_erase(&key->serial_node, &key_serial_tree);
332 spin_unlock(&key_serial_lock);
333
334 list_add_tail(&key->graveyard_link, &graveyard);
335 gc_state |= KEY_GC_REAP_AGAIN;
336 goto maybe_resched;
337
338 /* We found a restricted keyring and need to update the restriction if
339 * it is associated with the dead key type.
340 */
341found_restricted_keyring:
342 spin_unlock(&key_serial_lock);
343 keyring_restriction_gc(key, key_gc_dead_keytype);
344 goto maybe_resched;
345
346 /* We found a keyring and we need to check the payload for links to
347 * dead or expired keys. We don't flag another reap immediately as we
348 * have to wait for the old payload to be destroyed by RCU before we
349 * can reap the keys to which it refers.
350 */
351found_keyring:
352 spin_unlock(&key_serial_lock);
353 keyring_gc(key, limit);
354 goto maybe_resched;
355
356 /* We found a dead key that is still referenced. Reset its type and
357 * destroy its payload with its semaphore held.
358 */
359destroy_dead_key:
360 spin_unlock(&key_serial_lock);
361 kdebug("destroy key %d", key->serial);
362 down_write(&key->sem);
363 key->type = &key_type_dead;
364 if (key_gc_dead_keytype->destroy)
365 key_gc_dead_keytype->destroy(key);
366 memset(&key->payload, KEY_DESTROY, sizeof(key->payload));
367 up_write(&key->sem);
368 goto maybe_resched;
369}