Loading...
1// SPDX-License-Identifier: GPL-2.0-or-later
2/* Key garbage collector
3 *
4 * Copyright (C) 2009-2011 Red Hat, Inc. All Rights Reserved.
5 * Written by David Howells (dhowells@redhat.com)
6 */
7
8#include <linux/slab.h>
9#include <linux/security.h>
10#include <keys/keyring-type.h>
11#include "internal.h"
12
13/*
14 * Delay between key revocation/expiry in seconds
15 */
16unsigned key_gc_delay = 5 * 60;
17
18/*
19 * Reaper for unused keys.
20 */
21static void key_garbage_collector(struct work_struct *work);
22DECLARE_WORK(key_gc_work, key_garbage_collector);
23
24/*
25 * Reaper for links from keyrings to dead keys.
26 */
27static void key_gc_timer_func(struct timer_list *);
28static DEFINE_TIMER(key_gc_timer, key_gc_timer_func);
29
30static time64_t key_gc_next_run = TIME64_MAX;
31static struct key_type *key_gc_dead_keytype;
32
33static unsigned long key_gc_flags;
34#define KEY_GC_KEY_EXPIRED 0 /* A key expired and needs unlinking */
35#define KEY_GC_REAP_KEYTYPE 1 /* A keytype is being unregistered */
36#define KEY_GC_REAPING_KEYTYPE 2 /* Cleared when keytype reaped */
37
38
39/*
40 * Any key whose type gets unregistered will be re-typed to this if it can't be
41 * immediately unlinked.
42 */
43struct key_type key_type_dead = {
44 .name = ".dead",
45};
46
47/*
48 * Schedule a garbage collection run.
49 * - time precision isn't particularly important
50 */
51void key_schedule_gc(time64_t gc_at)
52{
53 unsigned long expires;
54 time64_t now = ktime_get_real_seconds();
55
56 kenter("%lld", gc_at - now);
57
58 if (gc_at <= now || test_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags)) {
59 kdebug("IMMEDIATE");
60 schedule_work(&key_gc_work);
61 } else if (gc_at < key_gc_next_run) {
62 kdebug("DEFERRED");
63 key_gc_next_run = gc_at;
64 expires = jiffies + (gc_at - now) * HZ;
65 mod_timer(&key_gc_timer, expires);
66 }
67}
68
69/*
70 * Set the expiration time on a key.
71 */
72void key_set_expiry(struct key *key, time64_t expiry)
73{
74 key->expiry = expiry;
75 if (expiry != TIME64_MAX) {
76 if (!(key->type->flags & KEY_TYPE_INSTANT_REAP))
77 expiry += key_gc_delay;
78 key_schedule_gc(expiry);
79 }
80}
81
82/*
83 * Schedule a dead links collection run.
84 */
85void key_schedule_gc_links(void)
86{
87 set_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags);
88 schedule_work(&key_gc_work);
89}
90
91/*
92 * Some key's cleanup time was met after it expired, so we need to get the
93 * reaper to go through a cycle finding expired keys.
94 */
95static void key_gc_timer_func(struct timer_list *unused)
96{
97 kenter("");
98 key_gc_next_run = TIME64_MAX;
99 key_schedule_gc_links();
100}
101
102/*
103 * Reap keys of dead type.
104 *
105 * We use three flags to make sure we see three complete cycles of the garbage
106 * collector: the first to mark keys of that type as being dead, the second to
107 * collect dead links and the third to clean up the dead keys. We have to be
108 * careful as there may already be a cycle in progress.
109 *
110 * The caller must be holding key_types_sem.
111 */
112void key_gc_keytype(struct key_type *ktype)
113{
114 kenter("%s", ktype->name);
115
116 key_gc_dead_keytype = ktype;
117 set_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
118 smp_mb();
119 set_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags);
120
121 kdebug("schedule");
122 schedule_work(&key_gc_work);
123
124 kdebug("sleep");
125 wait_on_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE,
126 TASK_UNINTERRUPTIBLE);
127
128 key_gc_dead_keytype = NULL;
129 kleave("");
130}
131
132/*
133 * Garbage collect a list of unreferenced, detached keys
134 */
135static noinline void key_gc_unused_keys(struct list_head *keys)
136{
137 while (!list_empty(keys)) {
138 struct key *key =
139 list_entry(keys->next, struct key, graveyard_link);
140 short state = key->state;
141
142 list_del(&key->graveyard_link);
143
144 kdebug("- %u", key->serial);
145 key_check(key);
146
147#ifdef CONFIG_KEY_NOTIFICATIONS
148 remove_watch_list(key->watchers, key->serial);
149 key->watchers = NULL;
150#endif
151
152 /* Throw away the key data if the key is instantiated */
153 if (state == KEY_IS_POSITIVE && key->type->destroy)
154 key->type->destroy(key);
155
156 security_key_free(key);
157
158 atomic_dec(&key->user->nkeys);
159 if (state != KEY_IS_UNINSTANTIATED)
160 atomic_dec(&key->user->nikeys);
161
162 key_user_put(key->user);
163 key_put_tag(key->domain_tag);
164 kfree(key->description);
165
166 memzero_explicit(key, sizeof(*key));
167 kmem_cache_free(key_jar, key);
168 }
169}
170
171/*
172 * Garbage collector for unused keys.
173 *
174 * This is done in process context so that we don't have to disable interrupts
175 * all over the place. key_put() schedules this rather than trying to do the
176 * cleanup itself, which means key_put() doesn't have to sleep.
177 */
178static void key_garbage_collector(struct work_struct *work)
179{
180 static LIST_HEAD(graveyard);
181 static u8 gc_state; /* Internal persistent state */
182#define KEY_GC_REAP_AGAIN 0x01 /* - Need another cycle */
183#define KEY_GC_REAPING_LINKS 0x02 /* - We need to reap links */
184#define KEY_GC_REAPING_DEAD_1 0x10 /* - We need to mark dead keys */
185#define KEY_GC_REAPING_DEAD_2 0x20 /* - We need to reap dead key links */
186#define KEY_GC_REAPING_DEAD_3 0x40 /* - We need to reap dead keys */
187#define KEY_GC_FOUND_DEAD_KEY 0x80 /* - We found at least one dead key */
188
189 struct rb_node *cursor;
190 struct key *key;
191 time64_t new_timer, limit, expiry;
192
193 kenter("[%lx,%x]", key_gc_flags, gc_state);
194
195 limit = ktime_get_real_seconds();
196
197 /* Work out what we're going to be doing in this pass */
198 gc_state &= KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2;
199 gc_state <<= 1;
200 if (test_and_clear_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags))
201 gc_state |= KEY_GC_REAPING_LINKS;
202
203 if (test_and_clear_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags))
204 gc_state |= KEY_GC_REAPING_DEAD_1;
205 kdebug("new pass %x", gc_state);
206
207 new_timer = TIME64_MAX;
208
209 /* As only this function is permitted to remove things from the key
210 * serial tree, if cursor is non-NULL then it will always point to a
211 * valid node in the tree - even if lock got dropped.
212 */
213 spin_lock(&key_serial_lock);
214 cursor = rb_first(&key_serial_tree);
215
216continue_scanning:
217 while (cursor) {
218 key = rb_entry(cursor, struct key, serial_node);
219 cursor = rb_next(cursor);
220
221 if (refcount_read(&key->usage) == 0)
222 goto found_unreferenced_key;
223
224 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_1)) {
225 if (key->type == key_gc_dead_keytype) {
226 gc_state |= KEY_GC_FOUND_DEAD_KEY;
227 set_bit(KEY_FLAG_DEAD, &key->flags);
228 key->perm = 0;
229 goto skip_dead_key;
230 } else if (key->type == &key_type_keyring &&
231 key->restrict_link) {
232 goto found_restricted_keyring;
233 }
234 }
235
236 expiry = key->expiry;
237 if (expiry != TIME64_MAX) {
238 if (!(key->type->flags & KEY_TYPE_INSTANT_REAP))
239 expiry += key_gc_delay;
240 if (expiry > limit && expiry < new_timer) {
241 kdebug("will expire %x in %lld",
242 key_serial(key), key->expiry - limit);
243 new_timer = key->expiry;
244 }
245 }
246
247 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2))
248 if (key->type == key_gc_dead_keytype)
249 gc_state |= KEY_GC_FOUND_DEAD_KEY;
250
251 if ((gc_state & KEY_GC_REAPING_LINKS) ||
252 unlikely(gc_state & KEY_GC_REAPING_DEAD_2)) {
253 if (key->type == &key_type_keyring)
254 goto found_keyring;
255 }
256
257 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3))
258 if (key->type == key_gc_dead_keytype)
259 goto destroy_dead_key;
260
261 skip_dead_key:
262 if (spin_is_contended(&key_serial_lock) || need_resched())
263 goto contended;
264 }
265
266contended:
267 spin_unlock(&key_serial_lock);
268
269maybe_resched:
270 if (cursor) {
271 cond_resched();
272 spin_lock(&key_serial_lock);
273 goto continue_scanning;
274 }
275
276 /* We've completed the pass. Set the timer if we need to and queue a
277 * new cycle if necessary. We keep executing cycles until we find one
278 * where we didn't reap any keys.
279 */
280 kdebug("pass complete");
281
282 if (new_timer != TIME64_MAX) {
283 new_timer += key_gc_delay;
284 key_schedule_gc(new_timer);
285 }
286
287 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2) ||
288 !list_empty(&graveyard)) {
289 /* Make sure that all pending keyring payload destructions are
290 * fulfilled and that people aren't now looking at dead or
291 * dying keys that they don't have a reference upon or a link
292 * to.
293 */
294 kdebug("gc sync");
295 synchronize_rcu();
296 }
297
298 if (!list_empty(&graveyard)) {
299 kdebug("gc keys");
300 key_gc_unused_keys(&graveyard);
301 }
302
303 if (unlikely(gc_state & (KEY_GC_REAPING_DEAD_1 |
304 KEY_GC_REAPING_DEAD_2))) {
305 if (!(gc_state & KEY_GC_FOUND_DEAD_KEY)) {
306 /* No remaining dead keys: short circuit the remaining
307 * keytype reap cycles.
308 */
309 kdebug("dead short");
310 gc_state &= ~(KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2);
311 gc_state |= KEY_GC_REAPING_DEAD_3;
312 } else {
313 gc_state |= KEY_GC_REAP_AGAIN;
314 }
315 }
316
317 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3)) {
318 kdebug("dead wake");
319 smp_mb();
320 clear_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
321 wake_up_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE);
322 }
323
324 if (gc_state & KEY_GC_REAP_AGAIN)
325 schedule_work(&key_gc_work);
326 kleave(" [end %x]", gc_state);
327 return;
328
329 /* We found an unreferenced key - once we've removed it from the tree,
330 * we can safely drop the lock.
331 */
332found_unreferenced_key:
333 kdebug("unrefd key %d", key->serial);
334 rb_erase(&key->serial_node, &key_serial_tree);
335 spin_unlock(&key_serial_lock);
336
337 list_add_tail(&key->graveyard_link, &graveyard);
338 gc_state |= KEY_GC_REAP_AGAIN;
339 goto maybe_resched;
340
341 /* We found a restricted keyring and need to update the restriction if
342 * it is associated with the dead key type.
343 */
344found_restricted_keyring:
345 spin_unlock(&key_serial_lock);
346 keyring_restriction_gc(key, key_gc_dead_keytype);
347 goto maybe_resched;
348
349 /* We found a keyring and we need to check the payload for links to
350 * dead or expired keys. We don't flag another reap immediately as we
351 * have to wait for the old payload to be destroyed by RCU before we
352 * can reap the keys to which it refers.
353 */
354found_keyring:
355 spin_unlock(&key_serial_lock);
356 keyring_gc(key, limit);
357 goto maybe_resched;
358
359 /* We found a dead key that is still referenced. Reset its type and
360 * destroy its payload with its semaphore held.
361 */
362destroy_dead_key:
363 spin_unlock(&key_serial_lock);
364 kdebug("destroy key %d", key->serial);
365 down_write(&key->sem);
366 key->type = &key_type_dead;
367 if (key_gc_dead_keytype->destroy)
368 key_gc_dead_keytype->destroy(key);
369 memset(&key->payload, KEY_DESTROY, sizeof(key->payload));
370 up_write(&key->sem);
371 goto maybe_resched;
372}
1/* Key garbage collector
2 *
3 * Copyright (C) 2009 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public Licence
8 * as published by the Free Software Foundation; either version
9 * 2 of the Licence, or (at your option) any later version.
10 */
11
12#include <linux/module.h>
13#include <keys/keyring-type.h>
14#include "internal.h"
15
16/*
17 * Delay between key revocation/expiry in seconds
18 */
19unsigned key_gc_delay = 5 * 60;
20
21/*
22 * Reaper
23 */
24static void key_gc_timer_func(unsigned long);
25static void key_garbage_collector(struct work_struct *);
26static DEFINE_TIMER(key_gc_timer, key_gc_timer_func, 0, 0);
27static DECLARE_WORK(key_gc_work, key_garbage_collector);
28static key_serial_t key_gc_cursor; /* the last key the gc considered */
29static bool key_gc_again;
30static unsigned long key_gc_executing;
31static time_t key_gc_next_run = LONG_MAX;
32static time_t key_gc_new_timer;
33
34/*
35 * Schedule a garbage collection run.
36 * - time precision isn't particularly important
37 */
38void key_schedule_gc(time_t gc_at)
39{
40 unsigned long expires;
41 time_t now = current_kernel_time().tv_sec;
42
43 kenter("%ld", gc_at - now);
44
45 if (gc_at <= now) {
46 schedule_work(&key_gc_work);
47 } else if (gc_at < key_gc_next_run) {
48 expires = jiffies + (gc_at - now) * HZ;
49 mod_timer(&key_gc_timer, expires);
50 }
51}
52
53/*
54 * The garbage collector timer kicked off
55 */
56static void key_gc_timer_func(unsigned long data)
57{
58 kenter("");
59 key_gc_next_run = LONG_MAX;
60 schedule_work(&key_gc_work);
61}
62
63/*
64 * Garbage collect pointers from a keyring.
65 *
66 * Return true if we altered the keyring.
67 */
68static bool key_gc_keyring(struct key *keyring, time_t limit)
69 __releases(key_serial_lock)
70{
71 struct keyring_list *klist;
72 struct key *key;
73 int loop;
74
75 kenter("%x", key_serial(keyring));
76
77 if (test_bit(KEY_FLAG_REVOKED, &keyring->flags))
78 goto dont_gc;
79
80 /* scan the keyring looking for dead keys */
81 rcu_read_lock();
82 klist = rcu_dereference(keyring->payload.subscriptions);
83 if (!klist)
84 goto unlock_dont_gc;
85
86 for (loop = klist->nkeys - 1; loop >= 0; loop--) {
87 key = klist->keys[loop];
88 if (test_bit(KEY_FLAG_DEAD, &key->flags) ||
89 (key->expiry > 0 && key->expiry <= limit))
90 goto do_gc;
91 }
92
93unlock_dont_gc:
94 rcu_read_unlock();
95dont_gc:
96 kleave(" = false");
97 return false;
98
99do_gc:
100 rcu_read_unlock();
101 key_gc_cursor = keyring->serial;
102 key_get(keyring);
103 spin_unlock(&key_serial_lock);
104 keyring_gc(keyring, limit);
105 key_put(keyring);
106 kleave(" = true");
107 return true;
108}
109
110/*
111 * Garbage collector for keys. This involves scanning the keyrings for dead,
112 * expired and revoked keys that have overstayed their welcome
113 */
114static void key_garbage_collector(struct work_struct *work)
115{
116 struct rb_node *rb;
117 key_serial_t cursor;
118 struct key *key, *xkey;
119 time_t new_timer = LONG_MAX, limit, now;
120
121 now = current_kernel_time().tv_sec;
122 kenter("[%x,%ld]", key_gc_cursor, key_gc_new_timer - now);
123
124 if (test_and_set_bit(0, &key_gc_executing)) {
125 key_schedule_gc(current_kernel_time().tv_sec + 1);
126 kleave(" [busy; deferring]");
127 return;
128 }
129
130 limit = now;
131 if (limit > key_gc_delay)
132 limit -= key_gc_delay;
133 else
134 limit = key_gc_delay;
135
136 spin_lock(&key_serial_lock);
137
138 if (unlikely(RB_EMPTY_ROOT(&key_serial_tree))) {
139 spin_unlock(&key_serial_lock);
140 clear_bit(0, &key_gc_executing);
141 return;
142 }
143
144 cursor = key_gc_cursor;
145 if (cursor < 0)
146 cursor = 0;
147 if (cursor > 0)
148 new_timer = key_gc_new_timer;
149 else
150 key_gc_again = false;
151
152 /* find the first key above the cursor */
153 key = NULL;
154 rb = key_serial_tree.rb_node;
155 while (rb) {
156 xkey = rb_entry(rb, struct key, serial_node);
157 if (cursor < xkey->serial) {
158 key = xkey;
159 rb = rb->rb_left;
160 } else if (cursor > xkey->serial) {
161 rb = rb->rb_right;
162 } else {
163 rb = rb_next(rb);
164 if (!rb)
165 goto reached_the_end;
166 key = rb_entry(rb, struct key, serial_node);
167 break;
168 }
169 }
170
171 if (!key)
172 goto reached_the_end;
173
174 /* trawl through the keys looking for keyrings */
175 for (;;) {
176 if (key->expiry > limit && key->expiry < new_timer) {
177 kdebug("will expire %x in %ld",
178 key_serial(key), key->expiry - limit);
179 new_timer = key->expiry;
180 }
181
182 if (key->type == &key_type_keyring &&
183 key_gc_keyring(key, limit))
184 /* the gc had to release our lock so that the keyring
185 * could be modified, so we have to get it again */
186 goto gc_released_our_lock;
187
188 rb = rb_next(&key->serial_node);
189 if (!rb)
190 goto reached_the_end;
191 key = rb_entry(rb, struct key, serial_node);
192 }
193
194gc_released_our_lock:
195 kdebug("gc_released_our_lock");
196 key_gc_new_timer = new_timer;
197 key_gc_again = true;
198 clear_bit(0, &key_gc_executing);
199 schedule_work(&key_gc_work);
200 kleave(" [continue]");
201 return;
202
203 /* when we reach the end of the run, we set the timer for the next one */
204reached_the_end:
205 kdebug("reached_the_end");
206 spin_unlock(&key_serial_lock);
207 key_gc_new_timer = new_timer;
208 key_gc_cursor = 0;
209 clear_bit(0, &key_gc_executing);
210
211 if (key_gc_again) {
212 /* there may have been a key that expired whilst we were
213 * scanning, so if we discarded any links we should do another
214 * scan */
215 new_timer = now + 1;
216 key_schedule_gc(new_timer);
217 } else if (new_timer < LONG_MAX) {
218 new_timer += key_gc_delay;
219 key_schedule_gc(new_timer);
220 }
221 kleave(" [end]");
222}