~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/security/keys/gc.c

Version: ~ [ linux-5.10-rc5 ] ~ [ linux-5.9.10 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.79 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.159 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.208 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.245 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.245 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.85 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /* Key garbage collector
  2  *
  3  * Copyright (C) 2009-2011 Red Hat, Inc. All Rights Reserved.
  4  * Written by David Howells (dhowells@redhat.com)
  5  *
  6  * This program is free software; you can redistribute it and/or
  7  * modify it under the terms of the GNU General Public Licence
  8  * as published by the Free Software Foundation; either version
  9  * 2 of the Licence, or (at your option) any later version.
 10  */
 11 
 12 #include <linux/module.h>
 13 #include <linux/slab.h>
 14 #include <linux/security.h>
 15 #include <keys/keyring-type.h>
 16 #include "internal.h"
 17 
 18 /*
 19  * Delay between key revocation/expiry in seconds
 20  */
 21 unsigned key_gc_delay = 5 * 60;
 22 
 23 /*
 24  * Reaper for unused keys.
 25  */
 26 static void key_garbage_collector(struct work_struct *work);
 27 DECLARE_WORK(key_gc_work, key_garbage_collector);
 28 
 29 /*
 30  * Reaper for links from keyrings to dead keys.
 31  */
 32 static void key_gc_timer_func(struct timer_list *);
 33 static DEFINE_TIMER(key_gc_timer, key_gc_timer_func);
 34 
 35 static time64_t key_gc_next_run = TIME64_MAX;
 36 static struct key_type *key_gc_dead_keytype;
 37 
 38 static unsigned long key_gc_flags;
 39 #define KEY_GC_KEY_EXPIRED      0       /* A key expired and needs unlinking */
 40 #define KEY_GC_REAP_KEYTYPE     1       /* A keytype is being unregistered */
 41 #define KEY_GC_REAPING_KEYTYPE  2       /* Cleared when keytype reaped */
 42 
 43 
 44 /*
 45  * Any key whose type gets unregistered will be re-typed to this if it can't be
 46  * immediately unlinked.
 47  */
 48 struct key_type key_type_dead = {
 49         .name = ".dead",
 50 };
 51 
 52 /*
 53  * Schedule a garbage collection run.
 54  * - time precision isn't particularly important
 55  */
 56 void key_schedule_gc(time64_t gc_at)
 57 {
 58         unsigned long expires;
 59         time64_t now = ktime_get_real_seconds();
 60 
 61         kenter("%lld", gc_at - now);
 62 
 63         if (gc_at <= now || test_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags)) {
 64                 kdebug("IMMEDIATE");
 65                 schedule_work(&key_gc_work);
 66         } else if (gc_at < key_gc_next_run) {
 67                 kdebug("DEFERRED");
 68                 key_gc_next_run = gc_at;
 69                 expires = jiffies + (gc_at - now) * HZ;
 70                 mod_timer(&key_gc_timer, expires);
 71         }
 72 }
 73 
 74 /*
 75  * Schedule a dead links collection run.
 76  */
 77 void key_schedule_gc_links(void)
 78 {
 79         set_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags);
 80         schedule_work(&key_gc_work);
 81 }
 82 
 83 /*
 84  * Some key's cleanup time was met after it expired, so we need to get the
 85  * reaper to go through a cycle finding expired keys.
 86  */
 87 static void key_gc_timer_func(struct timer_list *unused)
 88 {
 89         kenter("");
 90         key_gc_next_run = TIME64_MAX;
 91         key_schedule_gc_links();
 92 }
 93 
 94 /*
 95  * Reap keys of dead type.
 96  *
 97  * We use three flags to make sure we see three complete cycles of the garbage
 98  * collector: the first to mark keys of that type as being dead, the second to
 99  * collect dead links and the third to clean up the dead keys.  We have to be
100  * careful as there may already be a cycle in progress.
101  *
102  * The caller must be holding key_types_sem.
103  */
104 void key_gc_keytype(struct key_type *ktype)
105 {
106         kenter("%s", ktype->name);
107 
108         key_gc_dead_keytype = ktype;
109         set_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
110         smp_mb();
111         set_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags);
112 
113         kdebug("schedule");
114         schedule_work(&key_gc_work);
115 
116         kdebug("sleep");
117         wait_on_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE,
118                     TASK_UNINTERRUPTIBLE);
119 
120         key_gc_dead_keytype = NULL;
121         kleave("");
122 }
123 
124 /*
125  * Garbage collect a list of unreferenced, detached keys
126  */
127 static noinline void key_gc_unused_keys(struct list_head *keys)
128 {
129         while (!list_empty(keys)) {
130                 struct key *key =
131                         list_entry(keys->next, struct key, graveyard_link);
132                 short state = key->state;
133 
134                 list_del(&key->graveyard_link);
135 
136                 kdebug("- %u", key->serial);
137                 key_check(key);
138 
139                 /* Throw away the key data if the key is instantiated */
140                 if (state == KEY_IS_POSITIVE && key->type->destroy)
141                         key->type->destroy(key);
142 
143                 security_key_free(key);
144 
145                 /* deal with the user's key tracking and quota */
146                 if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) {
147                         spin_lock(&key->user->lock);
148                         key->user->qnkeys--;
149                         key->user->qnbytes -= key->quotalen;
150                         spin_unlock(&key->user->lock);
151                 }
152 
153                 atomic_dec(&key->user->nkeys);
154                 if (state != KEY_IS_UNINSTANTIATED)
155                         atomic_dec(&key->user->nikeys);
156 
157                 key_user_put(key->user);
158 
159                 kfree(key->description);
160 
161                 memzero_explicit(key, sizeof(*key));
162                 kmem_cache_free(key_jar, key);
163         }
164 }
165 
166 /*
167  * Garbage collector for unused keys.
168  *
169  * This is done in process context so that we don't have to disable interrupts
170  * all over the place.  key_put() schedules this rather than trying to do the
171  * cleanup itself, which means key_put() doesn't have to sleep.
172  */
173 static void key_garbage_collector(struct work_struct *work)
174 {
175         static LIST_HEAD(graveyard);
176         static u8 gc_state;             /* Internal persistent state */
177 #define KEY_GC_REAP_AGAIN       0x01    /* - Need another cycle */
178 #define KEY_GC_REAPING_LINKS    0x02    /* - We need to reap links */
179 #define KEY_GC_SET_TIMER        0x04    /* - We need to restart the timer */
180 #define KEY_GC_REAPING_DEAD_1   0x10    /* - We need to mark dead keys */
181 #define KEY_GC_REAPING_DEAD_2   0x20    /* - We need to reap dead key links */
182 #define KEY_GC_REAPING_DEAD_3   0x40    /* - We need to reap dead keys */
183 #define KEY_GC_FOUND_DEAD_KEY   0x80    /* - We found at least one dead key */
184 
185         struct rb_node *cursor;
186         struct key *key;
187         time64_t new_timer, limit;
188 
189         kenter("[%lx,%x]", key_gc_flags, gc_state);
190 
191         limit = ktime_get_real_seconds();
192         if (limit > key_gc_delay)
193                 limit -= key_gc_delay;
194         else
195                 limit = key_gc_delay;
196 
197         /* Work out what we're going to be doing in this pass */
198         gc_state &= KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2;
199         gc_state <<= 1;
200         if (test_and_clear_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags))
201                 gc_state |= KEY_GC_REAPING_LINKS | KEY_GC_SET_TIMER;
202 
203         if (test_and_clear_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags))
204                 gc_state |= KEY_GC_REAPING_DEAD_1;
205         kdebug("new pass %x", gc_state);
206 
207         new_timer = TIME64_MAX;
208 
209         /* As only this function is permitted to remove things from the key
210          * serial tree, if cursor is non-NULL then it will always point to a
211          * valid node in the tree - even if lock got dropped.
212          */
213         spin_lock(&key_serial_lock);
214         cursor = rb_first(&key_serial_tree);
215 
216 continue_scanning:
217         while (cursor) {
218                 key = rb_entry(cursor, struct key, serial_node);
219                 cursor = rb_next(cursor);
220 
221                 if (refcount_read(&key->usage) == 0)
222                         goto found_unreferenced_key;
223 
224                 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_1)) {
225                         if (key->type == key_gc_dead_keytype) {
226                                 gc_state |= KEY_GC_FOUND_DEAD_KEY;
227                                 set_bit(KEY_FLAG_DEAD, &key->flags);
228                                 key->perm = 0;
229                                 goto skip_dead_key;
230                         } else if (key->type == &key_type_keyring &&
231                                    key->restrict_link) {
232                                 goto found_restricted_keyring;
233                         }
234                 }
235 
236                 if (gc_state & KEY_GC_SET_TIMER) {
237                         if (key->expiry > limit && key->expiry < new_timer) {
238                                 kdebug("will expire %x in %lld",
239                                        key_serial(key), key->expiry - limit);
240                                 new_timer = key->expiry;
241                         }
242                 }
243 
244                 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2))
245                         if (key->type == key_gc_dead_keytype)
246                                 gc_state |= KEY_GC_FOUND_DEAD_KEY;
247 
248                 if ((gc_state & KEY_GC_REAPING_LINKS) ||
249                     unlikely(gc_state & KEY_GC_REAPING_DEAD_2)) {
250                         if (key->type == &key_type_keyring)
251                                 goto found_keyring;
252                 }
253 
254                 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3))
255                         if (key->type == key_gc_dead_keytype)
256                                 goto destroy_dead_key;
257 
258         skip_dead_key:
259                 if (spin_is_contended(&key_serial_lock) || need_resched())
260                         goto contended;
261         }
262 
263 contended:
264         spin_unlock(&key_serial_lock);
265 
266 maybe_resched:
267         if (cursor) {
268                 cond_resched();
269                 spin_lock(&key_serial_lock);
270                 goto continue_scanning;
271         }
272 
273         /* We've completed the pass.  Set the timer if we need to and queue a
274          * new cycle if necessary.  We keep executing cycles until we find one
275          * where we didn't reap any keys.
276          */
277         kdebug("pass complete");
278 
279         if (gc_state & KEY_GC_SET_TIMER && new_timer != (time64_t)TIME64_MAX) {
280                 new_timer += key_gc_delay;
281                 key_schedule_gc(new_timer);
282         }
283 
284         if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2) ||
285             !list_empty(&graveyard)) {
286                 /* Make sure that all pending keyring payload destructions are
287                  * fulfilled and that people aren't now looking at dead or
288                  * dying keys that they don't have a reference upon or a link
289                  * to.
290                  */
291                 kdebug("gc sync");
292                 synchronize_rcu();
293         }
294 
295         if (!list_empty(&graveyard)) {
296                 kdebug("gc keys");
297                 key_gc_unused_keys(&graveyard);
298         }
299 
300         if (unlikely(gc_state & (KEY_GC_REAPING_DEAD_1 |
301                                  KEY_GC_REAPING_DEAD_2))) {
302                 if (!(gc_state & KEY_GC_FOUND_DEAD_KEY)) {
303                         /* No remaining dead keys: short circuit the remaining
304                          * keytype reap cycles.
305                          */
306                         kdebug("dead short");
307                         gc_state &= ~(KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2);
308                         gc_state |= KEY_GC_REAPING_DEAD_3;
309                 } else {
310                         gc_state |= KEY_GC_REAP_AGAIN;
311                 }
312         }
313 
314         if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3)) {
315                 kdebug("dead wake");
316                 smp_mb();
317                 clear_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
318                 wake_up_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE);
319         }
320 
321         if (gc_state & KEY_GC_REAP_AGAIN)
322                 schedule_work(&key_gc_work);
323         kleave(" [end %x]", gc_state);
324         return;
325 
326         /* We found an unreferenced key - once we've removed it from the tree,
327          * we can safely drop the lock.
328          */
329 found_unreferenced_key:
330         kdebug("unrefd key %d", key->serial);
331         rb_erase(&key->serial_node, &key_serial_tree);
332         spin_unlock(&key_serial_lock);
333 
334         list_add_tail(&key->graveyard_link, &graveyard);
335         gc_state |= KEY_GC_REAP_AGAIN;
336         goto maybe_resched;
337 
338         /* We found a restricted keyring and need to update the restriction if
339          * it is associated with the dead key type.
340          */
341 found_restricted_keyring:
342         spin_unlock(&key_serial_lock);
343         keyring_restriction_gc(key, key_gc_dead_keytype);
344         goto maybe_resched;
345 
346         /* We found a keyring and we need to check the payload for links to
347          * dead or expired keys.  We don't flag another reap immediately as we
348          * have to wait for the old payload to be destroyed by RCU before we
349          * can reap the keys to which it refers.
350          */
351 found_keyring:
352         spin_unlock(&key_serial_lock);
353         keyring_gc(key, limit);
354         goto maybe_resched;
355 
356         /* We found a dead key that is still referenced.  Reset its type and
357          * destroy its payload with its semaphore held.
358          */
359 destroy_dead_key:
360         spin_unlock(&key_serial_lock);
361         kdebug("destroy key %d", key->serial);
362         down_write(&key->sem);
363         key->type = &key_type_dead;
364         if (key_gc_dead_keytype->destroy)
365                 key_gc_dead_keytype->destroy(key);
366         memset(&key->payload, KEY_DESTROY, sizeof(key->payload));
367         up_write(&key->sem);
368         goto maybe_resched;
369 }
370 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp