audit: complex interfield comparison helper
[linux-2.6/linux-acpi-2.6/ibm-acpi-2.6.git] / security / keys / gc.c
blobbf4d8da5a79502f626a849473e4af18e229eb074
1 /* Key garbage collector
3 * Copyright (C) 2009-2011 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public Licence
8 * as published by the Free Software Foundation; either version
9 * 2 of the Licence, or (at your option) any later version.
12 #include <linux/module.h>
13 #include <linux/slab.h>
14 #include <linux/security.h>
15 #include <keys/keyring-type.h>
16 #include "internal.h"
19 * Delay between key revocation/expiry in seconds
21 unsigned key_gc_delay = 5 * 60;
24 * Reaper for unused keys.
26 static void key_garbage_collector(struct work_struct *work);
27 DECLARE_WORK(key_gc_work, key_garbage_collector);
30 * Reaper for links from keyrings to dead keys.
32 static void key_gc_timer_func(unsigned long);
33 static DEFINE_TIMER(key_gc_timer, key_gc_timer_func, 0, 0);
35 static time_t key_gc_next_run = LONG_MAX;
36 static struct key_type *key_gc_dead_keytype;
38 static unsigned long key_gc_flags;
39 #define KEY_GC_KEY_EXPIRED 0 /* A key expired and needs unlinking */
40 #define KEY_GC_REAP_KEYTYPE 1 /* A keytype is being unregistered */
41 #define KEY_GC_REAPING_KEYTYPE 2 /* Cleared when keytype reaped */
45 * Any key whose type gets unregistered will be re-typed to this if it can't be
46 * immediately unlinked.
48 struct key_type key_type_dead = {
49 .name = "dead",
53 * Schedule a garbage collection run.
54 * - time precision isn't particularly important
56 void key_schedule_gc(time_t gc_at)
58 unsigned long expires;
59 time_t now = current_kernel_time().tv_sec;
61 kenter("%ld", gc_at - now);
63 if (gc_at <= now || test_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags)) {
64 kdebug("IMMEDIATE");
65 queue_work(system_nrt_wq, &key_gc_work);
66 } else if (gc_at < key_gc_next_run) {
67 kdebug("DEFERRED");
68 key_gc_next_run = gc_at;
69 expires = jiffies + (gc_at - now) * HZ;
70 mod_timer(&key_gc_timer, expires);
75 * Some key's cleanup time was met after it expired, so we need to get the
76 * reaper to go through a cycle finding expired keys.
78 static void key_gc_timer_func(unsigned long data)
80 kenter("");
81 key_gc_next_run = LONG_MAX;
82 set_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags);
83 queue_work(system_nrt_wq, &key_gc_work);
87 * wait_on_bit() sleep function for uninterruptible waiting
89 static int key_gc_wait_bit(void *flags)
91 schedule();
92 return 0;
96 * Reap keys of dead type.
98 * We use three flags to make sure we see three complete cycles of the garbage
99 * collector: the first to mark keys of that type as being dead, the second to
100 * collect dead links and the third to clean up the dead keys. We have to be
101 * careful as there may already be a cycle in progress.
103 * The caller must be holding key_types_sem.
105 void key_gc_keytype(struct key_type *ktype)
107 kenter("%s", ktype->name);
109 key_gc_dead_keytype = ktype;
110 set_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
111 smp_mb();
112 set_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags);
114 kdebug("schedule");
115 queue_work(system_nrt_wq, &key_gc_work);
117 kdebug("sleep");
118 wait_on_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE, key_gc_wait_bit,
119 TASK_UNINTERRUPTIBLE);
121 key_gc_dead_keytype = NULL;
122 kleave("");
126 * Garbage collect pointers from a keyring.
128 * Not called with any locks held. The keyring's key struct will not be
129 * deallocated under us as only our caller may deallocate it.
131 static void key_gc_keyring(struct key *keyring, time_t limit)
133 struct keyring_list *klist;
134 struct key *key;
135 int loop;
137 kenter("%x", key_serial(keyring));
139 if (test_bit(KEY_FLAG_REVOKED, &keyring->flags))
140 goto dont_gc;
142 /* scan the keyring looking for dead keys */
143 rcu_read_lock();
144 klist = rcu_dereference(keyring->payload.subscriptions);
145 if (!klist)
146 goto unlock_dont_gc;
148 for (loop = klist->nkeys - 1; loop >= 0; loop--) {
149 key = klist->keys[loop];
150 if (test_bit(KEY_FLAG_DEAD, &key->flags) ||
151 (key->expiry > 0 && key->expiry <= limit))
152 goto do_gc;
155 unlock_dont_gc:
156 rcu_read_unlock();
157 dont_gc:
158 kleave(" [no gc]");
159 return;
161 do_gc:
162 rcu_read_unlock();
164 keyring_gc(keyring, limit);
165 kleave(" [gc]");
169 * Garbage collect an unreferenced, detached key
171 static noinline void key_gc_unused_key(struct key *key)
173 key_check(key);
175 security_key_free(key);
177 /* deal with the user's key tracking and quota */
178 if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) {
179 spin_lock(&key->user->lock);
180 key->user->qnkeys--;
181 key->user->qnbytes -= key->quotalen;
182 spin_unlock(&key->user->lock);
185 atomic_dec(&key->user->nkeys);
186 if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
187 atomic_dec(&key->user->nikeys);
189 key_user_put(key->user);
191 /* now throw away the key memory */
192 if (key->type->destroy)
193 key->type->destroy(key);
195 kfree(key->description);
197 #ifdef KEY_DEBUGGING
198 key->magic = KEY_DEBUG_MAGIC_X;
199 #endif
200 kmem_cache_free(key_jar, key);
204 * Garbage collector for unused keys.
206 * This is done in process context so that we don't have to disable interrupts
207 * all over the place. key_put() schedules this rather than trying to do the
208 * cleanup itself, which means key_put() doesn't have to sleep.
210 static void key_garbage_collector(struct work_struct *work)
212 static u8 gc_state; /* Internal persistent state */
213 #define KEY_GC_REAP_AGAIN 0x01 /* - Need another cycle */
214 #define KEY_GC_REAPING_LINKS 0x02 /* - We need to reap links */
215 #define KEY_GC_SET_TIMER 0x04 /* - We need to restart the timer */
216 #define KEY_GC_REAPING_DEAD_1 0x10 /* - We need to mark dead keys */
217 #define KEY_GC_REAPING_DEAD_2 0x20 /* - We need to reap dead key links */
218 #define KEY_GC_REAPING_DEAD_3 0x40 /* - We need to reap dead keys */
219 #define KEY_GC_FOUND_DEAD_KEY 0x80 /* - We found at least one dead key */
221 struct rb_node *cursor;
222 struct key *key;
223 time_t new_timer, limit;
225 kenter("[%lx,%x]", key_gc_flags, gc_state);
227 limit = current_kernel_time().tv_sec;
228 if (limit > key_gc_delay)
229 limit -= key_gc_delay;
230 else
231 limit = key_gc_delay;
233 /* Work out what we're going to be doing in this pass */
234 gc_state &= KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2;
235 gc_state <<= 1;
236 if (test_and_clear_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags))
237 gc_state |= KEY_GC_REAPING_LINKS | KEY_GC_SET_TIMER;
239 if (test_and_clear_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags))
240 gc_state |= KEY_GC_REAPING_DEAD_1;
241 kdebug("new pass %x", gc_state);
243 new_timer = LONG_MAX;
245 /* As only this function is permitted to remove things from the key
246 * serial tree, if cursor is non-NULL then it will always point to a
247 * valid node in the tree - even if lock got dropped.
249 spin_lock(&key_serial_lock);
250 cursor = rb_first(&key_serial_tree);
252 continue_scanning:
253 while (cursor) {
254 key = rb_entry(cursor, struct key, serial_node);
255 cursor = rb_next(cursor);
257 if (atomic_read(&key->usage) == 0)
258 goto found_unreferenced_key;
260 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_1)) {
261 if (key->type == key_gc_dead_keytype) {
262 gc_state |= KEY_GC_FOUND_DEAD_KEY;
263 set_bit(KEY_FLAG_DEAD, &key->flags);
264 key->perm = 0;
265 goto skip_dead_key;
269 if (gc_state & KEY_GC_SET_TIMER) {
270 if (key->expiry > limit && key->expiry < new_timer) {
271 kdebug("will expire %x in %ld",
272 key_serial(key), key->expiry - limit);
273 new_timer = key->expiry;
277 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2))
278 if (key->type == key_gc_dead_keytype)
279 gc_state |= KEY_GC_FOUND_DEAD_KEY;
281 if ((gc_state & KEY_GC_REAPING_LINKS) ||
282 unlikely(gc_state & KEY_GC_REAPING_DEAD_2)) {
283 if (key->type == &key_type_keyring)
284 goto found_keyring;
287 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3))
288 if (key->type == key_gc_dead_keytype)
289 goto destroy_dead_key;
291 skip_dead_key:
292 if (spin_is_contended(&key_serial_lock) || need_resched())
293 goto contended;
296 contended:
297 spin_unlock(&key_serial_lock);
299 maybe_resched:
300 if (cursor) {
301 cond_resched();
302 spin_lock(&key_serial_lock);
303 goto continue_scanning;
306 /* We've completed the pass. Set the timer if we need to and queue a
307 * new cycle if necessary. We keep executing cycles until we find one
308 * where we didn't reap any keys.
310 kdebug("pass complete");
312 if (gc_state & KEY_GC_SET_TIMER && new_timer != (time_t)LONG_MAX) {
313 new_timer += key_gc_delay;
314 key_schedule_gc(new_timer);
317 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2)) {
318 /* Make sure everyone revalidates their keys if we marked a
319 * bunch as being dead and make sure all keyring ex-payloads
320 * are destroyed.
322 kdebug("dead sync");
323 synchronize_rcu();
326 if (unlikely(gc_state & (KEY_GC_REAPING_DEAD_1 |
327 KEY_GC_REAPING_DEAD_2))) {
328 if (!(gc_state & KEY_GC_FOUND_DEAD_KEY)) {
329 /* No remaining dead keys: short circuit the remaining
330 * keytype reap cycles.
332 kdebug("dead short");
333 gc_state &= ~(KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2);
334 gc_state |= KEY_GC_REAPING_DEAD_3;
335 } else {
336 gc_state |= KEY_GC_REAP_AGAIN;
340 if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3)) {
341 kdebug("dead wake");
342 smp_mb();
343 clear_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
344 wake_up_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE);
347 if (gc_state & KEY_GC_REAP_AGAIN)
348 queue_work(system_nrt_wq, &key_gc_work);
349 kleave(" [end %x]", gc_state);
350 return;
352 /* We found an unreferenced key - once we've removed it from the tree,
353 * we can safely drop the lock.
355 found_unreferenced_key:
356 kdebug("unrefd key %d", key->serial);
357 rb_erase(&key->serial_node, &key_serial_tree);
358 spin_unlock(&key_serial_lock);
360 key_gc_unused_key(key);
361 gc_state |= KEY_GC_REAP_AGAIN;
362 goto maybe_resched;
364 /* We found a keyring and we need to check the payload for links to
365 * dead or expired keys. We don't flag another reap immediately as we
366 * have to wait for the old payload to be destroyed by RCU before we
367 * can reap the keys to which it refers.
369 found_keyring:
370 spin_unlock(&key_serial_lock);
371 kdebug("scan keyring %d", key->serial);
372 key_gc_keyring(key, limit);
373 goto maybe_resched;
375 /* We found a dead key that is still referenced. Reset its type and
376 * destroy its payload with its semaphore held.
378 destroy_dead_key:
379 spin_unlock(&key_serial_lock);
380 kdebug("destroy key %d", key->serial);
381 down_write(&key->sem);
382 key->type = &key_type_dead;
383 if (key_gc_dead_keytype->destroy)
384 key_gc_dead_keytype->destroy(key);
385 memset(&key->payload, KEY_DESTROY, sizeof(key->payload));
386 up_write(&key->sem);
387 goto maybe_resched;