security/keys/gc.c

0001 // SPDX-License-Identifier: GPL-2.0-or-later
0002 /* Key garbage collector
0003  *
0004  * Copyright (C) 2009-2011 Red Hat, Inc. All Rights Reserved.
0005  * Written by David Howells (dhowells@redhat.com)
0006  */
0007
0008 #include <linux/slab.h>
0009 #include <linux/security.h>
0010 #include <keys/keyring-type.h>
0011 #include "internal.h"
0012
0013 /*
0014  * Delay between key revocation/expiry in seconds
0015  */
0016 unsigned key_gc_delay = 5 * 60;
0017
0018 /*
0019  * Reaper for unused keys.
0020  */
0021 static void key_garbage_collector(struct work_struct *work);
0022 DECLARE_WORK(key_gc_work, key_garbage_collector);
0023
0024 /*
0025  * Reaper for links from keyrings to dead keys.
0026  */
0027 static void key_gc_timer_func(struct timer_list *);
0028 static DEFINE_TIMER(key_gc_timer, key_gc_timer_func);
0029
0030 static time64_t key_gc_next_run = TIME64_MAX;
0031 static struct key_type *key_gc_dead_keytype;
0032
0033 static unsigned long key_gc_flags;
0034 #define KEY_GC_KEY_EXPIRED  0   /* A key expired and needs unlinking */
0035 #define KEY_GC_REAP_KEYTYPE 1   /* A keytype is being unregistered */
0036 #define KEY_GC_REAPING_KEYTYPE  2   /* Cleared when keytype reaped */
0037
0038
0039 /*
0040  * Any key whose type gets unregistered will be re-typed to this if it can't be
0041  * immediately unlinked.
0042  */
0043 struct key_type key_type_dead = {
0044     .name = ".dead",
0045 };
0046
0047 /*
0048  * Schedule a garbage collection run.
0049  * - time precision isn't particularly important
0050  */
0051 void key_schedule_gc(time64_t gc_at)
0052 {
0053     unsigned long expires;
0054     time64_t now = ktime_get_real_seconds();
0055
0056     kenter("%lld", gc_at - now);
0057
0058     if (gc_at <= now || test_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags)) {
0059         kdebug("IMMEDIATE");
0060         schedule_work(&key_gc_work);
0061     } else if (gc_at < key_gc_next_run) {
0062         kdebug("DEFERRED");
0063         key_gc_next_run = gc_at;
0064         expires = jiffies + (gc_at - now) * HZ;
0065         mod_timer(&key_gc_timer, expires);
0066     }
0067 }
0068
0069 /*
0070  * Schedule a dead links collection run.
0071  */
0072 void key_schedule_gc_links(void)
0073 {
0074     set_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags);
0075     schedule_work(&key_gc_work);
0076 }
0077
0078 /*
0079  * Some key's cleanup time was met after it expired, so we need to get the
0080  * reaper to go through a cycle finding expired keys.
0081  */
0082 static void key_gc_timer_func(struct timer_list *unused)
0083 {
0084     kenter("");
0085     key_gc_next_run = TIME64_MAX;
0086     key_schedule_gc_links();
0087 }
0088
0089 /*
0090  * Reap keys of dead type.
0091  *
0092  * We use three flags to make sure we see three complete cycles of the garbage
0093  * collector: the first to mark keys of that type as being dead, the second to
0094  * collect dead links and the third to clean up the dead keys.  We have to be
0095  * careful as there may already be a cycle in progress.
0096  *
0097  * The caller must be holding key_types_sem.
0098  */
0099 void key_gc_keytype(struct key_type *ktype)
0100 {
0101     kenter("%s", ktype->name);
0102
0103     key_gc_dead_keytype = ktype;
0104     set_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
0105     smp_mb();
0106     set_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags);
0107
0108     kdebug("schedule");
0109     schedule_work(&key_gc_work);
0110
0111     kdebug("sleep");
0112     wait_on_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE,
0113             TASK_UNINTERRUPTIBLE);
0114
0115     key_gc_dead_keytype = NULL;
0116     kleave("");
0117 }
0118
0119 /*
0120  * Garbage collect a list of unreferenced, detached keys
0121  */
0122 static noinline void key_gc_unused_keys(struct list_head *keys)
0123 {
0124     while (!list_empty(keys)) {
0125         struct key *key =
0126             list_entry(keys->next, struct key, graveyard_link);
0127         short state = key->state;
0128
0129         list_del(&key->graveyard_link);
0130
0131         kdebug("- %u", key->serial);
0132         key_check(key);
0133
0134 #ifdef CONFIG_KEY_NOTIFICATIONS
0135         remove_watch_list(key->watchers, key->serial);
0136         key->watchers = NULL;
0137 #endif
0138
0139         /* Throw away the key data if the key is instantiated */
0140         if (state == KEY_IS_POSITIVE && key->type->destroy)
0141             key->type->destroy(key);
0142
0143         security_key_free(key);
0144
0145         /* deal with the user's key tracking and quota */
0146         if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) {
0147             spin_lock(&key->user->lock);
0148             key->user->qnkeys--;
0149             key->user->qnbytes -= key->quotalen;
0150             spin_unlock(&key->user->lock);
0151         }
0152
0153         atomic_dec(&key->user->nkeys);
0154         if (state != KEY_IS_UNINSTANTIATED)
0155             atomic_dec(&key->user->nikeys);
0156
0157         key_user_put(key->user);
0158         key_put_tag(key->domain_tag);
0159         kfree(key->description);
0160
0161         memzero_explicit(key, sizeof(*key));
0162         kmem_cache_free(key_jar, key);
0163     }
0164 }
0165
0166 /*
0167  * Garbage collector for unused keys.
0168  *
0169  * This is done in process context so that we don't have to disable interrupts
0170  * all over the place.  key_put() schedules this rather than trying to do the
0171  * cleanup itself, which means key_put() doesn't have to sleep.
0172  */
0173 static void key_garbage_collector(struct work_struct *work)
0174 {
0175     static LIST_HEAD(graveyard);
0176     static u8 gc_state;     /* Internal persistent state */
0177 #define KEY_GC_REAP_AGAIN   0x01    /* - Need another cycle */
0178 #define KEY_GC_REAPING_LINKS    0x02    /* - We need to reap links */
0179 #define KEY_GC_SET_TIMER    0x04    /* - We need to restart the timer */
0180 #define KEY_GC_REAPING_DEAD_1   0x10    /* - We need to mark dead keys */
0181 #define KEY_GC_REAPING_DEAD_2   0x20    /* - We need to reap dead key links */
0182 #define KEY_GC_REAPING_DEAD_3   0x40    /* - We need to reap dead keys */
0183 #define KEY_GC_FOUND_DEAD_KEY   0x80    /* - We found at least one dead key */
0184
0185     struct rb_node *cursor;
0186     struct key *key;
0187     time64_t new_timer, limit;
0188
0189     kenter("[%lx,%x]", key_gc_flags, gc_state);
0190
0191     limit = ktime_get_real_seconds();
0192     if (limit > key_gc_delay)
0193         limit -= key_gc_delay;
0194     else
0195         limit = key_gc_delay;
0196
0197     /* Work out what we're going to be doing in this pass */
0198     gc_state &= KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2;
0199     gc_state <<= 1;
0200     if (test_and_clear_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags))
0201         gc_state |= KEY_GC_REAPING_LINKS | KEY_GC_SET_TIMER;
0202
0203     if (test_and_clear_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags))
0204         gc_state |= KEY_GC_REAPING_DEAD_1;
0205     kdebug("new pass %x", gc_state);
0206
0207     new_timer = TIME64_MAX;
0208
0209     /* As only this function is permitted to remove things from the key
0210      * serial tree, if cursor is non-NULL then it will always point to a
0211      * valid node in the tree - even if lock got dropped.
0212      */
0213     spin_lock(&key_serial_lock);
0214     cursor = rb_first(&key_serial_tree);
0215
0216 continue_scanning:
0217     while (cursor) {
0218         key = rb_entry(cursor, struct key, serial_node);
0219         cursor = rb_next(cursor);
0220
0221         if (refcount_read(&key->usage) == 0)
0222             goto found_unreferenced_key;
0223
0224         if (unlikely(gc_state & KEY_GC_REAPING_DEAD_1)) {
0225             if (key->type == key_gc_dead_keytype) {
0226                 gc_state |= KEY_GC_FOUND_DEAD_KEY;
0227                 set_bit(KEY_FLAG_DEAD, &key->flags);
0228                 key->perm = 0;
0229                 goto skip_dead_key;
0230             } else if (key->type == &key_type_keyring &&
0231                    key->restrict_link) {
0232                 goto found_restricted_keyring;
0233             }
0234         }
0235
0236         if (gc_state & KEY_GC_SET_TIMER) {
0237             if (key->expiry > limit && key->expiry < new_timer) {
0238                 kdebug("will expire %x in %lld",
0239                        key_serial(key), key->expiry - limit);
0240                 new_timer = key->expiry;
0241             }
0242         }
0243
0244         if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2))
0245             if (key->type == key_gc_dead_keytype)
0246                 gc_state |= KEY_GC_FOUND_DEAD_KEY;
0247
0248         if ((gc_state & KEY_GC_REAPING_LINKS) ||
0249             unlikely(gc_state & KEY_GC_REAPING_DEAD_2)) {
0250             if (key->type == &key_type_keyring)
0251                 goto found_keyring;
0252         }
0253
0254         if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3))
0255             if (key->type == key_gc_dead_keytype)
0256                 goto destroy_dead_key;
0257
0258     skip_dead_key:
0259         if (spin_is_contended(&key_serial_lock) || need_resched())
0260             goto contended;
0261     }
0262
0263 contended:
0264     spin_unlock(&key_serial_lock);
0265
0266 maybe_resched:
0267     if (cursor) {
0268         cond_resched();
0269         spin_lock(&key_serial_lock);
0270         goto continue_scanning;
0271     }
0272
0273     /* We've completed the pass.  Set the timer if we need to and queue a
0274      * new cycle if necessary.  We keep executing cycles until we find one
0275      * where we didn't reap any keys.
0276      */
0277     kdebug("pass complete");
0278
0279     if (gc_state & KEY_GC_SET_TIMER && new_timer != (time64_t)TIME64_MAX) {
0280         new_timer += key_gc_delay;
0281         key_schedule_gc(new_timer);
0282     }
0283
0284     if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2) ||
0285         !list_empty(&graveyard)) {
0286         /* Make sure that all pending keyring payload destructions are
0287          * fulfilled and that people aren't now looking at dead or
0288          * dying keys that they don't have a reference upon or a link
0289          * to.
0290          */
0291         kdebug("gc sync");
0292         synchronize_rcu();
0293     }
0294
0295     if (!list_empty(&graveyard)) {
0296         kdebug("gc keys");
0297         key_gc_unused_keys(&graveyard);
0298     }
0299
0300     if (unlikely(gc_state & (KEY_GC_REAPING_DEAD_1 |
0301                  KEY_GC_REAPING_DEAD_2))) {
0302         if (!(gc_state & KEY_GC_FOUND_DEAD_KEY)) {
0303             /* No remaining dead keys: short circuit the remaining
0304              * keytype reap cycles.
0305              */
0306             kdebug("dead short");
0307             gc_state &= ~(KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2);
0308             gc_state |= KEY_GC_REAPING_DEAD_3;
0309         } else {
0310             gc_state |= KEY_GC_REAP_AGAIN;
0311         }
0312     }
0313
0314     if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3)) {
0315         kdebug("dead wake");
0316         smp_mb();
0317         clear_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
0318         wake_up_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE);
0319     }
0320
0321     if (gc_state & KEY_GC_REAP_AGAIN)
0322         schedule_work(&key_gc_work);
0323     kleave(" [end %x]", gc_state);
0324     return;
0325
0326     /* We found an unreferenced key - once we've removed it from the tree,
0327      * we can safely drop the lock.
0328      */
0329 found_unreferenced_key:
0330     kdebug("unrefd key %d", key->serial);
0331     rb_erase(&key->serial_node, &key_serial_tree);
0332     spin_unlock(&key_serial_lock);
0333
0334     list_add_tail(&key->graveyard_link, &graveyard);
0335     gc_state |= KEY_GC_REAP_AGAIN;
0336     goto maybe_resched;
0337
0338     /* We found a restricted keyring and need to update the restriction if
0339      * it is associated with the dead key type.
0340      */
0341 found_restricted_keyring:
0342     spin_unlock(&key_serial_lock);
0343     keyring_restriction_gc(key, key_gc_dead_keytype);
0344     goto maybe_resched;
0345
0346     /* We found a keyring and we need to check the payload for links to
0347      * dead or expired keys.  We don't flag another reap immediately as we
0348      * have to wait for the old payload to be destroyed by RCU before we
0349      * can reap the keys to which it refers.
0350      */
0351 found_keyring:
0352     spin_unlock(&key_serial_lock);
0353     keyring_gc(key, limit);
0354     goto maybe_resched;
0355
0356     /* We found a dead key that is still referenced.  Reset its type and
0357      * destroy its payload with its semaphore held.
0358      */
0359 destroy_dead_key:
0360     spin_unlock(&key_serial_lock);
0361     kdebug("destroy key %d", key->serial);
0362     down_write(&key->sem);
0363     key->type = &key_type_dead;
0364     if (key_gc_dead_keytype->destroy)
0365         key_gc_dead_keytype->destroy(key);
0366     memset(&key->payload, KEY_DESTROY, sizeof(key->payload));
0367     up_write(&key->sem);
0368     goto maybe_resched;
0369 }