1// SPDX-License-Identifier: GPL-2.0-or-later
2/* Key garbage collector
3 *
4 * Copyright (C) 2009-2011 Red Hat, Inc. All Rights Reserved.
5 * Written by David Howells (dhowells@redhat.com)
6 */
7
8#include <linux/slab.h>
9#include <linux/security.h>
10#include <keys/keyring-type.h>
11#include "internal.h"
12
13/*
14 * Delay between key revocation/expiry in seconds
15 */
16unsigned key_gc_delay = 5 * 60;
17
18/*
19 * Reaper for unused keys.
20 */
21static void key_garbage_collector(struct work_struct *work);
22DECLARE_WORK(key_gc_work, key_garbage_collector);
23
24/*
25 * Reaper for links from keyrings to dead keys.
26 */
27static void key_gc_timer_func(struct timer_list *);
28static DEFINE_TIMER(key_gc_timer, key_gc_timer_func);
29
30static time64_t key_gc_next_run = TIME64_MAX;
31static struct key_type *key_gc_dead_keytype;
32
33static unsigned long key_gc_flags;
34#define KEY_GC_KEY_EXPIRED	0	/* A key expired and needs unlinking */
35#define KEY_GC_REAP_KEYTYPE	1	/* A keytype is being unregistered */
36#define KEY_GC_REAPING_KEYTYPE	2	/* Cleared when keytype reaped */
37
38
39/*
40 * Any key whose type gets unregistered will be re-typed to this if it can't be
41 * immediately unlinked.
42 */
43struct key_type key_type_dead = {
44	.name = ".dead",
45};
46
47/*
48 * Schedule a garbage collection run.
49 * - time precision isn't particularly important
50 */
51void key_schedule_gc(time64_t gc_at)
52{
53	unsigned long expires;
54	time64_t now = ktime_get_real_seconds();
55
56	kenter("%lld", gc_at - now);
57
58	if (gc_at <= now || test_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags)) {
59		kdebug("IMMEDIATE");
60		schedule_work(&key_gc_work);
61	} else if (gc_at < key_gc_next_run) {
62		kdebug("DEFERRED");
63		key_gc_next_run = gc_at;
64		expires = jiffies + (gc_at - now) * HZ;
65		mod_timer(&key_gc_timer, expires);
66	}
67}
68
69/*
70 * Set the expiration time on a key.
71 */
72void key_set_expiry(struct key *key, time64_t expiry)
73{
74	key->expiry = expiry;
75	if (expiry != TIME64_MAX) {
76		if (!(key->type->flags & KEY_TYPE_INSTANT_REAP))
77			expiry += key_gc_delay;
78		key_schedule_gc(expiry);
79	}
80}
81
82/*
83 * Schedule a dead links collection run.
84 */
85void key_schedule_gc_links(void)
86{
87	set_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags);
88	schedule_work(&key_gc_work);
89}
90
91/*
92 * Some key's cleanup time was met after it expired, so we need to get the
93 * reaper to go through a cycle finding expired keys.
94 */
95static void key_gc_timer_func(struct timer_list *unused)
96{
97	kenter("");
98	key_gc_next_run = TIME64_MAX;
99	key_schedule_gc_links();
100}
101
102/*
103 * Reap keys of dead type.
104 *
105 * We use three flags to make sure we see three complete cycles of the garbage
106 * collector: the first to mark keys of that type as being dead, the second to
107 * collect dead links and the third to clean up the dead keys.  We have to be
108 * careful as there may already be a cycle in progress.
109 *
110 * The caller must be holding key_types_sem.
111 */
112void key_gc_keytype(struct key_type *ktype)
113{
114	kenter("%s", ktype->name);
115
116	key_gc_dead_keytype = ktype;
117	set_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
118	smp_mb();
119	set_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags);
120
121	kdebug("schedule");
122	schedule_work(&key_gc_work);
123
124	kdebug("sleep");
125	wait_on_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE,
126		    TASK_UNINTERRUPTIBLE);
127
128	key_gc_dead_keytype = NULL;
129	kleave("");
130}
131
132/*
133 * Garbage collect a list of unreferenced, detached keys
134 */
135static noinline void key_gc_unused_keys(struct list_head *keys)
136{
137	while (!list_empty(keys)) {
138		struct key *key =
139			list_entry(keys->next, struct key, graveyard_link);
140		short state = key->state;
141
142		list_del(&key->graveyard_link);
143
144		kdebug("- %u", key->serial);
145		key_check(key);
146
147#ifdef CONFIG_KEY_NOTIFICATIONS
148		remove_watch_list(key->watchers, key->serial);
149		key->watchers = NULL;
150#endif
151
152		/* Throw away the key data if the key is instantiated */
153		if (state == KEY_IS_POSITIVE && key->type->destroy)
154			key->type->destroy(key);
155
156		security_key_free(key);
157
158		/* deal with the user's key tracking and quota */
159		if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) {
160			spin_lock(&key->user->lock);
161			key->user->qnkeys--;
162			key->user->qnbytes -= key->quotalen;
163			spin_unlock(&key->user->lock);
164		}
165
166		atomic_dec(&key->user->nkeys);
167		if (state != KEY_IS_UNINSTANTIATED)
168			atomic_dec(&key->user->nikeys);
169
170		key_user_put(key->user);
171		key_put_tag(key->domain_tag);
172		kfree(key->description);
173
174		memzero_explicit(key, sizeof(*key));
175		kmem_cache_free(key_jar, key);
176	}
177}
178
179/*
180 * Garbage collector for unused keys.
181 *
182 * This is done in process context so that we don't have to disable interrupts
183 * all over the place.  key_put() schedules this rather than trying to do the
184 * cleanup itself, which means key_put() doesn't have to sleep.
185 */
186static void key_garbage_collector(struct work_struct *work)
187{
188	static LIST_HEAD(graveyard);
189	static u8 gc_state;		/* Internal persistent state */
190#define KEY_GC_REAP_AGAIN	0x01	/* - Need another cycle */
191#define KEY_GC_REAPING_LINKS	0x02	/* - We need to reap links */
192#define KEY_GC_REAPING_DEAD_1	0x10	/* - We need to mark dead keys */
193#define KEY_GC_REAPING_DEAD_2	0x20	/* - We need to reap dead key links */
194#define KEY_GC_REAPING_DEAD_3	0x40	/* - We need to reap dead keys */
195#define KEY_GC_FOUND_DEAD_KEY	0x80	/* - We found at least one dead key */
196
197	struct rb_node *cursor;
198	struct key *key;
199	time64_t new_timer, limit, expiry;
200
201	kenter("[%lx,%x]", key_gc_flags, gc_state);
202
203	limit = ktime_get_real_seconds();
204
205	/* Work out what we're going to be doing in this pass */
206	gc_state &= KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2;
207	gc_state <<= 1;
208	if (test_and_clear_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags))
209		gc_state |= KEY_GC_REAPING_LINKS;
210
211	if (test_and_clear_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags))
212		gc_state |= KEY_GC_REAPING_DEAD_1;
213	kdebug("new pass %x", gc_state);
214
215	new_timer = TIME64_MAX;
216
217	/* As only this function is permitted to remove things from the key
218	 * serial tree, if cursor is non-NULL then it will always point to a
219	 * valid node in the tree - even if lock got dropped.
220	 */
221	spin_lock(&key_serial_lock);
222	cursor = rb_first(&key_serial_tree);
223
224continue_scanning:
225	while (cursor) {
226		key = rb_entry(cursor, struct key, serial_node);
227		cursor = rb_next(cursor);
228
229		if (refcount_read(&key->usage) == 0)
230			goto found_unreferenced_key;
231
232		if (unlikely(gc_state & KEY_GC_REAPING_DEAD_1)) {
233			if (key->type == key_gc_dead_keytype) {
234				gc_state |= KEY_GC_FOUND_DEAD_KEY;
235				set_bit(KEY_FLAG_DEAD, &key->flags);
236				key->perm = 0;
237				goto skip_dead_key;
238			} else if (key->type == &key_type_keyring &&
239				   key->restrict_link) {
240				goto found_restricted_keyring;
241			}
242		}
243
244		expiry = key->expiry;
245		if (expiry != TIME64_MAX) {
246			if (!(key->type->flags & KEY_TYPE_INSTANT_REAP))
247				expiry += key_gc_delay;
248			if (expiry > limit && expiry < new_timer) {
249				kdebug("will expire %x in %lld",
250				       key_serial(key), key->expiry - limit);
251				new_timer = key->expiry;
252			}
253		}
254
255		if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2))
256			if (key->type == key_gc_dead_keytype)
257				gc_state |= KEY_GC_FOUND_DEAD_KEY;
258
259		if ((gc_state & KEY_GC_REAPING_LINKS) ||
260		    unlikely(gc_state & KEY_GC_REAPING_DEAD_2)) {
261			if (key->type == &key_type_keyring)
262				goto found_keyring;
263		}
264
265		if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3))
266			if (key->type == key_gc_dead_keytype)
267				goto destroy_dead_key;
268
269	skip_dead_key:
270		if (spin_is_contended(&key_serial_lock) || need_resched())
271			goto contended;
272	}
273
274contended:
275	spin_unlock(&key_serial_lock);
276
277maybe_resched:
278	if (cursor) {
279		cond_resched();
280		spin_lock(&key_serial_lock);
281		goto continue_scanning;
282	}
283
284	/* We've completed the pass.  Set the timer if we need to and queue a
285	 * new cycle if necessary.  We keep executing cycles until we find one
286	 * where we didn't reap any keys.
287	 */
288	kdebug("pass complete");
289
290	if (new_timer != TIME64_MAX) {
291		new_timer += key_gc_delay;
292		key_schedule_gc(new_timer);
293	}
294
295	if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2) ||
296	    !list_empty(&graveyard)) {
297		/* Make sure that all pending keyring payload destructions are
298		 * fulfilled and that people aren't now looking at dead or
299		 * dying keys that they don't have a reference upon or a link
300		 * to.
301		 */
302		kdebug("gc sync");
303		synchronize_rcu();
304	}
305
306	if (!list_empty(&graveyard)) {
307		kdebug("gc keys");
308		key_gc_unused_keys(&graveyard);
309	}
310
311	if (unlikely(gc_state & (KEY_GC_REAPING_DEAD_1 |
312				 KEY_GC_REAPING_DEAD_2))) {
313		if (!(gc_state & KEY_GC_FOUND_DEAD_KEY)) {
314			/* No remaining dead keys: short circuit the remaining
315			 * keytype reap cycles.
316			 */
317			kdebug("dead short");
318			gc_state &= ~(KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2);
319			gc_state |= KEY_GC_REAPING_DEAD_3;
320		} else {
321			gc_state |= KEY_GC_REAP_AGAIN;
322		}
323	}
324
325	if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3)) {
326		kdebug("dead wake");
327		smp_mb();
328		clear_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
329		wake_up_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE);
330	}
331
332	if (gc_state & KEY_GC_REAP_AGAIN)
333		schedule_work(&key_gc_work);
334	kleave(" [end %x]", gc_state);
335	return;
336
337	/* We found an unreferenced key - once we've removed it from the tree,
338	 * we can safely drop the lock.
339	 */
340found_unreferenced_key:
341	kdebug("unrefd key %d", key->serial);
342	rb_erase(&key->serial_node, &key_serial_tree);
343	spin_unlock(&key_serial_lock);
344
345	list_add_tail(&key->graveyard_link, &graveyard);
346	gc_state |= KEY_GC_REAP_AGAIN;
347	goto maybe_resched;
348
349	/* We found a restricted keyring and need to update the restriction if
350	 * it is associated with the dead key type.
351	 */
352found_restricted_keyring:
353	spin_unlock(&key_serial_lock);
354	keyring_restriction_gc(key, key_gc_dead_keytype);
355	goto maybe_resched;
356
357	/* We found a keyring and we need to check the payload for links to
358	 * dead or expired keys.  We don't flag another reap immediately as we
359	 * have to wait for the old payload to be destroyed by RCU before we
360	 * can reap the keys to which it refers.
361	 */
362found_keyring:
363	spin_unlock(&key_serial_lock);
364	keyring_gc(key, limit);
365	goto maybe_resched;
366
367	/* We found a dead key that is still referenced.  Reset its type and
368	 * destroy its payload with its semaphore held.
369	 */
370destroy_dead_key:
371	spin_unlock(&key_serial_lock);
372	kdebug("destroy key %d", key->serial);
373	down_write(&key->sem);
374	key->type = &key_type_dead;
375	if (key_gc_dead_keytype->destroy)
376		key_gc_dead_keytype->destroy(key);
377	memset(&key->payload, KEY_DESTROY, sizeof(key->payload));
378	up_write(&key->sem);
379	goto maybe_resched;
380}
381