[linux-block.git] / security / keys / gc.c

// SPDX-License-Identifier: GPL-2.0-or-later
/* Key garbage collector
 *
 * Copyright (C) 2009-2011 Red Hat, Inc. All Rights Reserved.
 * Written by David Howells (dhowells@redhat.com)
 */

#include <linux/slab.h>
#include <linux/security.h>
#include <keys/keyring-type.h>
#include "internal.h"

/*
 * Delay between key revocation/expiry in seconds
 */
unsigned key_gc_delay = 5 * 60;

/*
 * Reaper for unused keys.
 */
static void key_garbage_collector(struct work_struct *work);
DECLARE_WORK(key_gc_work, key_garbage_collector);

/*
 * Reaper for links from keyrings to dead keys.
 */
static void key_gc_timer_func(struct timer_list *);
static DEFINE_TIMER(key_gc_timer, key_gc_timer_func);

static time64_t key_gc_next_run = TIME64_MAX;
static struct key_type *key_gc_dead_keytype;

static unsigned long key_gc_flags;
#define KEY_GC_KEY_EXPIRED	0	/* A key expired and needs unlinking */
#define KEY_GC_REAP_KEYTYPE	1	/* A keytype is being unregistered */
#define KEY_GC_REAPING_KEYTYPE	2	/* Cleared when keytype reaped */


/*
 * Any key whose type gets unregistered will be re-typed to this if it can't be
 * immediately unlinked.
 */
struct key_type key_type_dead = {
	.name = ".dead",
};

/*
 * Schedule a garbage collection run.
 * - time precision isn't particularly important
 */
void key_schedule_gc(time64_t gc_at)
{
	unsigned long expires;
	time64_t now = ktime_get_real_seconds();

	kenter("%lld", gc_at - now);

	if (gc_at <= now || test_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags)) {
		kdebug("IMMEDIATE");
		schedule_work(&key_gc_work);
	} else if (gc_at < key_gc_next_run) {
		kdebug("DEFERRED");
		key_gc_next_run = gc_at;
		expires = jiffies + (gc_at - now) * HZ;
		mod_timer(&key_gc_timer, expires);
	}
}

/*
 * Schedule a dead links collection run.
 */
void key_schedule_gc_links(void)
{
	set_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags);
	schedule_work(&key_gc_work);
}

/*
 * Some key's cleanup time was met after it expired, so we need to get the
 * reaper to go through a cycle finding expired keys.
 */
static void key_gc_timer_func(struct timer_list *unused)
{
	kenter("");
	key_gc_next_run = TIME64_MAX;
	key_schedule_gc_links();
}

/*
 * Reap keys of dead type.
 *
 * We use three flags to make sure we see three complete cycles of the garbage
 * collector: the first to mark keys of that type as being dead, the second to
 * collect dead links and the third to clean up the dead keys.  We have to be
 * careful as there may already be a cycle in progress.
 *
 * The caller must be holding key_types_sem.
 */
void key_gc_keytype(struct key_type *ktype)
{
	kenter("%s", ktype->name);

	key_gc_dead_keytype = ktype;
	set_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
	smp_mb();
	set_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags);

	kdebug("schedule");
	schedule_work(&key_gc_work);

	kdebug("sleep");
	wait_on_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE,
		    TASK_UNINTERRUPTIBLE);

	key_gc_dead_keytype = NULL;
	kleave("");
}

/*
 * Garbage collect a list of unreferenced, detached keys
 */
static noinline void key_gc_unused_keys(struct list_head *keys)
{
	while (!list_empty(keys)) {
		struct key *key =
			list_entry(keys->next, struct key, graveyard_link);
		short state = key->state;

		list_del(&key->graveyard_link);

		kdebug("- %u", key->serial);
		key_check(key);

#ifdef CONFIG_KEY_NOTIFICATIONS
		remove_watch_list(key->watchers, key->serial);
		key->watchers = NULL;
#endif

		/* Throw away the key data if the key is instantiated */
		if (state == KEY_IS_POSITIVE && key->type->destroy)
			key->type->destroy(key);

		security_key_free(key);

		/* deal with the user's key tracking and quota */
		if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) {
			spin_lock(&key->user->lock);
			key->user->qnkeys--;
			key->user->qnbytes -= key->quotalen;
			spin_unlock(&key->user->lock);
		}

		atomic_dec(&key->user->nkeys);
		if (state != KEY_IS_UNINSTANTIATED)
			atomic_dec(&key->user->nikeys);

		key_user_put(key->user);
		key_put_tag(key->domain_tag);
		kfree(key->description);

		memzero_explicit(key, sizeof(*key));
		kmem_cache_free(key_jar, key);
	}
}

/*
 * Garbage collector for unused keys.
 *
 * This is done in process context so that we don't have to disable interrupts
 * all over the place.  key_put() schedules this rather than trying to do the
 * cleanup itself, which means key_put() doesn't have to sleep.
 */
static void key_garbage_collector(struct work_struct *work)
{
	static LIST_HEAD(graveyard);
	static u8 gc_state;		/* Internal persistent state */
#define KEY_GC_REAP_AGAIN	0x01	/* - Need another cycle */
#define KEY_GC_REAPING_LINKS	0x02	/* - We need to reap links */
#define KEY_GC_SET_TIMER	0x04	/* - We need to restart the timer */
#define KEY_GC_REAPING_DEAD_1	0x10	/* - We need to mark dead keys */
#define KEY_GC_REAPING_DEAD_2	0x20	/* - We need to reap dead key links */
#define KEY_GC_REAPING_DEAD_3	0x40	/* - We need to reap dead keys */
#define KEY_GC_FOUND_DEAD_KEY	0x80	/* - We found at least one dead key */

	struct rb_node *cursor;
	struct key *key;
	time64_t new_timer, limit;

	kenter("[%lx,%x]", key_gc_flags, gc_state);

	limit = ktime_get_real_seconds();
	if (limit > key_gc_delay)
		limit -= key_gc_delay;
	else
		limit = key_gc_delay;

	/* Work out what we're going to be doing in this pass */
	gc_state &= KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2;
	gc_state <<= 1;
	if (test_and_clear_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags))
		gc_state |= KEY_GC_REAPING_LINKS | KEY_GC_SET_TIMER;

	if (test_and_clear_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags))
		gc_state |= KEY_GC_REAPING_DEAD_1;
	kdebug("new pass %x", gc_state);

	new_timer = TIME64_MAX;

	/* As only this function is permitted to remove things from the key
	 * serial tree, if cursor is non-NULL then it will always point to a
	 * valid node in the tree - even if lock got dropped.
	 */
	spin_lock(&key_serial_lock);
	cursor = rb_first(&key_serial_tree);

continue_scanning:
	while (cursor) {
		key = rb_entry(cursor, struct key, serial_node);
		cursor = rb_next(cursor);

		if (refcount_read(&key->usage) == 0)
			goto found_unreferenced_key;

		if (unlikely(gc_state & KEY_GC_REAPING_DEAD_1)) {
			if (key->type == key_gc_dead_keytype) {
				gc_state |= KEY_GC_FOUND_DEAD_KEY;
				set_bit(KEY_FLAG_DEAD, &key->flags);
				key->perm = 0;
				goto skip_dead_key;
			} else if (key->type == &key_type_keyring &&
				   key->restrict_link) {
				goto found_restricted_keyring;
			}
		}

		if (gc_state & KEY_GC_SET_TIMER) {
			if (key->expiry > limit && key->expiry < new_timer) {
				kdebug("will expire %x in %lld",
				       key_serial(key), key->expiry - limit);
				new_timer = key->expiry;
			}
		}

		if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2))
			if (key->type == key_gc_dead_keytype)
				gc_state |= KEY_GC_FOUND_DEAD_KEY;

		if ((gc_state & KEY_GC_REAPING_LINKS) ||
		    unlikely(gc_state & KEY_GC_REAPING_DEAD_2)) {
			if (key->type == &key_type_keyring)
				goto found_keyring;
		}

		if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3))
			if (key->type == key_gc_dead_keytype)
				goto destroy_dead_key;

	skip_dead_key:
		if (spin_is_contended(&key_serial_lock) || need_resched())
			goto contended;
	}

contended:
	spin_unlock(&key_serial_lock);

maybe_resched:
	if (cursor) {
		cond_resched();
		spin_lock(&key_serial_lock);
		goto continue_scanning;
	}

	/* We've completed the pass.  Set the timer if we need to and queue a
	 * new cycle if necessary.  We keep executing cycles until we find one
	 * where we didn't reap any keys.
	 */
	kdebug("pass complete");

	if (gc_state & KEY_GC_SET_TIMER && new_timer != (time64_t)TIME64_MAX) {
		new_timer += key_gc_delay;
		key_schedule_gc(new_timer);
	}

	if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2) ||
	    !list_empty(&graveyard)) {
		/* Make sure that all pending keyring payload destructions are
		 * fulfilled and that people aren't now looking at dead or
		 * dying keys that they don't have a reference upon or a link
		 * to.
		 */
		kdebug("gc sync");
		synchronize_rcu();
	}

	if (!list_empty(&graveyard)) {
		kdebug("gc keys");
		key_gc_unused_keys(&graveyard);
	}

	if (unlikely(gc_state & (KEY_GC_REAPING_DEAD_1 |
				 KEY_GC_REAPING_DEAD_2))) {
		if (!(gc_state & KEY_GC_FOUND_DEAD_KEY)) {
			/* No remaining dead keys: short circuit the remaining
			 * keytype reap cycles.
			 */
			kdebug("dead short");
			gc_state &= ~(KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2);
			gc_state |= KEY_GC_REAPING_DEAD_3;
		} else {
			gc_state |= KEY_GC_REAP_AGAIN;
		}
	}

	if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3)) {
		kdebug("dead wake");
		smp_mb();
		clear_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
		wake_up_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE);
	}

	if (gc_state & KEY_GC_REAP_AGAIN)
		schedule_work(&key_gc_work);
	kleave(" [end %x]", gc_state);
	return;

	/* We found an unreferenced key - once we've removed it from the tree,
	 * we can safely drop the lock.
	 */
found_unreferenced_key:
	kdebug("unrefd key %d", key->serial);
	rb_erase(&key->serial_node, &key_serial_tree);
	spin_unlock(&key_serial_lock);

	list_add_tail(&key->graveyard_link, &graveyard);
	gc_state |= KEY_GC_REAP_AGAIN;
	goto maybe_resched;

	/* We found a restricted keyring and need to update the restriction if
	 * it is associated with the dead key type.
	 */
found_restricted_keyring:
	spin_unlock(&key_serial_lock);
	keyring_restriction_gc(key, key_gc_dead_keytype);
	goto maybe_resched;

	/* We found a keyring and we need to check the payload for links to
	 * dead or expired keys.  We don't flag another reap immediately as we
	 * have to wait for the old payload to be destroyed by RCU before we
	 * can reap the keys to which it refers.
	 */
found_keyring:
	spin_unlock(&key_serial_lock);
	keyring_gc(key, limit);
	goto maybe_resched;

	/* We found a dead key that is still referenced.  Reset its type and
	 * destroy its payload with its semaphore held.
	 */
destroy_dead_key:
	spin_unlock(&key_serial_lock);
	kdebug("destroy key %d", key->serial);
	down_write(&key->sem);
	key->type = &key_type_dead;
	if (key_gc_dead_keytype->destroy)
		key_gc_dead_keytype->destroy(key);
	memset(&key->payload, KEY_DESTROY, sizeof(key->payload));
	up_write(&key->sem);
	goto maybe_resched;
}
Commit	Line	Data
b4d0d230	1	// SPDX-License-Identifier: GPL-2.0-or-later
5d135440 DH	2	/* Key garbage collector
5d135440 DH	3	*
0c061b57	4	* Copyright (C) 2009-2011 Red Hat, Inc. All Rights Reserved.
5d135440	5	* Written by David Howells (dhowells@redhat.com)
5d135440 DH	6	*/
5d135440 DH	7
8bc16dea DH	8	#include <linux/slab.h>
8bc16dea DH	9	#include <linux/security.h>
5d135440 DH	10	#include <keys/keyring-type.h>
	11	#include "internal.h"
	12
	13	/*
	14	* Delay between key revocation/expiry in seconds
	15	*/
	16	unsigned key_gc_delay = 5 * 60;
	17
	18	/*
8bc16dea DH	19	* Reaper for unused keys.
8bc16dea DH	20	*/
0c061b57 DH	21	static void key_garbage_collector(struct work_struct *work);
0c061b57 DH	22	DECLARE_WORK(key_gc_work, key_garbage_collector);
8bc16dea DH	23
	24	/*
	25	* Reaper for links from keyrings to dead keys.
5d135440	26	*/
24ed960a	27	static void key_gc_timer_func(struct timer_list *);
1d27e3e2	28	static DEFINE_TIMER(key_gc_timer, key_gc_timer_func);
0c061b57	29
074d5898	30	static time64_t key_gc_next_run = TIME64_MAX;
0c061b57 DH	31	static struct key_type *key_gc_dead_keytype;
	32
	33	static unsigned long key_gc_flags;
	34	#define KEY_GC_KEY_EXPIRED 0 /* A key expired and needs unlinking */
	35	#define KEY_GC_REAP_KEYTYPE 1 /* A keytype is being unregistered */
	36	#define KEY_GC_REAPING_KEYTYPE 2 /* Cleared when keytype reaped */
	37
	38
	39	/*
	40	* Any key whose type gets unregistered will be re-typed to this if it can't be
	41	* immediately unlinked.
	42	*/
	43	struct key_type key_type_dead = {
c1644fe0	44	.name = ".dead",
0c061b57	45	};
5d135440 DH	46
5d135440 DH	47	/*
973c9f4f DH	48	* Schedule a garbage collection run.
973c9f4f DH	49	* - time precision isn't particularly important
5d135440	50	*/
074d5898	51	void key_schedule_gc(time64_t gc_at)
5d135440 DH	52	{
5d135440 DH	53	unsigned long expires;
074d5898	54	time64_t now = ktime_get_real_seconds();
5d135440	55
074d5898	56	kenter("%lld", gc_at - now);
5d135440	57
0c061b57 DH	58	if (gc_at <= now \|\| test_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags)) {
0c061b57 DH	59	kdebug("IMMEDIATE");
3b07e9ca	60	schedule_work(&key_gc_work);
5d135440	61	} else if (gc_at < key_gc_next_run) {
0c061b57 DH	62	kdebug("DEFERRED");
0c061b57 DH	63	key_gc_next_run = gc_at;
5d135440 DH	64	expires = jiffies + (gc_at - now) * HZ;
	65	mod_timer(&key_gc_timer, expires);
	66	}
	67	}
	68
fd75815f DH	69	/*
	70	* Schedule a dead links collection run.
	71	*/
	72	void key_schedule_gc_links(void)
	73	{
	74	set_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags);
3b07e9ca	75	schedule_work(&key_gc_work);
fd75815f DH	76	}
fd75815f DH	77
5d135440	78	/*
0c061b57 DH	79	* Some key's cleanup time was met after it expired, so we need to get the
0c061b57 DH	80	* reaper to go through a cycle finding expired keys.
5d135440	81	*/
24ed960a	82	static void key_gc_timer_func(struct timer_list *unused)
5d135440 DH	83	{
5d135440 DH	84	kenter("");
074d5898	85	key_gc_next_run = TIME64_MAX;
fd75815f	86	key_schedule_gc_links();
5d135440 DH	87	}
5d135440 DH	88
0c061b57 DH	89	/*
	90	* Reap keys of dead type.
	91	*
	92	* We use three flags to make sure we see three complete cycles of the garbage
	93	* collector: the first to mark keys of that type as being dead, the second to
	94	* collect dead links and the third to clean up the dead keys. We have to be
	95	* careful as there may already be a cycle in progress.
	96	*
	97	* The caller must be holding key_types_sem.
	98	*/
	99	void key_gc_keytype(struct key_type *ktype)
	100	{
	101	kenter("%s", ktype->name);
	102
	103	key_gc_dead_keytype = ktype;
	104	set_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
	105	smp_mb();
	106	set_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags);
	107
	108	kdebug("schedule");
3b07e9ca	109	schedule_work(&key_gc_work);
0c061b57 DH	110
0c061b57 DH	111	kdebug("sleep");
74316201	112	wait_on_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE,
0c061b57 DH	113	TASK_UNINTERRUPTIBLE);
	114
	115	key_gc_dead_keytype = NULL;
	116	kleave("");
	117	}
	118
5d135440	119	/*
65d87fe6	120	* Garbage collect a list of unreferenced, detached keys
5d135440	121	*/
65d87fe6	122	static noinline void key_gc_unused_keys(struct list_head *keys)
5d135440	123	{
65d87fe6 DH	124	while (!list_empty(keys)) {
	125	struct key *key =
	126	list_entry(keys->next, struct key, graveyard_link);
363b02da DH	127	short state = key->state;
363b02da DH	128
65d87fe6 DH	129	list_del(&key->graveyard_link);
	130
	131	kdebug("- %u", key->serial);
	132	key_check(key);
	133
f7e47677 DH	134	#ifdef CONFIG_KEY_NOTIFICATIONS
	135	remove_watch_list(key->watchers, key->serial);
	136	key->watchers = NULL;
	137	#endif
	138
f05819df	139	/* Throw away the key data if the key is instantiated */
363b02da	140	if (state == KEY_IS_POSITIVE && key->type->destroy)
94c4554b DH	141	key->type->destroy(key);
94c4554b DH	142
65d87fe6 DH	143	security_key_free(key);
	144
	145	/* deal with the user's key tracking and quota */
	146	if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) {
	147	spin_lock(&key->user->lock);
	148	key->user->qnkeys--;
	149	key->user->qnbytes -= key->quotalen;
	150	spin_unlock(&key->user->lock);
	151	}
5d135440	152
65d87fe6	153	atomic_dec(&key->user->nkeys);
363b02da	154	if (state != KEY_IS_UNINSTANTIATED)
65d87fe6	155	atomic_dec(&key->user->nikeys);
5d135440	156
a3a87844	157	key_user_put(key->user);
3b6e4de0	158	key_put_tag(key->domain_tag);
65d87fe6	159	kfree(key->description);
5d135440	160
0620fddb	161	memzero_explicit(key, sizeof(*key));
65d87fe6 DH	162	kmem_cache_free(key_jar, key);
65d87fe6 DH	163	}
5d135440	164	}
8bc16dea DH	165
	166	/*
	167	* Garbage collector for unused keys.
	168	*
	169	* This is done in process context so that we don't have to disable interrupts
	170	* all over the place. key_put() schedules this rather than trying to do the
	171	* cleanup itself, which means key_put() doesn't have to sleep.
	172	*/
0c061b57	173	static void key_garbage_collector(struct work_struct *work)
8bc16dea	174	{
65d87fe6	175	static LIST_HEAD(graveyard);
0c061b57 DH	176	static u8 gc_state; /* Internal persistent state */
	177	#define KEY_GC_REAP_AGAIN 0x01 /* - Need another cycle */
	178	#define KEY_GC_REAPING_LINKS 0x02 /* - We need to reap links */
	179	#define KEY_GC_SET_TIMER 0x04 /* - We need to restart the timer */
	180	#define KEY_GC_REAPING_DEAD_1 0x10 /* - We need to mark dead keys */
	181	#define KEY_GC_REAPING_DEAD_2 0x20 /* - We need to reap dead key links */
	182	#define KEY_GC_REAPING_DEAD_3 0x40 /* - We need to reap dead keys */
	183	#define KEY_GC_FOUND_DEAD_KEY 0x80 /* - We found at least one dead key */
	184
	185	struct rb_node *cursor;
8bc16dea	186	struct key *key;
074d5898	187	time64_t new_timer, limit;
0c061b57 DH	188
	189	kenter("[%lx,%x]", key_gc_flags, gc_state);
	190
074d5898	191	limit = ktime_get_real_seconds();
0c061b57 DH	192	if (limit > key_gc_delay)
	193	limit -= key_gc_delay;
	194	else
	195	limit = key_gc_delay;
	196
	197	/* Work out what we're going to be doing in this pass */
	198	gc_state &= KEY_GC_REAPING_DEAD_1 \| KEY_GC_REAPING_DEAD_2;
	199	gc_state <<= 1;
	200	if (test_and_clear_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags))
	201	gc_state \|= KEY_GC_REAPING_LINKS \| KEY_GC_SET_TIMER;
	202
	203	if (test_and_clear_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags))
	204	gc_state \|= KEY_GC_REAPING_DEAD_1;
	205	kdebug("new pass %x", gc_state);
	206
074d5898	207	new_timer = TIME64_MAX;
8bc16dea	208
0c061b57 DH	209	/* As only this function is permitted to remove things from the key
	210	* serial tree, if cursor is non-NULL then it will always point to a
	211	* valid node in the tree - even if lock got dropped.
	212	*/
8bc16dea	213	spin_lock(&key_serial_lock);
0c061b57	214	cursor = rb_first(&key_serial_tree);
8bc16dea	215
0c061b57 DH	216	continue_scanning:
	217	while (cursor) {
	218	key = rb_entry(cursor, struct key, serial_node);
	219	cursor = rb_next(cursor);
8bc16dea	220
fff29291	221	if (refcount_read(&key->usage) == 0)
0c061b57 DH	222	goto found_unreferenced_key;
	223
	224	if (unlikely(gc_state & KEY_GC_REAPING_DEAD_1)) {
	225	if (key->type == key_gc_dead_keytype) {
	226	gc_state \|= KEY_GC_FOUND_DEAD_KEY;
	227	set_bit(KEY_FLAG_DEAD, &key->flags);
028db3e2	228	key->perm = 0;
0c061b57	229	goto skip_dead_key;
2b6aa412 MM	230	} else if (key->type == &key_type_keyring &&
	231	key->restrict_link) {
	232	goto found_restricted_keyring;
0c061b57 DH	233	}
	234	}
	235
	236	if (gc_state & KEY_GC_SET_TIMER) {
	237	if (key->expiry > limit && key->expiry < new_timer) {
074d5898	238	kdebug("will expire %x in %lld",
0c061b57 DH	239	key_serial(key), key->expiry - limit);
	240	new_timer = key->expiry;
	241	}
	242	}
	243
	244	if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2))
	245	if (key->type == key_gc_dead_keytype)
	246	gc_state \|= KEY_GC_FOUND_DEAD_KEY;
	247
	248	if ((gc_state & KEY_GC_REAPING_LINKS) \|\|
	249	unlikely(gc_state & KEY_GC_REAPING_DEAD_2)) {
	250	if (key->type == &key_type_keyring)
	251	goto found_keyring;
	252	}
	253
	254	if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3))
	255	if (key->type == key_gc_dead_keytype)
	256	goto destroy_dead_key;
	257
	258	skip_dead_key:
	259	if (spin_is_contended(&key_serial_lock) \|\| need_resched())
	260	goto contended;
8bc16dea DH	261	}
8bc16dea DH	262
0c061b57	263	contended:
8bc16dea	264	spin_unlock(&key_serial_lock);
8bc16dea	265
0c061b57 DH	266	maybe_resched:
	267	if (cursor) {
	268	cond_resched();
	269	spin_lock(&key_serial_lock);
	270	goto continue_scanning;
	271	}
8bc16dea	272
0c061b57 DH	273	/* We've completed the pass. Set the timer if we need to and queue a
	274	* new cycle if necessary. We keep executing cycles until we find one
	275	* where we didn't reap any keys.
	276	*/
	277	kdebug("pass complete");
8bc16dea	278
074d5898	279	if (gc_state & KEY_GC_SET_TIMER && new_timer != (time64_t)TIME64_MAX) {
0c061b57 DH	280	new_timer += key_gc_delay;
	281	key_schedule_gc(new_timer);
	282	}
8bc16dea	283
65d87fe6 DH	284	if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2) \|\|
	285	!list_empty(&graveyard)) {
	286	/* Make sure that all pending keyring payload destructions are
	287	* fulfilled and that people aren't now looking at dead or
	288	* dying keys that they don't have a reference upon or a link
	289	* to.
0c061b57	290	*/
65d87fe6	291	kdebug("gc sync");
0c061b57	292	synchronize_rcu();
8bc16dea DH	293	}
8bc16dea DH	294
65d87fe6 DH	295	if (!list_empty(&graveyard)) {
	296	kdebug("gc keys");
	297	key_gc_unused_keys(&graveyard);
	298	}
	299
0c061b57 DH	300	if (unlikely(gc_state & (KEY_GC_REAPING_DEAD_1 \|
	301	KEY_GC_REAPING_DEAD_2))) {
	302	if (!(gc_state & KEY_GC_FOUND_DEAD_KEY)) {
	303	/* No remaining dead keys: short circuit the remaining
	304	* keytype reap cycles.
	305	*/
	306	kdebug("dead short");
	307	gc_state &= ~(KEY_GC_REAPING_DEAD_1 \| KEY_GC_REAPING_DEAD_2);
	308	gc_state \|= KEY_GC_REAPING_DEAD_3;
	309	} else {
	310	gc_state \|= KEY_GC_REAP_AGAIN;
	311	}
	312	}
8bc16dea	313
0c061b57 DH	314	if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3)) {
	315	kdebug("dead wake");
	316	smp_mb();
	317	clear_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
	318	wake_up_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE);
	319	}
8bc16dea	320
0c061b57	321	if (gc_state & KEY_GC_REAP_AGAIN)
3b07e9ca	322	schedule_work(&key_gc_work);
0c061b57 DH	323	kleave(" [end %x]", gc_state);
0c061b57 DH	324	return;
8bc16dea	325
0c061b57 DH	326	/* We found an unreferenced key - once we've removed it from the tree,
	327	* we can safely drop the lock.
	328	*/
	329	found_unreferenced_key:
	330	kdebug("unrefd key %d", key->serial);
	331	rb_erase(&key->serial_node, &key_serial_tree);
	332	spin_unlock(&key_serial_lock);
8bc16dea	333
65d87fe6	334	list_add_tail(&key->graveyard_link, &graveyard);
0c061b57 DH	335	gc_state \|= KEY_GC_REAP_AGAIN;
0c061b57 DH	336	goto maybe_resched;
8bc16dea	337
2b6aa412 MM	338	/* We found a restricted keyring and need to update the restriction if
	339	* it is associated with the dead key type.
	340	*/
	341	found_restricted_keyring:
	342	spin_unlock(&key_serial_lock);
	343	keyring_restriction_gc(key, key_gc_dead_keytype);
	344	goto maybe_resched;
	345
0c061b57 DH	346	/* We found a keyring and we need to check the payload for links to
	347	* dead or expired keys. We don't flag another reap immediately as we
	348	* have to wait for the old payload to be destroyed by RCU before we
	349	* can reap the keys to which it refers.
	350	*/
	351	found_keyring:
	352	spin_unlock(&key_serial_lock);
62fe3182	353	keyring_gc(key, limit);
0c061b57 DH	354	goto maybe_resched;
	355
	356	/* We found a dead key that is still referenced. Reset its type and
	357	* destroy its payload with its semaphore held.
	358	*/
	359	destroy_dead_key:
	360	spin_unlock(&key_serial_lock);
	361	kdebug("destroy key %d", key->serial);
	362	down_write(&key->sem);
	363	key->type = &key_type_dead;
	364	if (key_gc_dead_keytype->destroy)
	365	key_gc_dead_keytype->destroy(key);
	366	memset(&key->payload, KEY_DESTROY, sizeof(key->payload));
	367	up_write(&key->sem);
	368	goto maybe_resched;
8bc16dea	369	}