security/keys/keyring.c

   1 /* keyring.c: keyring handling
   2  *
   3  * Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved.
   4  * Written by David Howells (dhowells@redhat.com)
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version
   9  * 2 of the License, or (at your option) any later version.
  10  */
  11
  12 #include <linux/module.h>
  13 #include <linux/init.h>
  14 #include <linux/sched.h>
  15 #include <linux/slab.h>
  16 #include <linux/security.h>
  17 #include <linux/seq_file.h>
  18 #include <linux/err.h>
  19 #include <asm/uaccess.h>
  20 #include "internal.h"
  21
  22 /*
  23  * when plumbing the depths of the key tree, this sets a hard limit set on how
  24  * deep we're willing to go
  25  */
  26 #define KEYRING_SEARCH_MAX_DEPTH 6
  27
  28 /*
  29  * we keep all named keyrings in a hash to speed looking them up
  30  */
  31 #define KEYRING_NAME_HASH_SIZE  (1 << 5)
  32
  33 static struct list_head keyring_name_hash[KEYRING_NAME_HASH_SIZE];
  34 static DEFINE_RWLOCK(keyring_name_lock);
  35
  36 static inline unsigned keyring_hash(const char *desc)
  37 {
  38         unsigned bucket = 0;
  39
  40         for (; *desc; desc++)
  41                 bucket += (unsigned char) *desc;
  42
  43         return bucket & (KEYRING_NAME_HASH_SIZE - 1);
  44 }
  45
  46 /*
  47  * the keyring type definition
  48  */
  49 static int keyring_instantiate(struct key *keyring,
  50                                const void *data, size_t datalen);
  51 static int keyring_match(const struct key *keyring, const void *criterion);
  52 static void keyring_destroy(struct key *keyring);
  53 static void keyring_describe(const struct key *keyring, struct seq_file *m);
  54 static long keyring_read(const struct key *keyring,
  55                          char __user *buffer, size_t buflen);
  56
  57 struct key_type key_type_keyring = {
  58         .name           = "keyring",
  59         .def_datalen    = sizeof(struct keyring_list),
  60         .instantiate    = keyring_instantiate,
  61         .match          = keyring_match,
  62         .destroy        = keyring_destroy,
  63         .describe       = keyring_describe,
  64         .read           = keyring_read,
  65 };
  66
  67 /*
  68  * semaphore to serialise link/link calls to prevent two link calls in parallel
  69  * introducing a cycle
  70  */
  71 static DECLARE_RWSEM(keyring_serialise_link_sem);
  72
  73 /*****************************************************************************/
  74 /*
  75  * publish the name of a keyring so that it can be found by name (if it has
  76  * one)
  77  */
  78 void keyring_publish_name(struct key *keyring)
  79 {
  80         int bucket;
  81
  82         if (keyring->description) {
  83                 bucket = keyring_hash(keyring->description);
  84
  85                 write_lock(&keyring_name_lock);
  86
  87                 if (!keyring_name_hash[bucket].next)
  88                         INIT_LIST_HEAD(&keyring_name_hash[bucket]);
  89
  90                 list_add_tail(&keyring->type_data.link,
  91                               &keyring_name_hash[bucket]);
  92
  93                 write_unlock(&keyring_name_lock);
  94         }
  95
  96 } /* end keyring_publish_name() */
  97
  98 /*****************************************************************************/
  99 /*
 100  * initialise a keyring
 101  * - we object if we were given any data
 102  */
 103 static int keyring_instantiate(struct key *keyring,
 104                                const void *data, size_t datalen)
 105 {
 106         int ret;
 107
 108         ret = -EINVAL;
 109         if (datalen == 0) {
 110                 /* make the keyring available by name if it has one */
 111                 keyring_publish_name(keyring);
 112                 ret = 0;
 113         }
 114
 115         return ret;
 116
 117 } /* end keyring_instantiate() */
 118
 119 /*****************************************************************************/
 120 /*
 121  * match keyrings on their name
 122  */
 123 static int keyring_match(const struct key *keyring, const void *description)
 124 {
 125         return keyring->description &&
 126                 strcmp(keyring->description, description) == 0;
 127
 128 } /* end keyring_match() */
 129
 130 /*****************************************************************************/
 131 /*
 132  * dispose of the data dangling from the corpse of a keyring
 133  */
 134 static void keyring_destroy(struct key *keyring)
 135 {
 136         struct keyring_list *klist;
 137         int loop;
 138
 139         if (keyring->description) {
 140                 write_lock(&keyring_name_lock);
 141
 142                 if (keyring->type_data.link.next != NULL &&
 143                     !list_empty(&keyring->type_data.link))
 144                         list_del(&keyring->type_data.link);
 145
 146                 write_unlock(&keyring_name_lock);
 147         }
 148
 149         klist = rcu_dereference(keyring->payload.subscriptions);
 150         if (klist) {
 151                 for (loop = klist->nkeys - 1; loop >= 0; loop--)
 152                         key_put(klist->keys[loop]);
 153                 kfree(klist);
 154         }
 155
 156 } /* end keyring_destroy() */
 157
 158 /*****************************************************************************/
 159 /*
 160  * describe the keyring
 161  */
 162 static void keyring_describe(const struct key *keyring, struct seq_file *m)
 163 {
 164         struct keyring_list *klist;
 165
 166         if (keyring->description) {
 167                 seq_puts(m, keyring->description);
 168         }
 169         else {
 170                 seq_puts(m, "[anon]");
 171         }
 172
 173         rcu_read_lock();
 174         klist = rcu_dereference(keyring->payload.subscriptions);
 175         if (klist)
 176                 seq_printf(m, ": %u/%u", klist->nkeys, klist->maxkeys);
 177         else
 178                 seq_puts(m, ": empty");
 179         rcu_read_unlock();
 180
 181 } /* end keyring_describe() */
 182
 183 /*****************************************************************************/
 184 /*
 185  * read a list of key IDs from the keyring's contents
 186  * - the keyring's semaphore is read-locked
 187  */
 188 static long keyring_read(const struct key *keyring,
 189                          char __user *buffer, size_t buflen)
 190 {
 191         struct keyring_list *klist;
 192         struct key *key;
 193         size_t qty, tmp;
 194         int loop, ret;
 195
 196         ret = 0;
 197         klist = rcu_dereference(keyring->payload.subscriptions);
 198
 199         if (klist) {
 200                 /* calculate how much data we could return */
 201                 qty = klist->nkeys * sizeof(key_serial_t);
 202
 203                 if (buffer && buflen > 0) {
 204                         if (buflen > qty)
 205                                 buflen = qty;
 206
 207                         /* copy the IDs of the subscribed keys into the
 208                          * buffer */
 209                         ret = -EFAULT;
 210
 211                         for (loop = 0; loop < klist->nkeys; loop++) {
 212                                 key = klist->keys[loop];
 213
 214                                 tmp = sizeof(key_serial_t);
 215                                 if (tmp > buflen)
 216                                         tmp = buflen;
 217
 218                                 if (copy_to_user(buffer,
 219                                                  &key->serial,
 220                                                  tmp) != 0)
 221                                         goto error;
 222
 223                                 buflen -= tmp;
 224                                 if (buflen == 0)
 225                                         break;
 226                                 buffer += tmp;
 227                         }
 228                 }
 229
 230                 ret = qty;
 231         }
 232
 233  error:
 234         return ret;
 235
 236 } /* end keyring_read() */
 237
 238 /*****************************************************************************/
 239 /*
 240  * allocate a keyring and link into the destination keyring
 241  */
 242 struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,
 243                           struct task_struct *ctx, unsigned long flags,
 244                           struct key *dest)
 245 {
 246         struct key *keyring;
 247         int ret;
 248
 249         keyring = key_alloc(&key_type_keyring, description,
 250                             uid, gid, ctx,
 251                             (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_ALL,
 252                             flags);
 253
 254         if (!IS_ERR(keyring)) {
 255                 ret = key_instantiate_and_link(keyring, NULL, 0, dest, NULL);
 256                 if (ret < 0) {
 257                         key_put(keyring);
 258                         keyring = ERR_PTR(ret);
 259                 }
 260         }
 261
 262         return keyring;
 263
 264 } /* end keyring_alloc() */
 265
 266 /*****************************************************************************/
 267 /*
 268  * search the supplied keyring tree for a key that matches the criterion
 269  * - perform a breadth-then-depth search up to the prescribed limit
 270  * - we only find keys on which we have search permission
 271  * - we use the supplied match function to see if the description (or other
 272  *   feature of interest) matches
 273  * - we rely on RCU to prevent the keyring lists from disappearing on us
 274  * - we return -EAGAIN if we didn't find any matching key
 275  * - we return -ENOKEY if we only found negative matching keys
 276  * - we propagate the possession attribute from the keyring ref to the key ref
 277  */
 278 key_ref_t keyring_search_aux(key_ref_t keyring_ref,
 279                              struct task_struct *context,
 280                              struct key_type *type,
 281                              const void *description,
 282                              key_match_func_t match)
 283 {
 284         struct {
 285                 struct keyring_list *keylist;
 286                 int kix;
 287         } stack[KEYRING_SEARCH_MAX_DEPTH];
 288
 289         struct keyring_list *keylist;
 290         struct timespec now;
 291         unsigned long possessed;
 292         struct key *keyring, *key;
 293         key_ref_t key_ref;
 294         long err;
 295         int sp, kix;
 296
 297         keyring = key_ref_to_ptr(keyring_ref);
 298         possessed = is_key_possessed(keyring_ref);
 299         key_check(keyring);
 300
 301         /* top keyring must have search permission to begin the search */
 302         err = key_task_permission(keyring_ref, context, KEY_SEARCH);
 303         if (err < 0) {
 304                 key_ref = ERR_PTR(err);
 305                 goto error;
 306         }
 307
 308         key_ref = ERR_PTR(-ENOTDIR);
 309         if (keyring->type != &key_type_keyring)
 310                 goto error;
 311
 312         rcu_read_lock();
 313
 314         now = current_kernel_time();
 315         err = -EAGAIN;
 316         sp = 0;
 317
 318         /* start processing a new keyring */
 319 descend:
 320         if (test_bit(KEY_FLAG_REVOKED, &keyring->flags))
 321                 goto not_this_keyring;
 322
 323         keylist = rcu_dereference(keyring->payload.subscriptions);
 324         if (!keylist)
 325                 goto not_this_keyring;
 326
 327         /* iterate through the keys in this keyring first */
 328         for (kix = 0; kix < keylist->nkeys; kix++) {
 329                 key = keylist->keys[kix];
 330
 331                 /* ignore keys not of this type */
 332                 if (key->type != type)
 333                         continue;
 334
 335                 /* skip revoked keys and expired keys */
 336                 if (test_bit(KEY_FLAG_REVOKED, &key->flags))
 337                         continue;
 338
 339                 if (key->expiry && now.tv_sec >= key->expiry)
 340                         continue;
 341
 342                 /* keys that don't match */
 343                 if (!match(key, description))
 344                         continue;
 345
 346                 /* key must have search permissions */
 347                 if (key_task_permission(make_key_ref(key, possessed),
 348                                         context, KEY_SEARCH) < 0)
 349                         continue;
 350
 351                 /* we set a different error code if we find a negative key */
 352                 if (test_bit(KEY_FLAG_NEGATIVE, &key->flags)) {
 353                         err = -ENOKEY;
 354                         continue;
 355                 }
 356
 357                 goto found;
 358         }
 359
 360         /* search through the keyrings nested in this one */
 361         kix = 0;
 362 ascend:
 363         for (; kix < keylist->nkeys; kix++) {
 364                 key = keylist->keys[kix];
 365                 if (key->type != &key_type_keyring)
 366                         continue;
 367
 368                 /* recursively search nested keyrings
 369                  * - only search keyrings for which we have search permission
 370                  */
 371                 if (sp >= KEYRING_SEARCH_MAX_DEPTH)
 372                         continue;
 373
 374                 if (key_task_permission(make_key_ref(key, possessed),
 375                                         context, KEY_SEARCH) < 0)
 376                         continue;
 377
 378                 /* stack the current position */
 379                 stack[sp].keylist = keylist;
 380                 stack[sp].kix = kix;
 381                 sp++;
 382
 383                 /* begin again with the new keyring */
 384                 keyring = key;
 385                 goto descend;
 386         }
 387
 388         /* the keyring we're looking at was disqualified or didn't contain a
 389          * matching key */
 390 not_this_keyring:
 391         if (sp > 0) {
 392                 /* resume the processing of a keyring higher up in the tree */
 393                 sp--;
 394                 keylist = stack[sp].keylist;
 395                 kix = stack[sp].kix + 1;
 396                 goto ascend;
 397         }
 398
 399         key_ref = ERR_PTR(err);
 400         goto error_2;
 401
 402         /* we found a viable match */
 403 found:
 404         atomic_inc(&key->usage);
 405         key_check(key);
 406         key_ref = make_key_ref(key, possessed);
 407 error_2:
 408         rcu_read_unlock();
 409 error:
 410         return key_ref;
 411
 412 } /* end keyring_search_aux() */
 413
 414 /*****************************************************************************/
 415 /*
 416  * search the supplied keyring tree for a key that matches the criterion
 417  * - perform a breadth-then-depth search up to the prescribed limit
 418  * - we only find keys on which we have search permission
 419  * - we readlock the keyrings as we search down the tree
 420  * - we return -EAGAIN if we didn't find any matching key
 421  * - we return -ENOKEY if we only found negative matching keys
 422  */
 423 key_ref_t keyring_search(key_ref_t keyring,
 424                          struct key_type *type,
 425                          const char *description)
 426 {
 427         if (!type->match)
 428                 return ERR_PTR(-ENOKEY);
 429
 430         return keyring_search_aux(keyring, current,
 431                                   type, description, type->match);
 432
 433 } /* end keyring_search() */
 434
 435 EXPORT_SYMBOL(keyring_search);
 436
 437 /*****************************************************************************/
 438 /*
 439  * search the given keyring only (no recursion)
 440  * - keyring must be locked by caller
 441  * - caller must guarantee that the keyring is a keyring
 442  */
 443 key_ref_t __keyring_search_one(key_ref_t keyring_ref,
 444                                const struct key_type *ktype,
 445                                const char *description,
 446                                key_perm_t perm)
 447 {
 448         struct keyring_list *klist;
 449         unsigned long possessed;
 450         struct key *keyring, *key;
 451         int loop;
 452
 453         keyring = key_ref_to_ptr(keyring_ref);
 454         possessed = is_key_possessed(keyring_ref);
 455
 456         rcu_read_lock();
 457
 458         klist = rcu_dereference(keyring->payload.subscriptions);
 459         if (klist) {
 460                 for (loop = 0; loop < klist->nkeys; loop++) {
 461                         key = klist->keys[loop];
 462
 463                         if (key->type == ktype &&
 464                             (!key->type->match ||
 465                              key->type->match(key, description)) &&
 466                             key_permission(make_key_ref(key, possessed),
 467                                            perm) == 0 &&
 468                             !test_bit(KEY_FLAG_REVOKED, &key->flags)
 469                             )
 470                                 goto found;
 471                 }
 472         }
 473
 474         rcu_read_unlock();
 475         return ERR_PTR(-ENOKEY);
 476
 477  found:
 478         atomic_inc(&key->usage);
 479         rcu_read_unlock();
 480         return make_key_ref(key, possessed);
 481
 482 } /* end __keyring_search_one() */
 483
 484 /*****************************************************************************/
 485 /*
 486  * find a keyring with the specified name
 487  * - all named keyrings are searched
 488  * - only find keyrings with search permission for the process
 489  * - only find keyrings with a serial number greater than the one specified
 490  */
 491 struct key *find_keyring_by_name(const char *name, key_serial_t bound)
 492 {
 493         struct key *keyring;
 494         int bucket;
 495
 496         keyring = ERR_PTR(-EINVAL);
 497         if (!name)
 498                 goto error;
 499
 500         bucket = keyring_hash(name);
 501
 502         read_lock(&keyring_name_lock);
 503
 504         if (keyring_name_hash[bucket].next) {
 505                 /* search this hash bucket for a keyring with a matching name
 506                  * that's readable and that hasn't been revoked */
 507                 list_for_each_entry(keyring,
 508                                     &keyring_name_hash[bucket],
 509                                     type_data.link
 510                                     ) {
 511                         if (test_bit(KEY_FLAG_REVOKED, &keyring->flags))
 512                                 continue;
 513
 514                         if (strcmp(keyring->description, name) != 0)
 515                                 continue;
 516
 517                         if (key_permission(make_key_ref(keyring, 0),
 518                                            KEY_SEARCH) < 0)
 519                                 continue;
 520
 521                         /* found a potential candidate, but we still need to
 522                          * check the serial number */
 523                         if (keyring->serial <= bound)
 524                                 continue;
 525
 526                         /* we've got a match */
 527                         atomic_inc(&keyring->usage);
 528                         read_unlock(&keyring_name_lock);
 529                         goto error;
 530                 }
 531         }
 532
 533         read_unlock(&keyring_name_lock);
 534         keyring = ERR_PTR(-ENOKEY);
 535
 536  error:
 537         return keyring;
 538
 539 } /* end find_keyring_by_name() */
 540
 541 /*****************************************************************************/
 542 /*
 543  * see if a cycle will will be created by inserting acyclic tree B in acyclic
 544  * tree A at the topmost level (ie: as a direct child of A)
 545  * - since we are adding B to A at the top level, checking for cycles should
 546  *   just be a matter of seeing if node A is somewhere in tree B
 547  */
 548 static int keyring_detect_cycle(struct key *A, struct key *B)
 549 {
 550         struct {
 551                 struct keyring_list *keylist;
 552                 int kix;
 553         } stack[KEYRING_SEARCH_MAX_DEPTH];
 554
 555         struct keyring_list *keylist;
 556         struct key *subtree, *key;
 557         int sp, kix, ret;
 558
 559         rcu_read_lock();
 560
 561         ret = -EDEADLK;
 562         if (A == B)
 563                 goto cycle_detected;
 564
 565         subtree = B;
 566         sp = 0;
 567
 568         /* start processing a new keyring */
 569  descend:
 570         if (test_bit(KEY_FLAG_REVOKED, &subtree->flags))
 571                 goto not_this_keyring;
 572
 573         keylist = rcu_dereference(subtree->payload.subscriptions);
 574         if (!keylist)
 575                 goto not_this_keyring;
 576         kix = 0;
 577
 578  ascend:
 579         /* iterate through the remaining keys in this keyring */
 580         for (; kix < keylist->nkeys; kix++) {
 581                 key = keylist->keys[kix];
 582
 583                 if (key == A)
 584                         goto cycle_detected;
 585
 586                 /* recursively check nested keyrings */
 587                 if (key->type == &key_type_keyring) {
 588                         if (sp >= KEYRING_SEARCH_MAX_DEPTH)
 589                                 goto too_deep;
 590
 591                         /* stack the current position */
 592                         stack[sp].keylist = keylist;
 593                         stack[sp].kix = kix;
 594                         sp++;
 595
 596                         /* begin again with the new keyring */
 597                         subtree = key;
 598                         goto descend;
 599                 }
 600         }
 601
 602         /* the keyring we're looking at was disqualified or didn't contain a
 603          * matching key */
 604  not_this_keyring:
 605         if (sp > 0) {
 606                 /* resume the checking of a keyring higher up in the tree */
 607                 sp--;
 608                 keylist = stack[sp].keylist;
 609                 kix = stack[sp].kix + 1;
 610                 goto ascend;
 611         }
 612
 613         ret = 0; /* no cycles detected */
 614
 615  error:
 616         rcu_read_unlock();
 617         return ret;
 618
 619  too_deep:
 620         ret = -ELOOP;
 621         goto error;
 622
 623  cycle_detected:
 624         ret = -EDEADLK;
 625         goto error;
 626
 627 } /* end keyring_detect_cycle() */
 628
 629 /*****************************************************************************/
 630 /*
 631  * dispose of a keyring list after the RCU grace period
 632  */
 633 static void keyring_link_rcu_disposal(struct rcu_head *rcu)
 634 {
 635         struct keyring_list *klist =
 636                 container_of(rcu, struct keyring_list, rcu);
 637
 638         kfree(klist);
 639
 640 } /* end keyring_link_rcu_disposal() */
 641
 642 /*****************************************************************************/
 643 /*
 644  * dispose of a keyring list after the RCU grace period, freeing the unlinked
 645  * key
 646  */
 647 static void keyring_unlink_rcu_disposal(struct rcu_head *rcu)
 648 {
 649         struct keyring_list *klist =
 650                 container_of(rcu, struct keyring_list, rcu);
 651
 652         key_put(klist->keys[klist->delkey]);
 653         kfree(klist);
 654
 655 } /* end keyring_unlink_rcu_disposal() */
 656
 657 /*****************************************************************************/
 658 /*
 659  * link a key into to a keyring
 660  * - must be called with the keyring's semaphore write-locked
 661  * - discard already extant link to matching key if there is one
 662  */
 663 int __key_link(struct key *keyring, struct key *key)
 664 {
 665         struct keyring_list *klist, *nklist;
 666         unsigned max;
 667         size_t size;
 668         int loop, ret;
 669
 670         ret = -EKEYREVOKED;
 671         if (test_bit(KEY_FLAG_REVOKED, &keyring->flags))
 672                 goto error;
 673
 674         ret = -ENOTDIR;
 675         if (keyring->type != &key_type_keyring)
 676                 goto error;
 677
 678         /* serialise link/link calls to prevent parallel calls causing a
 679          * cycle when applied to two keyring in opposite orders */
 680         down_write(&keyring_serialise_link_sem);
 681
 682         /* check that we aren't going to create a cycle adding one keyring to
 683          * another */
 684         if (key->type == &key_type_keyring) {
 685                 ret = keyring_detect_cycle(keyring, key);
 686                 if (ret < 0)
 687                         goto error2;
 688         }
 689
 690         /* see if there's a matching key we can displace */
 691         klist = keyring->payload.subscriptions;
 692
 693         if (klist && klist->nkeys > 0) {
 694                 struct key_type *type = key->type;
 695
 696                 for (loop = klist->nkeys - 1; loop >= 0; loop--) {
 697                         if (klist->keys[loop]->type == type &&
 698                             strcmp(klist->keys[loop]->description,
 699                                    key->description) == 0
 700                             ) {
 701                                 /* found a match - replace with new key */
 702                                 size = sizeof(struct key *) * klist->maxkeys;
 703                                 size += sizeof(*klist);
 704                                 BUG_ON(size > PAGE_SIZE);
 705
 706                                 ret = -ENOMEM;
 707                                 nklist = kmalloc(size, GFP_KERNEL);
 708                                 if (!nklist)
 709                                         goto error2;
 710
 711                                 memcpy(nklist, klist, size);
 712
 713                                 /* replace matched key */
 714                                 atomic_inc(&key->usage);
 715                                 nklist->keys[loop] = key;
 716
 717                                 rcu_assign_pointer(
 718                                         keyring->payload.subscriptions,
 719                                         nklist);
 720
 721                                 /* dispose of the old keyring list and the
 722                                  * displaced key */
 723                                 klist->delkey = loop;
 724                                 call_rcu(&klist->rcu,
 725                                          keyring_unlink_rcu_disposal);
 726
 727                                 goto done;
 728                         }
 729                 }
 730         }
 731
 732         /* check that we aren't going to overrun the user's quota */
 733         ret = key_payload_reserve(keyring,
 734                                   keyring->datalen + KEYQUOTA_LINK_BYTES);
 735         if (ret < 0)
 736                 goto error2;
 737
 738         klist = keyring->payload.subscriptions;
 739
 740         if (klist && klist->nkeys < klist->maxkeys) {
 741                 /* there's sufficient slack space to add directly */
 742                 atomic_inc(&key->usage);
 743
 744                 klist->keys[klist->nkeys] = key;
 745                 smp_wmb();
 746                 klist->nkeys++;
 747                 smp_wmb();
 748         }
 749         else {
 750                 /* grow the key list */
 751                 max = 4;
 752                 if (klist)
 753                         max += klist->maxkeys;
 754
 755                 ret = -ENFILE;
 756                 if (max > 65535)
 757                         goto error3;
 758                 size = sizeof(*klist) + sizeof(struct key *) * max;
 759                 if (size > PAGE_SIZE)
 760                         goto error3;
 761
 762                 ret = -ENOMEM;
 763                 nklist = kmalloc(size, GFP_KERNEL);
 764                 if (!nklist)
 765                         goto error3;
 766                 nklist->maxkeys = max;
 767                 nklist->nkeys = 0;
 768
 769                 if (klist) {
 770                         nklist->nkeys = klist->nkeys;
 771                         memcpy(nklist->keys,
 772                                klist->keys,
 773                                sizeof(struct key *) * klist->nkeys);
 774                 }
 775
 776                 /* add the key into the new space */
 777                 atomic_inc(&key->usage);
 778                 nklist->keys[nklist->nkeys++] = key;
 779
 780                 rcu_assign_pointer(keyring->payload.subscriptions, nklist);
 781
 782                 /* dispose of the old keyring list */
 783                 if (klist)
 784                         call_rcu(&klist->rcu, keyring_link_rcu_disposal);
 785         }
 786
 787 done:
 788         ret = 0;
 789 error2:
 790         up_write(&keyring_serialise_link_sem);
 791 error:
 792         return ret;
 793
 794 error3:
 795         /* undo the quota changes */
 796         key_payload_reserve(keyring,
 797                             keyring->datalen - KEYQUOTA_LINK_BYTES);
 798         goto error2;
 799
 800 } /* end __key_link() */
 801
 802 /*****************************************************************************/
 803 /*
 804  * link a key to a keyring
 805  */
 806 int key_link(struct key *keyring, struct key *key)
 807 {
 808         int ret;
 809
 810         key_check(keyring);
 811         key_check(key);
 812
 813         down_write(&keyring->sem);
 814         ret = __key_link(keyring, key);
 815         up_write(&keyring->sem);
 816
 817         return ret;
 818
 819 } /* end key_link() */
 820
 821 EXPORT_SYMBOL(key_link);
 822
 823 /*****************************************************************************/
 824 /*
 825  * unlink the first link to a key from a keyring
 826  */
 827 int key_unlink(struct key *keyring, struct key *key)
 828 {
 829         struct keyring_list *klist, *nklist;
 830         int loop, ret;
 831
 832         key_check(keyring);
 833         key_check(key);
 834
 835         ret = -ENOTDIR;
 836         if (keyring->type != &key_type_keyring)
 837                 goto error;
 838
 839         down_write(&keyring->sem);
 840
 841         klist = keyring->payload.subscriptions;
 842         if (klist) {
 843                 /* search the keyring for the key */
 844                 for (loop = 0; loop < klist->nkeys; loop++)
 845                         if (klist->keys[loop] == key)
 846                                 goto key_is_present;
 847         }
 848
 849         up_write(&keyring->sem);
 850         ret = -ENOENT;
 851         goto error;
 852
 853 key_is_present:
 854         /* we need to copy the key list for RCU purposes */
 855         nklist = kmalloc(sizeof(*klist) +
 856                          sizeof(struct key *) * klist->maxkeys,
 857                          GFP_KERNEL);
 858         if (!nklist)
 859                 goto nomem;
 860         nklist->maxkeys = klist->maxkeys;
 861         nklist->nkeys = klist->nkeys - 1;
 862
 863         if (loop > 0)
 864                 memcpy(&nklist->keys[0],
 865                        &klist->keys[0],
 866                        loop * sizeof(struct key *));
 867
 868         if (loop < nklist->nkeys)
 869                 memcpy(&nklist->keys[loop],
 870                        &klist->keys[loop + 1],
 871                        (nklist->nkeys - loop) * sizeof(struct key *));
 872
 873         /* adjust the user's quota */
 874         key_payload_reserve(keyring,
 875                             keyring->datalen - KEYQUOTA_LINK_BYTES);
 876
 877         rcu_assign_pointer(keyring->payload.subscriptions, nklist);
 878
 879         up_write(&keyring->sem);
 880
 881         /* schedule for later cleanup */
 882         klist->delkey = loop;
 883         call_rcu(&klist->rcu, keyring_unlink_rcu_disposal);
 884
 885         ret = 0;
 886
 887 error:
 888         return ret;
 889 nomem:
 890         ret = -ENOMEM;
 891         up_write(&keyring->sem);
 892         goto error;
 893
 894 } /* end key_unlink() */
 895
 896 EXPORT_SYMBOL(key_unlink);
 897
 898 /*****************************************************************************/
 899 /*
 900  * dispose of a keyring list after the RCU grace period, releasing the keys it
 901  * links to
 902  */
 903 static void keyring_clear_rcu_disposal(struct rcu_head *rcu)
 904 {
 905         struct keyring_list *klist;
 906         int loop;
 907
 908         klist = container_of(rcu, struct keyring_list, rcu);
 909
 910         for (loop = klist->nkeys - 1; loop >= 0; loop--)
 911                 key_put(klist->keys[loop]);
 912
 913         kfree(klist);
 914
 915 } /* end keyring_clear_rcu_disposal() */
 916
 917 /*****************************************************************************/
 918 /*
 919  * clear the specified process keyring
 920  * - implements keyctl(KEYCTL_CLEAR)
 921  */
 922 int keyring_clear(struct key *keyring)
 923 {
 924         struct keyring_list *klist;
 925         int ret;
 926
 927         ret = -ENOTDIR;
 928         if (keyring->type == &key_type_keyring) {
 929                 /* detach the pointer block with the locks held */
 930                 down_write(&keyring->sem);
 931
 932                 klist = keyring->payload.subscriptions;
 933                 if (klist) {
 934                         /* adjust the quota */
 935                         key_payload_reserve(keyring,
 936                                             sizeof(struct keyring_list));
 937
 938                         rcu_assign_pointer(keyring->payload.subscriptions,
 939                                            NULL);
 940                 }
 941
 942                 up_write(&keyring->sem);
 943
 944                 /* free the keys after the locks have been dropped */
 945                 if (klist)
 946                         call_rcu(&klist->rcu, keyring_clear_rcu_disposal);
 947
 948                 ret = 0;
 949         }
 950
 951         return ret;
 952
 953 } /* end keyring_clear() */
 954
 955 EXPORT_SYMBOL(keyring_clear);