6c282bd937e26763c33f9a05b68817eb1d1af8a4
[linux-2.6.git] / security / keys / keyring.c
1 /* keyring.c: keyring handling
2  *
3  * Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved.
4  * Written by David Howells (dhowells@redhat.com)
5  *
6  * This program is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU General Public License
8  * as published by the Free Software Foundation; either version
9  * 2 of the License, or (at your option) any later version.
10  */
11
12 #include <linux/module.h>
13 #include <linux/init.h>
14 #include <linux/sched.h>
15 #include <linux/slab.h>
16 #include <linux/security.h>
17 #include <linux/seq_file.h>
18 #include <linux/err.h>
19 #include <asm/uaccess.h>
20 #include "internal.h"
21
22 /*
23  * when plumbing the depths of the key tree, this sets a hard limit set on how
24  * deep we're willing to go
25  */
26 #define KEYRING_SEARCH_MAX_DEPTH 6
27
28 /*
29  * we keep all named keyrings in a hash to speed looking them up
30  */
31 #define KEYRING_NAME_HASH_SIZE  (1 << 5)
32
33 static struct list_head keyring_name_hash[KEYRING_NAME_HASH_SIZE];
34 static DEFINE_RWLOCK(keyring_name_lock);
35
36 static inline unsigned keyring_hash(const char *desc)
37 {
38         unsigned bucket = 0;
39
40         for (; *desc; desc++)
41                 bucket += (unsigned char) *desc;
42
43         return bucket & (KEYRING_NAME_HASH_SIZE - 1);
44 }
45
46 /*
47  * the keyring type definition
48  */
49 static int keyring_instantiate(struct key *keyring,
50                                const void *data, size_t datalen);
51 static int keyring_match(const struct key *keyring, const void *criterion);
52 static void keyring_destroy(struct key *keyring);
53 static void keyring_describe(const struct key *keyring, struct seq_file *m);
54 static long keyring_read(const struct key *keyring,
55                          char __user *buffer, size_t buflen);
56
57 struct key_type key_type_keyring = {
58         .name           = "keyring",
59         .def_datalen    = sizeof(struct keyring_list),
60         .instantiate    = keyring_instantiate,
61         .match          = keyring_match,
62         .destroy        = keyring_destroy,
63         .describe       = keyring_describe,
64         .read           = keyring_read,
65 };
66
67 /*
68  * semaphore to serialise link/link calls to prevent two link calls in parallel
69  * introducing a cycle
70  */
71 static DECLARE_RWSEM(keyring_serialise_link_sem);
72
73 /*****************************************************************************/
74 /*
75  * publish the name of a keyring so that it can be found by name (if it has
76  * one)
77  */
78 void keyring_publish_name(struct key *keyring)
79 {
80         int bucket;
81
82         if (keyring->description) {
83                 bucket = keyring_hash(keyring->description);
84
85                 write_lock(&keyring_name_lock);
86
87                 if (!keyring_name_hash[bucket].next)
88                         INIT_LIST_HEAD(&keyring_name_hash[bucket]);
89
90                 list_add_tail(&keyring->type_data.link,
91                               &keyring_name_hash[bucket]);
92
93                 write_unlock(&keyring_name_lock);
94         }
95
96 } /* end keyring_publish_name() */
97
98 /*****************************************************************************/
99 /*
100  * initialise a keyring
101  * - we object if we were given any data
102  */
103 static int keyring_instantiate(struct key *keyring,
104                                const void *data, size_t datalen)
105 {
106         int ret;
107
108         ret = -EINVAL;
109         if (datalen == 0) {
110                 /* make the keyring available by name if it has one */
111                 keyring_publish_name(keyring);
112                 ret = 0;
113         }
114
115         return ret;
116
117 } /* end keyring_instantiate() */
118
119 /*****************************************************************************/
120 /*
121  * match keyrings on their name
122  */
123 static int keyring_match(const struct key *keyring, const void *description)
124 {
125         return keyring->description &&
126                 strcmp(keyring->description, description) == 0;
127
128 } /* end keyring_match() */
129
130 /*****************************************************************************/
131 /*
132  * dispose of the data dangling from the corpse of a keyring
133  */
134 static void keyring_destroy(struct key *keyring)
135 {
136         struct keyring_list *klist;
137         int loop;
138
139         if (keyring->description) {
140                 write_lock(&keyring_name_lock);
141
142                 if (keyring->type_data.link.next != NULL &&
143                     !list_empty(&keyring->type_data.link))
144                         list_del(&keyring->type_data.link);
145
146                 write_unlock(&keyring_name_lock);
147         }
148
149         klist = rcu_dereference(keyring->payload.subscriptions);
150         if (klist) {
151                 for (loop = klist->nkeys - 1; loop >= 0; loop--)
152                         key_put(klist->keys[loop]);
153                 kfree(klist);
154         }
155
156 } /* end keyring_destroy() */
157
158 /*****************************************************************************/
159 /*
160  * describe the keyring
161  */
162 static void keyring_describe(const struct key *keyring, struct seq_file *m)
163 {
164         struct keyring_list *klist;
165
166         if (keyring->description) {
167                 seq_puts(m, keyring->description);
168         }
169         else {
170                 seq_puts(m, "[anon]");
171         }
172
173         rcu_read_lock();
174         klist = rcu_dereference(keyring->payload.subscriptions);
175         if (klist)
176                 seq_printf(m, ": %u/%u", klist->nkeys, klist->maxkeys);
177         else
178                 seq_puts(m, ": empty");
179         rcu_read_unlock();
180
181 } /* end keyring_describe() */
182
183 /*****************************************************************************/
184 /*
185  * read a list of key IDs from the keyring's contents
186  * - the keyring's semaphore is read-locked
187  */
188 static long keyring_read(const struct key *keyring,
189                          char __user *buffer, size_t buflen)
190 {
191         struct keyring_list *klist;
192         struct key *key;
193         size_t qty, tmp;
194         int loop, ret;
195
196         ret = 0;
197         klist = rcu_dereference(keyring->payload.subscriptions);
198
199         if (klist) {
200                 /* calculate how much data we could return */
201                 qty = klist->nkeys * sizeof(key_serial_t);
202
203                 if (buffer && buflen > 0) {
204                         if (buflen > qty)
205                                 buflen = qty;
206
207                         /* copy the IDs of the subscribed keys into the
208                          * buffer */
209                         ret = -EFAULT;
210
211                         for (loop = 0; loop < klist->nkeys; loop++) {
212                                 key = klist->keys[loop];
213
214                                 tmp = sizeof(key_serial_t);
215                                 if (tmp > buflen)
216                                         tmp = buflen;
217
218                                 if (copy_to_user(buffer,
219                                                  &key->serial,
220                                                  tmp) != 0)
221                                         goto error;
222
223                                 buflen -= tmp;
224                                 if (buflen == 0)
225                                         break;
226                                 buffer += tmp;
227                         }
228                 }
229
230                 ret = qty;
231         }
232
233  error:
234         return ret;
235
236 } /* end keyring_read() */
237
238 /*****************************************************************************/
239 /*
240  * allocate a keyring and link into the destination keyring
241  */
242 struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,
243                           struct task_struct *ctx, unsigned long flags,
244                           struct key *dest)
245 {
246         struct key *keyring;
247         int ret;
248
249         keyring = key_alloc(&key_type_keyring, description,
250                             uid, gid, ctx,
251                             (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_ALL,
252                             flags);
253
254         if (!IS_ERR(keyring)) {
255                 ret = key_instantiate_and_link(keyring, NULL, 0, dest, NULL);
256                 if (ret < 0) {
257                         key_put(keyring);
258                         keyring = ERR_PTR(ret);
259                 }
260         }
261
262         return keyring;
263
264 } /* end keyring_alloc() */
265
266 /*****************************************************************************/
267 /*
268  * search the supplied keyring tree for a key that matches the criterion
269  * - perform a breadth-then-depth search up to the prescribed limit
270  * - we only find keys on which we have search permission
271  * - we use the supplied match function to see if the description (or other
272  *   feature of interest) matches
273  * - we rely on RCU to prevent the keyring lists from disappearing on us
274  * - we return -EAGAIN if we didn't find any matching key
275  * - we return -ENOKEY if we only found negative matching keys
276  * - we propagate the possession attribute from the keyring ref to the key ref
277  */
278 key_ref_t keyring_search_aux(key_ref_t keyring_ref,
279                              struct task_struct *context,
280                              struct key_type *type,
281                              const void *description,
282                              key_match_func_t match)
283 {
284         struct {
285                 struct keyring_list *keylist;
286                 int kix;
287         } stack[KEYRING_SEARCH_MAX_DEPTH];
288
289         struct keyring_list *keylist;
290         struct timespec now;
291         unsigned long possessed;
292         struct key *keyring, *key;
293         key_ref_t key_ref;
294         long err;
295         int sp, kix;
296
297         keyring = key_ref_to_ptr(keyring_ref);
298         possessed = is_key_possessed(keyring_ref);
299         key_check(keyring);
300
301         /* top keyring must have search permission to begin the search */
302         err = key_task_permission(keyring_ref, context, KEY_SEARCH);
303         if (err < 0) {
304                 key_ref = ERR_PTR(err);
305                 goto error;
306         }
307
308         key_ref = ERR_PTR(-ENOTDIR);
309         if (keyring->type != &key_type_keyring)
310                 goto error;
311
312         rcu_read_lock();
313
314         now = current_kernel_time();
315         err = -EAGAIN;
316         sp = 0;
317
318         /* start processing a new keyring */
319 descend:
320         if (test_bit(KEY_FLAG_REVOKED, &keyring->flags))
321                 goto not_this_keyring;
322
323         keylist = rcu_dereference(keyring->payload.subscriptions);
324         if (!keylist)
325                 goto not_this_keyring;
326
327         /* iterate through the keys in this keyring first */
328         for (kix = 0; kix < keylist->nkeys; kix++) {
329                 key = keylist->keys[kix];
330
331                 /* ignore keys not of this type */
332                 if (key->type != type)
333                         continue;
334
335                 /* skip revoked keys and expired keys */
336                 if (test_bit(KEY_FLAG_REVOKED, &key->flags))
337                         continue;
338
339                 if (key->expiry && now.tv_sec >= key->expiry)
340                         continue;
341
342                 /* keys that don't match */
343                 if (!match(key, description))
344                         continue;
345
346                 /* key must have search permissions */
347                 if (key_task_permission(make_key_ref(key, possessed),
348                                         context, KEY_SEARCH) < 0)
349                         continue;
350
351                 /* we set a different error code if we find a negative key */
352                 if (test_bit(KEY_FLAG_NEGATIVE, &key->flags)) {
353                         err = -ENOKEY;
354                         continue;
355                 }
356
357                 goto found;
358         }
359
360         /* search through the keyrings nested in this one */
361         kix = 0;
362 ascend:
363         for (; kix < keylist->nkeys; kix++) {
364                 key = keylist->keys[kix];
365                 if (key->type != &key_type_keyring)
366                         continue;
367
368                 /* recursively search nested keyrings
369                  * - only search keyrings for which we have search permission
370                  */
371                 if (sp >= KEYRING_SEARCH_MAX_DEPTH)
372                         continue;
373
374                 if (key_task_permission(make_key_ref(key, possessed),
375                                         context, KEY_SEARCH) < 0)
376                         continue;
377
378                 /* stack the current position */
379                 stack[sp].keylist = keylist;
380                 stack[sp].kix = kix;
381                 sp++;
382
383                 /* begin again with the new keyring */
384                 keyring = key;
385                 goto descend;
386         }
387
388         /* the keyring we're looking at was disqualified or didn't contain a
389          * matching key */
390 not_this_keyring:
391         if (sp > 0) {
392                 /* resume the processing of a keyring higher up in the tree */
393                 sp--;
394                 keylist = stack[sp].keylist;
395                 kix = stack[sp].kix + 1;
396                 goto ascend;
397         }
398
399         key_ref = ERR_PTR(err);
400         goto error_2;
401
402         /* we found a viable match */
403 found:
404         atomic_inc(&key->usage);
405         key_check(key);
406         key_ref = make_key_ref(key, possessed);
407 error_2:
408         rcu_read_unlock();
409 error:
410         return key_ref;
411
412 } /* end keyring_search_aux() */
413
414 /*****************************************************************************/
415 /*
416  * search the supplied keyring tree for a key that matches the criterion
417  * - perform a breadth-then-depth search up to the prescribed limit
418  * - we only find keys on which we have search permission
419  * - we readlock the keyrings as we search down the tree
420  * - we return -EAGAIN if we didn't find any matching key
421  * - we return -ENOKEY if we only found negative matching keys
422  */
423 key_ref_t keyring_search(key_ref_t keyring,
424                          struct key_type *type,
425                          const char *description)
426 {
427         if (!type->match)
428                 return ERR_PTR(-ENOKEY);
429
430         return keyring_search_aux(keyring, current,
431                                   type, description, type->match);
432
433 } /* end keyring_search() */
434
435 EXPORT_SYMBOL(keyring_search);
436
437 /*****************************************************************************/
438 /*
439  * search the given keyring only (no recursion)
440  * - keyring must be locked by caller
441  * - caller must guarantee that the keyring is a keyring
442  */
443 key_ref_t __keyring_search_one(key_ref_t keyring_ref,
444                                const struct key_type *ktype,
445                                const char *description,
446                                key_perm_t perm)
447 {
448         struct keyring_list *klist;
449         unsigned long possessed;
450         struct key *keyring, *key;
451         int loop;
452
453         keyring = key_ref_to_ptr(keyring_ref);
454         possessed = is_key_possessed(keyring_ref);
455
456         rcu_read_lock();
457
458         klist = rcu_dereference(keyring->payload.subscriptions);
459         if (klist) {
460                 for (loop = 0; loop < klist->nkeys; loop++) {
461                         key = klist->keys[loop];
462
463                         if (key->type == ktype &&
464                             (!key->type->match ||
465                              key->type->match(key, description)) &&
466                             key_permission(make_key_ref(key, possessed),
467                                            perm) == 0 &&
468                             !test_bit(KEY_FLAG_REVOKED, &key->flags)
469                             )
470                                 goto found;
471                 }
472         }
473
474         rcu_read_unlock();
475         return ERR_PTR(-ENOKEY);
476
477  found:
478         atomic_inc(&key->usage);
479         rcu_read_unlock();
480         return make_key_ref(key, possessed);
481
482 } /* end __keyring_search_one() */
483
484 /*****************************************************************************/
485 /*
486  * find a keyring with the specified name
487  * - all named keyrings are searched
488  * - only find keyrings with search permission for the process
489  * - only find keyrings with a serial number greater than the one specified
490  */
491 struct key *find_keyring_by_name(const char *name, key_serial_t bound)
492 {
493         struct key *keyring;
494         int bucket;
495
496         keyring = ERR_PTR(-EINVAL);
497         if (!name)
498                 goto error;
499
500         bucket = keyring_hash(name);
501
502         read_lock(&keyring_name_lock);
503
504         if (keyring_name_hash[bucket].next) {
505                 /* search this hash bucket for a keyring with a matching name
506                  * that's readable and that hasn't been revoked */
507                 list_for_each_entry(keyring,
508                                     &keyring_name_hash[bucket],
509                                     type_data.link
510                                     ) {
511                         if (test_bit(KEY_FLAG_REVOKED, &keyring->flags))
512                                 continue;
513
514                         if (strcmp(keyring->description, name) != 0)
515                                 continue;
516
517                         if (key_permission(make_key_ref(keyring, 0),
518                                            KEY_SEARCH) < 0)
519                                 continue;
520
521                         /* found a potential candidate, but we still need to
522                          * check the serial number */
523                         if (keyring->serial <= bound)
524                                 continue;
525
526                         /* we've got a match */
527                         atomic_inc(&keyring->usage);
528                         read_unlock(&keyring_name_lock);
529                         goto error;
530                 }
531         }
532
533         read_unlock(&keyring_name_lock);
534         keyring = ERR_PTR(-ENOKEY);
535
536  error:
537         return keyring;
538
539 } /* end find_keyring_by_name() */
540
541 /*****************************************************************************/
542 /*
543  * see if a cycle will will be created by inserting acyclic tree B in acyclic
544  * tree A at the topmost level (ie: as a direct child of A)
545  * - since we are adding B to A at the top level, checking for cycles should
546  *   just be a matter of seeing if node A is somewhere in tree B
547  */
548 static int keyring_detect_cycle(struct key *A, struct key *B)
549 {
550         struct {
551                 struct keyring_list *keylist;
552                 int kix;
553         } stack[KEYRING_SEARCH_MAX_DEPTH];
554
555         struct keyring_list *keylist;
556         struct key *subtree, *key;
557         int sp, kix, ret;
558
559         rcu_read_lock();
560
561         ret = -EDEADLK;
562         if (A == B)
563                 goto cycle_detected;
564
565         subtree = B;
566         sp = 0;
567
568         /* start processing a new keyring */
569  descend:
570         if (test_bit(KEY_FLAG_REVOKED, &subtree->flags))
571                 goto not_this_keyring;
572
573         keylist = rcu_dereference(subtree->payload.subscriptions);
574         if (!keylist)
575                 goto not_this_keyring;
576         kix = 0;
577
578  ascend:
579         /* iterate through the remaining keys in this keyring */
580         for (; kix < keylist->nkeys; kix++) {
581                 key = keylist->keys[kix];
582
583                 if (key == A)
584                         goto cycle_detected;
585
586                 /* recursively check nested keyrings */
587                 if (key->type == &key_type_keyring) {
588                         if (sp >= KEYRING_SEARCH_MAX_DEPTH)
589                                 goto too_deep;
590
591                         /* stack the current position */
592                         stack[sp].keylist = keylist;
593                         stack[sp].kix = kix;
594                         sp++;
595
596                         /* begin again with the new keyring */
597                         subtree = key;
598                         goto descend;
599                 }
600         }
601
602         /* the keyring we're looking at was disqualified or didn't contain a
603          * matching key */
604  not_this_keyring:
605         if (sp > 0) {
606                 /* resume the checking of a keyring higher up in the tree */
607                 sp--;
608                 keylist = stack[sp].keylist;
609                 kix = stack[sp].kix + 1;
610                 goto ascend;
611         }
612
613         ret = 0; /* no cycles detected */
614
615  error:
616         rcu_read_unlock();
617         return ret;
618
619  too_deep:
620         ret = -ELOOP;
621         goto error;
622
623  cycle_detected:
624         ret = -EDEADLK;
625         goto error;
626
627 } /* end keyring_detect_cycle() */
628
629 /*****************************************************************************/
630 /*
631  * dispose of a keyring list after the RCU grace period
632  */
633 static void keyring_link_rcu_disposal(struct rcu_head *rcu)
634 {
635         struct keyring_list *klist =
636                 container_of(rcu, struct keyring_list, rcu);
637
638         kfree(klist);
639
640 } /* end keyring_link_rcu_disposal() */
641
642 /*****************************************************************************/
643 /*
644  * dispose of a keyring list after the RCU grace period, freeing the unlinked
645  * key
646  */
647 static void keyring_unlink_rcu_disposal(struct rcu_head *rcu)
648 {
649         struct keyring_list *klist =
650                 container_of(rcu, struct keyring_list, rcu);
651
652         key_put(klist->keys[klist->delkey]);
653         kfree(klist);
654
655 } /* end keyring_unlink_rcu_disposal() */
656
657 /*****************************************************************************/
658 /*
659  * link a key into to a keyring
660  * - must be called with the keyring's semaphore write-locked
661  * - discard already extant link to matching key if there is one
662  */
663 int __key_link(struct key *keyring, struct key *key)
664 {
665         struct keyring_list *klist, *nklist;
666         unsigned max;
667         size_t size;
668         int loop, ret;
669
670         ret = -EKEYREVOKED;
671         if (test_bit(KEY_FLAG_REVOKED, &keyring->flags))
672                 goto error;
673
674         ret = -ENOTDIR;
675         if (keyring->type != &key_type_keyring)
676                 goto error;
677
678         /* serialise link/link calls to prevent parallel calls causing a
679          * cycle when applied to two keyring in opposite orders */
680         down_write(&keyring_serialise_link_sem);
681
682         /* check that we aren't going to create a cycle adding one keyring to
683          * another */
684         if (key->type == &key_type_keyring) {
685                 ret = keyring_detect_cycle(keyring, key);
686                 if (ret < 0)
687                         goto error2;
688         }
689
690         /* see if there's a matching key we can displace */
691         klist = keyring->payload.subscriptions;
692
693         if (klist && klist->nkeys > 0) {
694                 struct key_type *type = key->type;
695
696                 for (loop = klist->nkeys - 1; loop >= 0; loop--) {
697                         if (klist->keys[loop]->type == type &&
698                             strcmp(klist->keys[loop]->description,
699                                    key->description) == 0
700                             ) {
701                                 /* found a match - replace with new key */
702                                 size = sizeof(struct key *) * klist->maxkeys;
703                                 size += sizeof(*klist);
704                                 BUG_ON(size > PAGE_SIZE);
705
706                                 ret = -ENOMEM;
707                                 nklist = kmalloc(size, GFP_KERNEL);
708                                 if (!nklist)
709                                         goto error2;
710
711                                 memcpy(nklist, klist, size);
712
713                                 /* replace matched key */
714                                 atomic_inc(&key->usage);
715                                 nklist->keys[loop] = key;
716
717                                 rcu_assign_pointer(
718                                         keyring->payload.subscriptions,
719                                         nklist);
720
721                                 /* dispose of the old keyring list and the
722                                  * displaced key */
723                                 klist->delkey = loop;
724                                 call_rcu(&klist->rcu,
725                                          keyring_unlink_rcu_disposal);
726
727                                 goto done;
728                         }
729                 }
730         }
731
732         /* check that we aren't going to overrun the user's quota */
733         ret = key_payload_reserve(keyring,
734                                   keyring->datalen + KEYQUOTA_LINK_BYTES);
735         if (ret < 0)
736                 goto error2;
737
738         klist = keyring->payload.subscriptions;
739
740         if (klist && klist->nkeys < klist->maxkeys) {
741                 /* there's sufficient slack space to add directly */
742                 atomic_inc(&key->usage);
743
744                 klist->keys[klist->nkeys] = key;
745                 smp_wmb();
746                 klist->nkeys++;
747                 smp_wmb();
748         }
749         else {
750                 /* grow the key list */
751                 max = 4;
752                 if (klist)
753                         max += klist->maxkeys;
754
755                 ret = -ENFILE;
756                 if (max > 65535)
757                         goto error3;
758                 size = sizeof(*klist) + sizeof(struct key *) * max;
759                 if (size > PAGE_SIZE)
760                         goto error3;
761
762                 ret = -ENOMEM;
763                 nklist = kmalloc(size, GFP_KERNEL);
764                 if (!nklist)
765                         goto error3;
766                 nklist->maxkeys = max;
767                 nklist->nkeys = 0;
768
769                 if (klist) {
770                         nklist->nkeys = klist->nkeys;
771                         memcpy(nklist->keys,
772                                klist->keys,
773                                sizeof(struct key *) * klist->nkeys);
774                 }
775
776                 /* add the key into the new space */
777                 atomic_inc(&key->usage);
778                 nklist->keys[nklist->nkeys++] = key;
779
780                 rcu_assign_pointer(keyring->payload.subscriptions, nklist);
781
782                 /* dispose of the old keyring list */
783                 if (klist)
784                         call_rcu(&klist->rcu, keyring_link_rcu_disposal);
785         }
786
787 done:
788         ret = 0;
789 error2:
790         up_write(&keyring_serialise_link_sem);
791 error:
792         return ret;
793
794 error3:
795         /* undo the quota changes */
796         key_payload_reserve(keyring,
797                             keyring->datalen - KEYQUOTA_LINK_BYTES);
798         goto error2;
799
800 } /* end __key_link() */
801
802 /*****************************************************************************/
803 /*
804  * link a key to a keyring
805  */
806 int key_link(struct key *keyring, struct key *key)
807 {
808         int ret;
809
810         key_check(keyring);
811         key_check(key);
812
813         down_write(&keyring->sem);
814         ret = __key_link(keyring, key);
815         up_write(&keyring->sem);
816
817         return ret;
818
819 } /* end key_link() */
820
821 EXPORT_SYMBOL(key_link);
822
823 /*****************************************************************************/
824 /*
825  * unlink the first link to a key from a keyring
826  */
827 int key_unlink(struct key *keyring, struct key *key)
828 {
829         struct keyring_list *klist, *nklist;
830         int loop, ret;
831
832         key_check(keyring);
833         key_check(key);
834
835         ret = -ENOTDIR;
836         if (keyring->type != &key_type_keyring)
837                 goto error;
838
839         down_write(&keyring->sem);
840
841         klist = keyring->payload.subscriptions;
842         if (klist) {
843                 /* search the keyring for the key */
844                 for (loop = 0; loop < klist->nkeys; loop++)
845                         if (klist->keys[loop] == key)
846                                 goto key_is_present;
847         }
848
849         up_write(&keyring->sem);
850         ret = -ENOENT;
851         goto error;
852
853 key_is_present:
854         /* we need to copy the key list for RCU purposes */
855         nklist = kmalloc(sizeof(*klist) +
856                          sizeof(struct key *) * klist->maxkeys,
857                          GFP_KERNEL);
858         if (!nklist)
859                 goto nomem;
860         nklist->maxkeys = klist->maxkeys;
861         nklist->nkeys = klist->nkeys - 1;
862
863         if (loop > 0)
864                 memcpy(&nklist->keys[0],
865                        &klist->keys[0],
866                        loop * sizeof(struct key *));
867
868         if (loop < nklist->nkeys)
869                 memcpy(&nklist->keys[loop],
870                        &klist->keys[loop + 1],
871                        (nklist->nkeys - loop) * sizeof(struct key *));
872
873         /* adjust the user's quota */
874         key_payload_reserve(keyring,
875                             keyring->datalen - KEYQUOTA_LINK_BYTES);
876
877         rcu_assign_pointer(keyring->payload.subscriptions, nklist);
878
879         up_write(&keyring->sem);
880
881         /* schedule for later cleanup */
882         klist->delkey = loop;
883         call_rcu(&klist->rcu, keyring_unlink_rcu_disposal);
884
885         ret = 0;
886
887 error:
888         return ret;
889 nomem:
890         ret = -ENOMEM;
891         up_write(&keyring->sem);
892         goto error;
893
894 } /* end key_unlink() */
895
896 EXPORT_SYMBOL(key_unlink);
897
898 /*****************************************************************************/
899 /*
900  * dispose of a keyring list after the RCU grace period, releasing the keys it
901  * links to
902  */
903 static void keyring_clear_rcu_disposal(struct rcu_head *rcu)
904 {
905         struct keyring_list *klist;
906         int loop;
907
908         klist = container_of(rcu, struct keyring_list, rcu);
909
910         for (loop = klist->nkeys - 1; loop >= 0; loop--)
911                 key_put(klist->keys[loop]);
912
913         kfree(klist);
914
915 } /* end keyring_clear_rcu_disposal() */
916
917 /*****************************************************************************/
918 /*
919  * clear the specified process keyring
920  * - implements keyctl(KEYCTL_CLEAR)
921  */
922 int keyring_clear(struct key *keyring)
923 {
924         struct keyring_list *klist;
925         int ret;
926
927         ret = -ENOTDIR;
928         if (keyring->type == &key_type_keyring) {
929                 /* detach the pointer block with the locks held */
930                 down_write(&keyring->sem);
931
932                 klist = keyring->payload.subscriptions;
933                 if (klist) {
934                         /* adjust the quota */
935                         key_payload_reserve(keyring,
936                                             sizeof(struct keyring_list));
937
938                         rcu_assign_pointer(keyring->payload.subscriptions,
939                                            NULL);
940                 }
941
942                 up_write(&keyring->sem);
943
944                 /* free the keys after the locks have been dropped */
945                 if (klist)
946                         call_rcu(&klist->rcu, keyring_clear_rcu_disposal);
947
948                 ret = 0;
949         }
950
951         return ret;
952
953 } /* end keyring_clear() */
954
955 EXPORT_SYMBOL(keyring_clear);