Patched in Tegra support.

1 files changed, 80 insertions, 134 deletions

diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index 6ece7f2e570..30e242f7bd0 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -25,15 +25,6 @@
                 (keyring)->payload.subscriptions,                       \
                 rwsem_is_locked((struct rw_semaphore *)&(keyring)->sem)))
 
-#define rcu_deref_link_locked(klist, index, keyring)                    \
-        (rcu_dereference_protected(                                     \
-                (klist)->keys[index],                                   \
-                rwsem_is_locked((struct rw_semaphore *)&(keyring)->sem)))
-
-#define MAX_KEYRING_LINKS                                               \
-        min_t(size_t, USHRT_MAX - 1,                                    \
-              ((PAGE_SIZE - sizeof(struct keyring_list)) / sizeof(struct key *)))
-
 #define KEY_LINK_FIXQUOTA 1UL
 
 /*
@@ -66,7 +57,7 @@ static inline unsigned keyring_hash(const char *desc)
  * operations.
  */
 static int keyring_instantiate(struct key *keyring,
-                               struct key_preparsed_payload *prep);
+                               const void *data, size_t datalen);
 static int keyring_match(const struct key *keyring, const void *criterion);
 static void keyring_revoke(struct key *keyring);
 static void keyring_destroy(struct key *keyring);
@@ -121,12 +112,12 @@ static void keyring_publish_name(struct key *keyring)
  * Returns 0 on success, -EINVAL if given any data.
  */
 static int keyring_instantiate(struct key *keyring,
-                               struct key_preparsed_payload *prep)
+                               const void *data, size_t datalen)
 {
         int ret;
 
         ret = -EINVAL;
-        if (prep->datalen == 0) {
+        if (datalen == 0) {
                 /* make the keyring available by name if it has one */
                 keyring_publish_name(keyring);
                 ret = 0;
@@ -147,11 +138,6 @@ static int keyring_match(const struct key *keyring, const void *description)
 /*
  * Clean up a keyring when it is destroyed.  Unpublish its name if it had one
  * and dispose of its data.
- *
- * The garbage collector detects the final key_put(), removes the keyring from
- * the serial number tree and then does RCU synchronisation before coming here,
- * so we shouldn't need to worry about code poking around here with the RCU
- * readlock held by this time.
  */
 static void keyring_destroy(struct key *keyring)
 {
@@ -168,10 +154,11 @@ static void keyring_destroy(struct key *keyring)
                 write_unlock(&keyring_name_lock);
         }
 
-        klist = rcu_access_pointer(keyring->payload.subscriptions);
+        klist = rcu_dereference_check(keyring->payload.subscriptions,
+                                      atomic_read(&keyring->usage) == 0);
         if (klist) {
                 for (loop = klist->nkeys - 1; loop >= 0; loop--)
-                        key_put(rcu_access_pointer(klist->keys[loop]));
+                        key_put(klist->keys[loop]);
                 kfree(klist);
         }
 }
@@ -227,8 +214,7 @@ static long keyring_read(const struct key *keyring,
                         ret = -EFAULT;
 
                         for (loop = 0; loop < klist->nkeys; loop++) {
-                                key = rcu_deref_link_locked(klist, loop,
-                                                            keyring);
+                                key = klist->keys[loop];
 
                                 tmp = sizeof(key_serial_t);
                                 if (tmp > buflen)
@@ -256,15 +242,18 @@ error:
 /*
  * Allocate a keyring and link into the destination keyring.
  */
-struct key *keyring_alloc(const char *description, kuid_t uid, kgid_t gid,
-                          const struct cred *cred, key_perm_t perm,
-                          unsigned long flags, struct key *dest)
+struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,
+                          const struct cred *cred, unsigned long flags,
+                          struct key *dest)
 {
         struct key *keyring;
         int ret;
 
         keyring = key_alloc(&key_type_keyring, description,
-                            uid, gid, cred, perm, flags);
+                            uid, gid, cred,
+                            (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_ALL,
+                            flags);
+
         if (!IS_ERR(keyring)) {
                 ret = key_instantiate_and_link(keyring, NULL, 0, dest, NULL);
                 if (ret < 0) {
@@ -275,7 +264,6 @@ struct key *keyring_alloc(const char *description, kuid_t uid, kgid_t gid,
 
         return keyring;
 }
-EXPORT_SYMBOL(keyring_alloc);
 
 /**
  * keyring_search_aux - Search a keyring tree for a key matching some criteria
@@ -321,8 +309,6 @@ key_ref_t keyring_search_aux(key_ref_t keyring_ref,
                              bool no_state_check)
 {
         struct {
-                /* Need a separate keylist pointer for RCU purposes */
-                struct key *keyring;
                 struct keyring_list *keylist;
                 int kix;
         } stack[KEYRING_SEARCH_MAX_DEPTH];
@@ -333,7 +319,7 @@ key_ref_t keyring_search_aux(key_ref_t keyring_ref,
         struct key *keyring, *key;
         key_ref_t key_ref;
         long err;
-        int sp, nkeys, kix;
+        int sp, kix;
 
         keyring = key_ref_to_ptr(keyring_ref);
         possessed = is_key_possessed(keyring_ref);
@@ -380,17 +366,13 @@ key_ref_t keyring_search_aux(key_ref_t keyring_ref,
         /* otherwise, the top keyring must not be revoked, expired, or
          * negatively instantiated if we are to search it */
         key_ref = ERR_PTR(-EAGAIN);
-        if (kflags & ((1 << KEY_FLAG_INVALIDATED) |
-                      (1 << KEY_FLAG_REVOKED) |
-                      (1 << KEY_FLAG_NEGATIVE)) ||
+        if (kflags & ((1 << KEY_FLAG_REVOKED) | (1 << KEY_FLAG_NEGATIVE)) ||
             (keyring->expiry && now.tv_sec >= keyring->expiry))
                 goto error_2;
 
         /* start processing a new keyring */
 descend:
-        kflags = keyring->flags;
-        if (kflags & ((1 << KEY_FLAG_INVALIDATED) |
-                      (1 << KEY_FLAG_REVOKED)))
+        if (test_bit(KEY_FLAG_REVOKED, &keyring->flags))
                 goto not_this_keyring;
 
         keylist = rcu_dereference(keyring->payload.subscriptions);
@@ -398,20 +380,17 @@ descend:
                 goto not_this_keyring;
 
         /* iterate through the keys in this keyring first */
-        nkeys = keylist->nkeys;
-        smp_rmb();
-        for (kix = 0; kix < nkeys; kix++) {
-                key = rcu_dereference(keylist->keys[kix]);
+        for (kix = 0; kix < keylist->nkeys; kix++) {
+                key = keylist->keys[kix];
                 kflags = key->flags;
 
                 /* ignore keys not of this type */
                 if (key->type != type)
                         continue;
 
-                /* skip invalidated, revoked and expired keys */
+                /* skip revoked keys and expired keys */
                 if (!no_state_check) {
-                        if (kflags & ((1 << KEY_FLAG_INVALIDATED) |
-                                      (1 << KEY_FLAG_REVOKED)))
+                        if (kflags & (1 << KEY_FLAG_REVOKED))
                                 continue;
 
                         if (key->expiry && now.tv_sec >= key->expiry)
@@ -442,10 +421,8 @@ descend:
         /* search through the keyrings nested in this one */
         kix = 0;
 ascend:
-        nkeys = keylist->nkeys;
-        smp_rmb();
-        for (; kix < nkeys; kix++) {
-                key = rcu_dereference(keylist->keys[kix]);
+        for (; kix < keylist->nkeys; kix++) {
+                key = keylist->keys[kix];
                 if (key->type != &key_type_keyring)
                         continue;
 
@@ -460,7 +437,6 @@ ascend:
                         continue;
 
                 /* stack the current position */
-                stack[sp].keyring = keyring;
                 stack[sp].keylist = keylist;
                 stack[sp].kix = kix;
                 sp++;
@@ -476,7 +452,6 @@ not_this_keyring:
         if (sp > 0) {
                 /* resume the processing of a keyring higher up in the tree */
                 sp--;
-                keyring = stack[sp].keyring;
                 keylist = stack[sp].keylist;
                 kix = stack[sp].kix + 1;
                 goto ascend;
@@ -488,10 +463,6 @@ not_this_keyring:
         /* we found a viable match */
 found:
         atomic_inc(&key->usage);
-        key->last_used_at = now.tv_sec;
-        keyring->last_used_at = now.tv_sec;
-        while (sp > 0)
-                stack[--sp].keyring->last_used_at = now.tv_sec;
         key_check(key);
         key_ref = make_key_ref(key, possessed);
 error_2:
@@ -544,7 +515,7 @@ key_ref_t __keyring_search_one(key_ref_t keyring_ref,
         struct keyring_list *klist;
         unsigned long possessed;
         struct key *keyring, *key;
-        int nkeys, loop;
+        int loop;
 
         keyring = key_ref_to_ptr(keyring_ref);
         possessed = is_key_possessed(keyring_ref);
@@ -553,17 +524,15 @@ key_ref_t __keyring_search_one(key_ref_t keyring_ref,
 
         klist = rcu_dereference(keyring->payload.subscriptions);
         if (klist) {
-                nkeys = klist->nkeys;
-                smp_rmb();
-                for (loop = 0; loop < nkeys ; loop++) {
-                        key = rcu_dereference(klist->keys[loop]);
+                for (loop = 0; loop < klist->nkeys; loop++) {
+                        key = klist->keys[loop];
+
                         if (key->type == ktype &&
                             (!key->type->match ||
                              key->type->match(key, description)) &&
                             key_permission(make_key_ref(key, possessed),
                                            perm) == 0 &&
-                            !(key->flags & ((1 << KEY_FLAG_INVALIDATED) |
-                                            (1 << KEY_FLAG_REVOKED)))
+                            !test_bit(KEY_FLAG_REVOKED, &key->flags)
                             )
                                 goto found;
                 }
@@ -574,8 +543,6 @@ key_ref_t __keyring_search_one(key_ref_t keyring_ref,
 
 found:
         atomic_inc(&key->usage);
-        keyring->last_used_at = key->last_used_at =
-                current_kernel_time().tv_sec;
         rcu_read_unlock();
         return make_key_ref(key, possessed);
 }
@@ -610,7 +577,7 @@ struct key *find_keyring_by_name(const char *name, bool skip_perm_check)
                                     &keyring_name_hash[bucket],
                                     type_data.link
                                     ) {
-                        if (!kuid_has_mapping(current_user_ns(), keyring->user->uid))
+                        if (keyring->user->user_ns != current_user_ns())
                                 continue;
 
                         if (test_bit(KEY_FLAG_REVOKED, &keyring->flags))
@@ -629,7 +596,6 @@ struct key *find_keyring_by_name(const char *name, bool skip_perm_check)
                          * (ie. it has a zero usage count) */
                         if (!atomic_inc_not_zero(&keyring->usage))
                                 continue;
-                        keyring->last_used_at = current_kernel_time().tv_sec;
                         goto out;
                 }
         }
@@ -656,7 +622,7 @@ static int keyring_detect_cycle(struct key *A, struct key *B)
 
         struct keyring_list *keylist;
         struct key *subtree, *key;
-        int sp, nkeys, kix, ret;
+        int sp, kix, ret;
 
         rcu_read_lock();
 
@@ -679,10 +645,8 @@ descend:
 
 ascend:
         /* iterate through the remaining keys in this keyring */
-        nkeys = keylist->nkeys;
-        smp_rmb();
-        for (; kix < nkeys; kix++) {
-                key = rcu_dereference(keylist->keys[kix]);
+        for (; kix < keylist->nkeys; kix++) {
+                key = keylist->keys[kix];
 
                 if (key == A)
                         goto cycle_detected;
@@ -739,7 +703,7 @@ static void keyring_unlink_rcu_disposal(struct rcu_head *rcu)
                 container_of(rcu, struct keyring_list, rcu);
 
         if (klist->delkey != USHRT_MAX)
-                key_put(rcu_access_pointer(klist->keys[klist->delkey]));
+                key_put(klist->keys[klist->delkey]);
         kfree(klist);
 }
 
@@ -749,14 +713,12 @@ static void keyring_unlink_rcu_disposal(struct rcu_head *rcu)
 int __key_link_begin(struct key *keyring, const struct key_type *type,
                      const char *description, unsigned long *_prealloc)
         __acquires(&keyring->sem)
-        __acquires(&keyring_serialise_link_sem)
 {
         struct keyring_list *klist, *nklist;
         unsigned long prealloc;
         unsigned max;
-        time_t lowest_lru;
         size_t size;
-        int loop, lru, ret;
+        int loop, ret;
 
         kenter("%d,%s,%s,", key_serial(keyring), type->name, description);
 
@@ -777,39 +739,31 @@ int __key_link_begin(struct key *keyring, const struct key_type *type,
         klist = rcu_dereference_locked_keyring(keyring);
 
         /* see if there's a matching key we can displace */
-        lru = -1;
         if (klist && klist->nkeys > 0) {
-                lowest_lru = TIME_T_MAX;
                 for (loop = klist->nkeys - 1; loop >= 0; loop--) {
-                        struct key *key = rcu_deref_link_locked(klist, loop,
-                                                                keyring);
-                        if (key->type == type &&
-                            strcmp(key->description, description) == 0) {
-                                /* Found a match - we'll replace the link with
-                                 * one to the new key.  We record the slot
-                                 * position.
-                                 */
-                                klist->delkey = loop;
-                                prealloc = 0;
+                        if (klist->keys[loop]->type == type &&
+                            strcmp(klist->keys[loop]->description,
+                                   description) == 0
+                            ) {
+                                /* found a match - we'll replace this one with
+                                 * the new key */
+                                size = sizeof(struct key *) * klist->maxkeys;
+                                size += sizeof(*klist);
+                                BUG_ON(size > PAGE_SIZE);
+
+                                ret = -ENOMEM;
+                                nklist = kmemdup(klist, size, GFP_KERNEL);
+                                if (!nklist)
+                                        goto error_sem;
+
+                                /* note replacement slot */
+                                klist->delkey = nklist->delkey = loop;
+                                prealloc = (unsigned long)nklist;
                                 goto done;
                         }
-                        if (key->last_used_at < lowest_lru) {
-                                lowest_lru = key->last_used_at;
-                                lru = loop;
-                        }
                 }
         }
 
-        /* If the keyring is full then do an LRU discard */
-        if (klist &&
-            klist->nkeys == klist->maxkeys &&
-            klist->maxkeys >= MAX_KEYRING_LINKS) {
-                kdebug("LRU discard %d\n", lru);
-                klist->delkey = lru;
-                prealloc = 0;
-                goto done;
-        }
-
         /* check that we aren't going to overrun the user's quota */
         ret = key_payload_reserve(keyring,
                                   keyring->datalen + KEYQUOTA_LINK_BYTES);
@@ -818,19 +772,20 @@ int __key_link_begin(struct key *keyring, const struct key_type *type,
 
         if (klist && klist->nkeys < klist->maxkeys) {
                 /* there's sufficient slack space to append directly */
-                klist->delkey = klist->nkeys;
+                nklist = NULL;
                 prealloc = KEY_LINK_FIXQUOTA;
         } else {
                 /* grow the key list */
                 max = 4;
-                if (klist) {
+                if (klist)
                         max += klist->maxkeys;
-                        if (max > MAX_KEYRING_LINKS)
-                                max = MAX_KEYRING_LINKS;
-                        BUG_ON(max <= klist->maxkeys);
-                }
 
+                ret = -ENFILE;
+                if (max > USHRT_MAX - 1)
+                        goto error_quota;
                 size = sizeof(*klist) + sizeof(struct key *) * max;
+                if (size > PAGE_SIZE)
+                        goto error_quota;
 
                 ret = -ENOMEM;
                 nklist = kmalloc(size, GFP_KERNEL);
@@ -850,10 +805,10 @@ int __key_link_begin(struct key *keyring, const struct key_type *type,
                 }
 
                 /* add the key into the new space */
-                RCU_INIT_POINTER(nklist->keys[nklist->delkey], NULL);
-                prealloc = (unsigned long)nklist | KEY_LINK_FIXQUOTA;
+                nklist->keys[nklist->delkey] = NULL;
         }
 
+        prealloc = (unsigned long)nklist | KEY_LINK_FIXQUOTA;
 done:
         *_prealloc = prealloc;
         kleave(" = 0");
@@ -899,26 +854,24 @@ void __key_link(struct key *keyring, struct key *key,
                 unsigned long *_prealloc)
 {
         struct keyring_list *klist, *nklist;
-        struct key *discard;
 
         nklist = (struct keyring_list *)(*_prealloc & ~KEY_LINK_FIXQUOTA);
         *_prealloc = 0;
 
         kenter("%d,%d,%p", keyring->serial, key->serial, nklist);
 
-        klist = rcu_dereference_locked_keyring(keyring);
+        klist = rcu_dereference_protected(keyring->payload.subscriptions,
+                                          rwsem_is_locked(&keyring->sem));
 
         atomic_inc(&key->usage);
-        keyring->last_used_at = key->last_used_at =
-                current_kernel_time().tv_sec;
 
         /* there's a matching key we can displace or an empty slot in a newly
          * allocated list we can fill */
         if (nklist) {
-                kdebug("reissue %hu/%hu/%hu",
+                kdebug("replace %hu/%hu/%hu",
                        nklist->delkey, nklist->nkeys, nklist->maxkeys);
 
-                RCU_INIT_POINTER(nklist->keys[nklist->delkey], key);
+                nklist->keys[nklist->delkey] = key;
 
                 rcu_assign_pointer(keyring->payload.subscriptions, nklist);
 
@@ -929,23 +882,9 @@ void __key_link(struct key *keyring, struct key *key,
                                klist->delkey, klist->nkeys, klist->maxkeys);
                         call_rcu(&klist->rcu, keyring_unlink_rcu_disposal);
                 }
-        } else if (klist->delkey < klist->nkeys) {
-                kdebug("replace %hu/%hu/%hu",
-                       klist->delkey, klist->nkeys, klist->maxkeys);
-
-                discard = rcu_dereference_protected(
-                        klist->keys[klist->delkey],
-                        rwsem_is_locked(&keyring->sem));
-                rcu_assign_pointer(klist->keys[klist->delkey], key);
-                /* The garbage collector will take care of RCU
-                 * synchronisation */
-                key_put(discard);
         } else {
                 /* there's sufficient slack space to append directly */
-                kdebug("append %hu/%hu/%hu",
-                       klist->delkey, klist->nkeys, klist->maxkeys);
-
-                RCU_INIT_POINTER(klist->keys[klist->delkey], key);
+                klist->keys[klist->nkeys] = key;
                 smp_wmb();
                 klist->nkeys++;
         }
@@ -959,7 +898,6 @@ void __key_link(struct key *keyring, struct key *key,
 void __key_link_end(struct key *keyring, struct key_type *type,
                     unsigned long prealloc)
         __releases(&keyring->sem)
-        __releases(&keyring_serialise_link_sem)
 {
         BUG_ON(type == NULL);
         BUG_ON(type->name == NULL);
@@ -1053,7 +991,7 @@ int key_unlink(struct key *keyring, struct key *key)
         if (klist) {
                 /* search the keyring for the key */
                 for (loop = 0; loop < klist->nkeys; loop++)
-                        if (rcu_access_pointer(klist->keys[loop]) == key)
+                        if (klist->keys[loop] == key)
                                 goto key_is_present;
         }
 
@@ -1116,7 +1054,7 @@ static void keyring_clear_rcu_disposal(struct rcu_head *rcu)
         klist = container_of(rcu, struct keyring_list, rcu);
 
         for (loop = klist->nkeys - 1; loop >= 0; loop--)
-                key_put(rcu_access_pointer(klist->keys[loop]));
+                key_put(klist->keys[loop]);
 
         kfree(klist);
 }
@@ -1183,6 +1121,15 @@ static void keyring_revoke(struct key *keyring)
 }
 
 /*
+ * Determine whether a key is dead.
+ */
+static bool key_is_dead(struct key *key, time_t limit)
+{
+        return test_bit(KEY_FLAG_DEAD, &key->flags) ||
+                (key->expiry > 0 && key->expiry <= limit);
+}
+
+/*
  * Collect garbage from the contents of a keyring, replacing the old list with
  * a new one with the pointers all shuffled down.
  *
@@ -1207,8 +1154,7 @@ void keyring_gc(struct key *keyring, time_t limit)
         /* work out how many subscriptions we're keeping */
         keep = 0;
         for (loop = klist->nkeys - 1; loop >= 0; loop--)
-                if (!key_is_dead(rcu_deref_link_locked(klist, loop, keyring),
-                                 limit))
+                if (!key_is_dead(klist->keys[loop], limit))
                         keep++;
 
         if (keep == klist->nkeys)
@@ -1229,11 +1175,11 @@ void keyring_gc(struct key *keyring, time_t limit)
          */
         keep = 0;
         for (loop = klist->nkeys - 1; loop >= 0; loop--) {
-                key = rcu_deref_link_locked(klist, loop, keyring);
+                key = klist->keys[loop];
                 if (!key_is_dead(key, limit)) {
                         if (keep >= max)
                                 goto discard_new;
-                        RCU_INIT_POINTER(new->keys[keep++], key_get(key));
+                        new->keys[keep++] = key_get(key);
                 }
         }
         new->nkeys = keep;