25  * When plumbing the depths of the key tree, this sets a hard limit
40 static inline struct key *keyring_ptr_to_key(const struct assoc_array_ptr *x)  in keyring_ptr_to_key()
43 	return (struct key *)((unsigned long)object & ~KEYRING_PTR_SUBTYPE);  in keyring_ptr_to_key()
45 static inline void *keyring_key_to_ptr(struct key *key)  in keyring_key_to_ptr()  argument
47 	if (key->type == &key_type_keyring)  in keyring_key_to_ptr()
48 		return (void *)((unsigned long)key | KEYRING_PTR_SUBTYPE);  in keyring_key_to_ptr()
49 	return key;  in keyring_key_to_ptr()
70  * The keyring key type definition.  Keyrings are simply keys of this type and
76 static int keyring_instantiate(struct key *keyring,
78 static void keyring_revoke(struct key *keyring);
79 static void keyring_destroy(struct key *keyring);
80 static void keyring_describe(const struct key *keyring, struct seq_file *m);
81 static long keyring_read(const struct key *keyring,
107 static void keyring_publish_name(struct key *keyring)  in keyring_publish_name()
129  * Free a preparse of a user defined key payload
140 static int keyring_instantiate(struct key *keyring,  in keyring_instantiate()
161  * Hash a key type and description.
211  * Finalise an index key to include a part of the description actually in the
212  * index key, to set the domain tag and to calculate the hash.
249  * key_remove_domain - Kill off a key domain and gc its keys
264  * Build the next index key chunk.
305 	const struct key *key = keyring_ptr_to_key(object);  in keyring_get_object_key_chunk()  local
306 	return keyring_get_key_chunk(&key->index_key, level);  in keyring_get_object_key_chunk()
312 	const struct key *key = keyring_ptr_to_key(object);  in keyring_compare_object()  local
314 	return key->index_key.type == index_key->type &&  in keyring_compare_object()
315 		key->index_key.domain_tag == index_key->domain_tag &&  in keyring_compare_object()
316 		key->index_key.desc_len == index_key->desc_len &&  in keyring_compare_object()
317 		memcmp(key->index_key.description, index_key->description,  in keyring_compare_object()
327 	const struct key *key_a = keyring_ptr_to_key(object);  in keyring_diff_objects()
412 static void keyring_destroy(struct key *keyring)  in keyring_destroy()
427 		key_put(keyres->key);  in keyring_destroy()
437 static void keyring_describe(const struct key *keyring, struct seq_file *m)  in keyring_describe()
461 	const struct key *key = keyring_ptr_to_key(object);  in keyring_read_iterator()  local
464 	       key->type->name, key->serial, ctx->count, ctx->buflen);  in keyring_read_iterator()
469 	*ctx->buffer++ = key->serial;  in keyring_read_iterator()
470 	ctx->count += sizeof(key->serial);  in keyring_read_iterator()
475  * Read a list of key IDs from the keyring's contents in binary form
478  * from modifying it under us - which could cause us to read key IDs multiple
481 static long keyring_read(const struct key *keyring,  in keyring_read()
492 	/* Copy as many key IDs as fit into the buffer */  in keyring_read()
517 struct key *keyring_alloc(const char *description, kuid_t uid, kgid_t gid,  in keyring_alloc()
521 			  struct key *dest)  in keyring_alloc()
523 	struct key *keyring;  in keyring_alloc()
543  * @type: The type of key being added.
544  * @payload: The payload of the key intended to be added.
549  * adding a key to a keyring.
554 int restrict_link_reject(struct key *keyring,  in restrict_link_reject()
557 			 struct key *restriction_key)  in restrict_link_reject()
565 bool key_default_cmp(const struct key *key,  in key_default_cmp()  argument
568 	return strcmp(key->description, match_data->raw_data) == 0;  in key_default_cmp()
572  * Iteration function to consider each key found.
577 	const struct key *key = keyring_ptr_to_key(object);  in keyring_search_iterator()  local
578 	unsigned long kflags = READ_ONCE(key->flags);  in keyring_search_iterator()
579 	short state = READ_ONCE(key->state);  in keyring_search_iterator()
581 	kenter("{%d}", key->serial);  in keyring_search_iterator()
584 	if (key->type != ctx->index_key.type) {  in keyring_search_iterator()
591 		time64_t expiry = READ_ONCE(key->expiry);  in keyring_search_iterator()
609 	if (!ctx->match_data.cmp(key, &ctx->match_data)) {  in keyring_search_iterator()
614 	/* key must have search permissions */  in keyring_search_iterator()
616 	    key_task_permission(make_key_ref(key, ctx->possessed),  in keyring_search_iterator()
624 		/* we set a different error code if we pass a negative key */  in keyring_search_iterator()
633 	ctx->result = make_key_ref(key, ctx->possessed);  in keyring_search_iterator()
642  * Search inside a keyring for a key.  We can search by walking to it
643  * directly based on its index-key or we can iterate over the entire
646 static int search_keyring(struct key *keyring, struct keyring_search_context *ctx)  in search_keyring()
663 static bool search_nested_keyrings(struct key *keyring,  in search_nested_keyrings()
667 		struct key *keyring;  in search_nested_keyrings()
675 	struct key *key;  in search_nested_keyrings()  local
784 		key = keyring_ptr_to_key(ptr);  in search_nested_keyrings()
796 		    key_task_permission(make_key_ref(key, ctx->possessed),  in search_nested_keyrings()
807 		keyring = key;  in search_nested_keyrings()
837 	 * matching key.  in search_nested_keyrings()
856 	key = key_ref_to_ptr(ctx->result);  in search_nested_keyrings()
857 	key_check(key);  in search_nested_keyrings()
859 		key->last_used_at = ctx->now;  in search_nested_keyrings()
869  * keyring_search_rcu - Search a keyring tree for a matching key under RCU
873  * Search the supplied keyring tree for a key that matches the criteria given.
878  * addition, the LSM gets to forbid keyring searches and key matches.
887  * match function may use any attributes of a key that it wishes to
888  * determine the match.  Normally the match function from the key type would be
891  * RCU can be used to prevent the keyring key lists from disappearing without
894  * Returns a pointer to the found key and increments the key usage count if
900  * @keyring_ref is propagated to the returned key reference.
905 	struct key *keyring;  in keyring_search_rcu()
931  * keyring_search - Search the supplied keyring tree for a matching key
955 	key_ref_t key;  in keyring_search()  local
967 	key = keyring_search_rcu(keyring, &ctx);  in keyring_search()
972 	return key;  in keyring_search()
992  * cycles through restriction key pointers.
1000 static bool keyring_detect_restriction_cycle(const struct key *dest_keyring,  in keyring_detect_restriction_cycle()
1003 	while (keyres && keyres->key &&  in keyring_detect_restriction_cycle()
1004 	       keyres->key->type == &key_type_keyring) {  in keyring_detect_restriction_cycle()
1005 		if (keyres->key == dest_keyring)  in keyring_detect_restriction_cycle()
1008 		keyres = keyres->key->restrict_link;  in keyring_detect_restriction_cycle()
1017  * @type: The key type that will provide the restriction checker.
1021  * by the specific key type, but can be configured by the options specified in
1027 	struct key *keyring;  in keyring_restrict()
1075 		key_put(restrict_link->key);  in keyring_restrict()
1088  * Search the given keyring for a key that might be updated.
1094  * Returns a pointer to the found key with usage count incremented if
1099  * to the returned key reference.
1104 	struct key *keyring, *key;  in find_key_to_update()  local
1122 	key = keyring_ptr_to_key(object);  in find_key_to_update()
1123 	if (key->flags & ((1 << KEY_FLAG_INVALIDATED) |  in find_key_to_update()
1128 	__key_get(key);  in find_key_to_update()
1129 	kleave(" = {%d}", key->serial);  in find_key_to_update()
1130 	return make_key_ref(key, is_key_possessed(keyring_ref));  in find_key_to_update()
1142  * incremented on success.  -ENOKEY is returned if a key could not be found.
1144 struct key *find_keyring_by_name(const char *name, bool uid_keyring)  in find_keyring_by_name()
1147 	struct key *keyring;  in find_keyring_by_name()
1196 	const struct key *key = keyring_ptr_to_key(object);  in keyring_detect_cycle_iterator()  local
1198 	kenter("{%d}", key->serial);  in keyring_detect_cycle_iterator()
1200 	/* We might get a keyring with matching index-key that is nonetheless a  in keyring_detect_cycle_iterator()
1202 	if (key != ctx->match_data.raw_data)  in keyring_detect_cycle_iterator()
1216 static int keyring_detect_cycle(struct key *A, struct key *B)  in keyring_detect_cycle()
1239 int __key_link_lock(struct key *keyring,  in __key_link_lock()
1261 int __key_move_lock(struct key *l_keyring, struct key *u_keyring,  in __key_move_lock()
1293  * Preallocate memory so that a key can be linked into to a keyring.
1295 int __key_link_begin(struct key *keyring,  in __key_link_begin()
1314 	/* Create an edit script that will insert/replace the key in the  in __key_link_begin()
1353 int __key_link_check_live_key(struct key *keyring, struct key *key)  in __key_link_check_live_key()  argument
1355 	if (key->type == &key_type_keyring)  in __key_link_check_live_key()
1358 		return keyring_detect_cycle(keyring, key);  in __key_link_check_live_key()
1363  * Link a key into to a keyring.
1366  * already extant link to matching key if there is one, so that each keyring
1367  * holds at most one link to any given key of a particular type+description
1370 void __key_link(struct key *keyring, struct key *key,  in __key_link()  argument
1373 	__key_get(key);  in __key_link()
1374 	assoc_array_insert_set_object(*_edit, keyring_key_to_ptr(key));  in __key_link()
1377 	notify_key(keyring, NOTIFY_KEY_LINKED, key_serial(key));  in __key_link()
1381  * Finish linking a key into to a keyring.
1385 void __key_link_end(struct key *keyring,  in __key_link_end()
1410 static int __key_link_check_restriction(struct key *keyring, struct key *key)  in __key_link_check_restriction()  argument
1414 	return keyring->restrict_link->check(keyring, key->type, &key->payload,  in __key_link_check_restriction()
1415 					     keyring->restrict_link->key);  in __key_link_check_restriction()
1419  * key_link - Link a key to a keyring
1421  * @key: The key to link to.
1423  * Make a link in a keyring to a key, such that the keyring holds a reference
1424  * on that key and the key can potentially be found by searching that keyring.
1427  * of the user's key data quota to hold the link.
1431  * full, -EDQUOT if there is insufficient key data quota remaining to add
1435  * be made (the keyring should have Write permission and the key Link
1438 int key_link(struct key *keyring, struct key *key)  in key_link()  argument
1446 	key_check(key);  in key_link()
1448 	ret = __key_link_lock(keyring, &key->index_key);  in key_link()
1452 	ret = __key_link_begin(keyring, &key->index_key, &edit);  in key_link()
1457 	ret = __key_link_check_restriction(keyring, key);  in key_link()
1459 		ret = __key_link_check_live_key(keyring, key);  in key_link()
1461 		__key_link(keyring, key, &edit);  in key_link()
1464 	__key_link_end(keyring, &key->index_key, edit);  in key_link()
1474 static int __key_unlink_lock(struct key *keyring)  in __key_unlink_lock()
1485  * Begin the process of unlinking a key from a keyring.
1487 static int __key_unlink_begin(struct key *keyring, struct key *key,  in __key_unlink_begin()  argument
1495 				  &key->index_key);  in __key_unlink_begin()
1509 static void __key_unlink(struct key *keyring, struct key *key,  in __key_unlink()  argument
1513 	notify_key(keyring, NOTIFY_KEY_UNLINKED, key_serial(key));  in __key_unlink()
1519  * Finish unlinking a key from to a keyring.
1521 static void __key_unlink_end(struct key *keyring,  in __key_unlink_end()  argument
1522 			     struct key *key,  in __key_unlink_end()
1532  * key_unlink - Unlink the first link to a key from a keyring.
1534  * @key: The key the link is to.
1536  * Remove a link from a keyring to a key.
1541  * the key isn't linked to by the keyring or -ENOMEM if there's insufficient
1546  * required on the key).
1548 int key_unlink(struct key *keyring, struct key *key)  in key_unlink()  argument
1554 	key_check(key);  in key_unlink()
1560 	ret = __key_unlink_begin(keyring, key, &edit);  in key_unlink()
1562 		__key_unlink(keyring, key, &edit);  in key_unlink()
1563 	__key_unlink_end(keyring, key, edit);  in key_unlink()
1569  * key_move - Move a key from one keyring to another
1570  * @key: The key to move
1575  * Make a link in @to_keyring to a key, such that the keyring holds a reference
1576  * on that key and the key can potentially be found by searching that keyring
1577  * whilst simultaneously removing a link to the key from @from_keyring.
1580  * some of the user's key data quota to hold the link on @to_keyring.
1584  * keyring is full, -EDQUOT if there is insufficient key data quota remaining
1587  * matching key in @to_keyring.
1590  * be made (the keyring should have Write permission and the key Link
1593 int key_move(struct key *key,  in key_move()  argument
1594 	     struct key *from_keyring,  in key_move()
1595 	     struct key *to_keyring,  in key_move()
1601 	kenter("%d,%d,%d", key->serial, from_keyring->serial, to_keyring->serial);  in key_move()
1606 	key_check(key);  in key_move()
1610 	ret = __key_move_lock(from_keyring, to_keyring, &key->index_key);  in key_move()
1613 	ret = __key_unlink_begin(from_keyring, key, &from_edit);  in key_move()
1616 	ret = __key_link_begin(to_keyring, &key->index_key, &to_edit);  in key_move()
1624 	ret = __key_link_check_restriction(to_keyring, key);  in key_move()
1627 	ret = __key_link_check_live_key(to_keyring, key);  in key_move()
1631 	__key_unlink(from_keyring, key, &from_edit);  in key_move()
1632 	__key_link(to_keyring, key, &to_edit);  in key_move()
1634 	__key_link_end(to_keyring, &key->index_key, to_edit);  in key_move()
1635 	__key_unlink_end(from_keyring, key, from_edit);  in key_move()
1650 int keyring_clear(struct key *keyring)  in keyring_clear()
1679  * This is called with the key sem write-locked.
1681 static void keyring_revoke(struct key *keyring)  in keyring_revoke()
1695 	struct key *key = keyring_ptr_to_key(object);  in keyring_gc_select_iterator()  local
1698 	if (key_is_dead(key, *limit))  in keyring_gc_select_iterator()
1700 	key_get(key);  in keyring_gc_select_iterator()
1706 	const struct key *key = keyring_ptr_to_key(object);  in keyring_gc_check_iterator()  local
1709 	key_check(key);  in keyring_gc_check_iterator()
1710 	return key_is_dead(key, *limit);  in keyring_gc_check_iterator()
1716  * Not called with any locks held.  The keyring's key struct will not be
1719 void keyring_gc(struct key *keyring, time64_t limit)  in keyring_gc()
1752  * Keyring restrictions are associated with a key type, and must be cleaned
1753  * up if the key type is unregistered. The restriction is altered to always
1755  * a key type.
1757  * Not called with any keyring locks held. The keyring's key struct will not
1764 void keyring_restriction_gc(struct key *keyring, struct key_type *dead_type)  in keyring_restriction_gc()
1771 	 * keyring->restrict_link is only assigned at key allocation time  in keyring_restriction_gc()
1772 	 * or with the key type locked, so the only values that could be  in keyring_restriction_gc()
1773 	 * concurrently assigned to keyring->restrict_link are for key  in keyring_restriction_gc()
1775 	 * the key type before acquiring keyring->sem.  in keyring_restriction_gc()
1790 	key_put(keyres->key);  in keyring_restriction_gc()
1791 	keyres->key = NULL;  in keyring_restriction_gc()