security/tomoyo/gc.c

   1 /*
   2  * security/tomoyo/gc.c
   3  *
   4  * Copyright (C) 2005-2011  NTT DATA CORPORATION
   5  */
   6
   7 #include "common.h"
   8 #include <linux/kthread.h>
   9 #include <linux/slab.h>
  10
  11 /* The list for "struct tomoyo_io_buffer". */
  12 static LIST_HEAD(tomoyo_io_buffer_list);
  13 /* Lock for protecting tomoyo_io_buffer_list. */
  14 static DEFINE_SPINLOCK(tomoyo_io_buffer_list_lock);
  15
  16 /* Size of an element. */
  17 static const u8 tomoyo_element_size[TOMOYO_MAX_POLICY] = {
  18         [TOMOYO_ID_GROUP] = sizeof(struct tomoyo_group),
  19         [TOMOYO_ID_PATH_GROUP] = sizeof(struct tomoyo_path_group),
  20         [TOMOYO_ID_NUMBER_GROUP] = sizeof(struct tomoyo_number_group),
  21         [TOMOYO_ID_AGGREGATOR] = sizeof(struct tomoyo_aggregator),
  22         [TOMOYO_ID_TRANSITION_CONTROL] =
  23         sizeof(struct tomoyo_transition_control),
  24         [TOMOYO_ID_MANAGER] = sizeof(struct tomoyo_manager),
  25         /* [TOMOYO_ID_CONDITION] = "struct tomoyo_condition"->size, */
  26         /* [TOMOYO_ID_NAME] = "struct tomoyo_name"->size, */
  27         /* [TOMOYO_ID_ACL] =
  28            tomoyo_acl_size["struct tomoyo_acl_info"->type], */
  29         [TOMOYO_ID_DOMAIN] = sizeof(struct tomoyo_domain_info),
  30 };
  31
  32 /* Size of a domain ACL element. */
  33 static const u8 tomoyo_acl_size[] = {
  34         [TOMOYO_TYPE_PATH_ACL] = sizeof(struct tomoyo_path_acl),
  35         [TOMOYO_TYPE_PATH2_ACL] = sizeof(struct tomoyo_path2_acl),
  36         [TOMOYO_TYPE_PATH_NUMBER_ACL] = sizeof(struct tomoyo_path_number_acl),
  37         [TOMOYO_TYPE_MKDEV_ACL] = sizeof(struct tomoyo_mkdev_acl),
  38         [TOMOYO_TYPE_MOUNT_ACL] = sizeof(struct tomoyo_mount_acl),
  39         [TOMOYO_TYPE_ENV_ACL] = sizeof(struct tomoyo_env_acl),
  40 };
  41
  42 /**
  43  * tomoyo_struct_used_by_io_buffer - Check whether the list element is used by /sys/kernel/security/tomoyo/ users or not.
  44  *
  45  * @element: Pointer to "struct list_head".
  46  *
  47  * Returns true if @element is used by /sys/kernel/security/tomoyo/ users,
  48  * false otherwise.
  49  */
  50 static bool tomoyo_struct_used_by_io_buffer(const struct list_head *element)
  51 {
  52         struct tomoyo_io_buffer *head;
  53         bool in_use = false;
  54
  55         spin_lock(&tomoyo_io_buffer_list_lock);
  56         list_for_each_entry(head, &tomoyo_io_buffer_list, list) {
  57                 head->users++;
  58                 spin_unlock(&tomoyo_io_buffer_list_lock);
  59                 if (mutex_lock_interruptible(&head->io_sem)) {
  60                         in_use = true;
  61                         goto out;
  62                 }
  63                 if (head->r.domain == element || head->r.group == element ||
  64                     head->r.acl == element || &head->w.domain->list == element)
  65                         in_use = true;
  66                 mutex_unlock(&head->io_sem);
  67 out:
  68                 spin_lock(&tomoyo_io_buffer_list_lock);
  69                 head->users--;
  70                 if (in_use)
  71                         break;
  72         }
  73         spin_unlock(&tomoyo_io_buffer_list_lock);
  74         return in_use;
  75 }
  76
  77 /**
  78  * tomoyo_name_used_by_io_buffer - Check whether the string is used by /sys/kernel/security/tomoyo/ users or not.
  79  *
  80  * @string: String to check.
  81  * @size:   Memory allocated for @string .
  82  *
  83  * Returns true if @string is used by /sys/kernel/security/tomoyo/ users,
  84  * false otherwise.
  85  */
  86 static bool tomoyo_name_used_by_io_buffer(const char *string,
  87                                           const size_t size)
  88 {
  89         struct tomoyo_io_buffer *head;
  90         bool in_use = false;
  91
  92         spin_lock(&tomoyo_io_buffer_list_lock);
  93         list_for_each_entry(head, &tomoyo_io_buffer_list, list) {
  94                 int i;
  95                 head->users++;
  96                 spin_unlock(&tomoyo_io_buffer_list_lock);
  97                 if (mutex_lock_interruptible(&head->io_sem)) {
  98                         in_use = true;
  99                         goto out;
 100                 }
 101                 for (i = 0; i < TOMOYO_MAX_IO_READ_QUEUE; i++) {
 102                         const char *w = head->r.w[i];
 103                         if (w < string || w > string + size)
 104                                 continue;
 105                         in_use = true;
 106                         break;
 107                 }
 108                 mutex_unlock(&head->io_sem);
 109 out:
 110                 spin_lock(&tomoyo_io_buffer_list_lock);
 111                 head->users--;
 112                 if (in_use)
 113                         break;
 114         }
 115         spin_unlock(&tomoyo_io_buffer_list_lock);
 116         return in_use;
 117 }
 118
 119 /* Structure for garbage collection. */
 120 struct tomoyo_gc {
 121         struct list_head list;
 122         enum tomoyo_policy_id type;
 123         size_t size;
 124         struct list_head *element;
 125 };
 126 /* List of entries to be deleted. */
 127 static LIST_HEAD(tomoyo_gc_list);
 128 /* Length of tomoyo_gc_list. */
 129 static int tomoyo_gc_list_len;
 130
 131 /**
 132  * tomoyo_add_to_gc - Add an entry to to be deleted list.
 133  *
 134  * @type:    One of values in "enum tomoyo_policy_id".
 135  * @element: Pointer to "struct list_head".
 136  *
 137  * Returns true on success, false otherwise.
 138  *
 139  * Caller holds tomoyo_policy_lock mutex.
 140  *
 141  * Adding an entry needs kmalloc(). Thus, if we try to add thousands of
 142  * entries at once, it will take too long time. Thus, do not add more than 128
 143  * entries per a scan. But to be able to handle worst case where all entries
 144  * are in-use, we accept one more entry per a scan.
 145  *
 146  * If we use singly linked list using "struct list_head"->prev (which is
 147  * LIST_POISON2), we can avoid kmalloc().
 148  */
 149 static bool tomoyo_add_to_gc(const int type, struct list_head *element)
 150 {
 151         struct tomoyo_gc *entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
 152         if (!entry)
 153                 return false;
 154         entry->type = type;
 155         if (type == TOMOYO_ID_ACL)
 156                 entry->size = tomoyo_acl_size[
 157                               container_of(element,
 158                                            typeof(struct tomoyo_acl_info),
 159                                            list)->type];
 160         else if (type == TOMOYO_ID_NAME)
 161                 entry->size = strlen(container_of(element,
 162                                                   typeof(struct tomoyo_name),
 163                                                   head.list)->entry.name) + 1;
 164         else if (type == TOMOYO_ID_CONDITION)
 165                 entry->size =
 166                         container_of(element, typeof(struct tomoyo_condition),
 167                                      head.list)->size;
 168         else
 169                 entry->size = tomoyo_element_size[type];
 170         entry->element = element;
 171         list_add(&entry->list, &tomoyo_gc_list);
 172         list_del_rcu(element);
 173         return tomoyo_gc_list_len++ < 128;
 174 }
 175
 176 /**
 177  * tomoyo_element_linked_by_gc - Validate next element of an entry.
 178  *
 179  * @element: Pointer to an element.
 180  * @size:    Size of @element in byte.
 181  *
 182  * Returns true if @element is linked by other elements in the garbage
 183  * collector's queue, false otherwise.
 184  */
 185 static bool tomoyo_element_linked_by_gc(const u8 *element, const size_t size)
 186 {
 187         struct tomoyo_gc *p;
 188         list_for_each_entry(p, &tomoyo_gc_list, list) {
 189                 const u8 *ptr = (const u8 *) p->element->next;
 190                 if (ptr < element || element + size < ptr)
 191                         continue;
 192                 return true;
 193         }
 194         return false;
 195 }
 196
 197 /**
 198  * tomoyo_del_transition_control - Delete members in "struct tomoyo_transition_control".
 199  *
 200  * @element: Pointer to "struct list_head".
 201  *
 202  * Returns nothing.
 203  */
 204 static void tomoyo_del_transition_control(struct list_head *element)
 205 {
 206         struct tomoyo_transition_control *ptr =
 207                 container_of(element, typeof(*ptr), head.list);
 208         tomoyo_put_name(ptr->domainname);
 209         tomoyo_put_name(ptr->program);
 210 }
 211
 212 /**
 213  * tomoyo_del_aggregator - Delete members in "struct tomoyo_aggregator".
 214  *
 215  * @element: Pointer to "struct list_head".
 216  *
 217  * Returns nothing.
 218  */
 219 static void tomoyo_del_aggregator(struct list_head *element)
 220 {
 221         struct tomoyo_aggregator *ptr =
 222                 container_of(element, typeof(*ptr), head.list);
 223         tomoyo_put_name(ptr->original_name);
 224         tomoyo_put_name(ptr->aggregated_name);
 225 }
 226
 227 /**
 228  * tomoyo_del_manager - Delete members in "struct tomoyo_manager".
 229  *
 230  * @element: Pointer to "struct list_head".
 231  *
 232  * Returns nothing.
 233  */
 234 static void tomoyo_del_manager(struct list_head *element)
 235 {
 236         struct tomoyo_manager *ptr =
 237                 container_of(element, typeof(*ptr), head.list);
 238         tomoyo_put_name(ptr->manager);
 239 }
 240
 241 /**
 242  * tomoyo_del_acl - Delete members in "struct tomoyo_acl_info".
 243  *
 244  * @element: Pointer to "struct list_head".
 245  *
 246  * Returns nothing.
 247  */
 248 static void tomoyo_del_acl(struct list_head *element)
 249 {
 250         struct tomoyo_acl_info *acl =
 251                 container_of(element, typeof(*acl), list);
 252         tomoyo_put_condition(acl->cond);
 253         switch (acl->type) {
 254         case TOMOYO_TYPE_PATH_ACL:
 255                 {
 256                         struct tomoyo_path_acl *entry
 257                                 = container_of(acl, typeof(*entry), head);
 258                         tomoyo_put_name_union(&entry->name);
 259                 }
 260                 break;
 261         case TOMOYO_TYPE_PATH2_ACL:
 262                 {
 263                         struct tomoyo_path2_acl *entry
 264                                 = container_of(acl, typeof(*entry), head);
 265                         tomoyo_put_name_union(&entry->name1);
 266                         tomoyo_put_name_union(&entry->name2);
 267                 }
 268                 break;
 269         case TOMOYO_TYPE_PATH_NUMBER_ACL:
 270                 {
 271                         struct tomoyo_path_number_acl *entry
 272                                 = container_of(acl, typeof(*entry), head);
 273                         tomoyo_put_name_union(&entry->name);
 274                         tomoyo_put_number_union(&entry->number);
 275                 }
 276                 break;
 277         case TOMOYO_TYPE_MKDEV_ACL:
 278                 {
 279                         struct tomoyo_mkdev_acl *entry
 280                                 = container_of(acl, typeof(*entry), head);
 281                         tomoyo_put_name_union(&entry->name);
 282                         tomoyo_put_number_union(&entry->mode);
 283                         tomoyo_put_number_union(&entry->major);
 284                         tomoyo_put_number_union(&entry->minor);
 285                 }
 286                 break;
 287         case TOMOYO_TYPE_MOUNT_ACL:
 288                 {
 289                         struct tomoyo_mount_acl *entry
 290                                 = container_of(acl, typeof(*entry), head);
 291                         tomoyo_put_name_union(&entry->dev_name);
 292                         tomoyo_put_name_union(&entry->dir_name);
 293                         tomoyo_put_name_union(&entry->fs_type);
 294                         tomoyo_put_number_union(&entry->flags);
 295                 }
 296                 break;
 297         case TOMOYO_TYPE_ENV_ACL:
 298                 {
 299                         struct tomoyo_env_acl *entry =
 300                                 container_of(acl, typeof(*entry), head);
 301
 302                         tomoyo_put_name(entry->env);
 303                 }
 304                 break;
 305         }
 306 }
 307
 308 /**
 309  * tomoyo_del_domain - Delete members in "struct tomoyo_domain_info".
 310  *
 311  * @element: Pointer to "struct list_head".
 312  *
 313  * Returns true if deleted, false otherwise.
 314  */
 315 static bool tomoyo_del_domain(struct list_head *element)
 316 {
 317         struct tomoyo_domain_info *domain =
 318                 container_of(element, typeof(*domain), list);
 319         struct tomoyo_acl_info *acl;
 320         struct tomoyo_acl_info *tmp;
 321         /*
 322          * Since we don't protect whole execve() operation using SRCU,
 323          * we need to recheck domain->users at this point.
 324          *
 325          * (1) Reader starts SRCU section upon execve().
 326          * (2) Reader traverses tomoyo_domain_list and finds this domain.
 327          * (3) Writer marks this domain as deleted.
 328          * (4) Garbage collector removes this domain from tomoyo_domain_list
 329          *     because this domain is marked as deleted and used by nobody.
 330          * (5) Reader saves reference to this domain into
 331          *     "struct linux_binprm"->cred->security .
 332          * (6) Reader finishes SRCU section, although execve() operation has
 333          *     not finished yet.
 334          * (7) Garbage collector waits for SRCU synchronization.
 335          * (8) Garbage collector kfree() this domain because this domain is
 336          *     used by nobody.
 337          * (9) Reader finishes execve() operation and restores this domain from
 338          *     "struct linux_binprm"->cred->security.
 339          *
 340          * By updating domain->users at (5), we can solve this race problem
 341          * by rechecking domain->users at (8).
 342          */
 343         if (atomic_read(&domain->users))
 344                 return false;
 345         list_for_each_entry_safe(acl, tmp, &domain->acl_info_list, list) {
 346                 tomoyo_del_acl(&acl->list);
 347                 tomoyo_memory_free(acl);
 348         }
 349         tomoyo_put_name(domain->domainname);
 350         return true;
 351 }
 352
 353 /**
 354  * tomoyo_del_condition - Delete members in "struct tomoyo_condition".
 355  *
 356  * @element: Pointer to "struct list_head".
 357  *
 358  * Returns nothing.
 359  */
 360 void tomoyo_del_condition(struct list_head *element)
 361 {
 362         struct tomoyo_condition *cond = container_of(element, typeof(*cond),
 363                                                      head.list);
 364         const u16 condc = cond->condc;
 365         const u16 numbers_count = cond->numbers_count;
 366         const u16 names_count = cond->names_count;
 367         const u16 argc = cond->argc;
 368         const u16 envc = cond->envc;
 369         unsigned int i;
 370         const struct tomoyo_condition_element *condp
 371                 = (const struct tomoyo_condition_element *) (cond + 1);
 372         struct tomoyo_number_union *numbers_p
 373                 = (struct tomoyo_number_union *) (condp + condc);
 374         struct tomoyo_name_union *names_p
 375                 = (struct tomoyo_name_union *) (numbers_p + numbers_count);
 376         const struct tomoyo_argv *argv
 377                 = (const struct tomoyo_argv *) (names_p + names_count);
 378         const struct tomoyo_envp *envp
 379                 = (const struct tomoyo_envp *) (argv + argc);
 380         for (i = 0; i < numbers_count; i++)
 381                 tomoyo_put_number_union(numbers_p++);
 382         for (i = 0; i < names_count; i++)
 383                 tomoyo_put_name_union(names_p++);
 384         for (i = 0; i < argc; argv++, i++)
 385                 tomoyo_put_name(argv->value);
 386         for (i = 0; i < envc; envp++, i++) {
 387                 tomoyo_put_name(envp->name);
 388                 tomoyo_put_name(envp->value);
 389         }
 390 }
 391
 392 /**
 393  * tomoyo_del_name - Delete members in "struct tomoyo_name".
 394  *
 395  * @element: Pointer to "struct list_head".
 396  *
 397  * Returns nothing.
 398  */
 399 static void tomoyo_del_name(struct list_head *element)
 400 {
 401         const struct tomoyo_name *ptr =
 402                 container_of(element, typeof(*ptr), head.list);
 403 }
 404
 405 /**
 406  * tomoyo_del_path_group - Delete members in "struct tomoyo_path_group".
 407  *
 408  * @element: Pointer to "struct list_head".
 409  *
 410  * Returns nothing.
 411  */
 412 static void tomoyo_del_path_group(struct list_head *element)
 413 {
 414         struct tomoyo_path_group *member =
 415                 container_of(element, typeof(*member), head.list);
 416         tomoyo_put_name(member->member_name);
 417 }
 418
 419 /**
 420  * tomoyo_del_group - Delete "struct tomoyo_group".
 421  *
 422  * @element: Pointer to "struct list_head".
 423  *
 424  * Returns nothing.
 425  */
 426 static void tomoyo_del_group(struct list_head *element)
 427 {
 428         struct tomoyo_group *group =
 429                 container_of(element, typeof(*group), head.list);
 430         tomoyo_put_name(group->group_name);
 431 }
 432
 433 /**
 434  * tomoyo_del_number_group - Delete members in "struct tomoyo_number_group".
 435  *
 436  * @element: Pointer to "struct list_head".
 437  *
 438  * Returns nothing.
 439  */
 440 static void tomoyo_del_number_group(struct list_head *element)
 441 {
 442         struct tomoyo_number_group *member =
 443                 container_of(element, typeof(*member), head.list);
 444 }
 445
 446 /**
 447  * tomoyo_collect_member - Delete elements with "struct tomoyo_acl_head".
 448  *
 449  * @id:          One of values in "enum tomoyo_policy_id".
 450  * @member_list: Pointer to "struct list_head".
 451  *
 452  * Returns true if some elements are deleted, false otherwise.
 453  */
 454 static bool tomoyo_collect_member(const enum tomoyo_policy_id id,
 455                                   struct list_head *member_list)
 456 {
 457         struct tomoyo_acl_head *member;
 458         list_for_each_entry(member, member_list, list) {
 459                 if (!member->is_deleted)
 460                         continue;
 461                 if (!tomoyo_add_to_gc(id, &member->list))
 462                         return false;
 463         }
 464         return true;
 465 }
 466
 467 /**
 468  * tomoyo_collect_acl - Delete elements in "struct tomoyo_domain_info".
 469  *
 470  * @list: Pointer to "struct list_head".
 471  *
 472  * Returns true if some elements are deleted, false otherwise.
 473  */
 474 static bool tomoyo_collect_acl(struct list_head *list)
 475 {
 476         struct tomoyo_acl_info *acl;
 477         list_for_each_entry(acl, list, list) {
 478                 if (!acl->is_deleted)
 479                         continue;
 480                 if (!tomoyo_add_to_gc(TOMOYO_ID_ACL, &acl->list))
 481                         return false;
 482         }
 483         return true;
 484 }
 485
 486 /**
 487  * tomoyo_collect_entry - Scan lists for deleted elements.
 488  *
 489  * Returns nothing.
 490  */
 491 static void tomoyo_collect_entry(void)
 492 {
 493         int i;
 494         enum tomoyo_policy_id id;
 495         struct tomoyo_policy_namespace *ns;
 496         int idx;
 497         if (mutex_lock_interruptible(&tomoyo_policy_lock))
 498                 return;
 499         idx = tomoyo_read_lock();
 500         {
 501                 struct tomoyo_domain_info *domain;
 502                 list_for_each_entry_rcu(domain, &tomoyo_domain_list, list) {
 503                         if (!tomoyo_collect_acl(&domain->acl_info_list))
 504                                 goto unlock;
 505                         if (!domain->is_deleted || atomic_read(&domain->users))
 506                                 continue;
 507                         /*
 508                          * Nobody is referring this domain. But somebody may
 509                          * refer this domain after successful execve().
 510                          * We recheck domain->users after SRCU synchronization.
 511                          */
 512                         if (!tomoyo_add_to_gc(TOMOYO_ID_DOMAIN, &domain->list))
 513                                 goto unlock;
 514                 }
 515         }
 516         list_for_each_entry_rcu(ns, &tomoyo_namespace_list, namespace_list) {
 517                 for (id = 0; id < TOMOYO_MAX_POLICY; id++)
 518                         if (!tomoyo_collect_member(id, &ns->policy_list[id]))
 519                                 goto unlock;
 520                 for (i = 0; i < TOMOYO_MAX_ACL_GROUPS; i++)
 521                         if (!tomoyo_collect_acl(&ns->acl_group[i]))
 522                                 goto unlock;
 523                 for (i = 0; i < TOMOYO_MAX_GROUP; i++) {
 524                         struct list_head *list = &ns->group_list[i];
 525                         struct tomoyo_group *group;
 526                         switch (i) {
 527                         case 0:
 528                                 id = TOMOYO_ID_PATH_GROUP;
 529                                 break;
 530                         default:
 531                                 id = TOMOYO_ID_NUMBER_GROUP;
 532                                 break;
 533                         }
 534                         list_for_each_entry(group, list, head.list) {
 535                                 if (!tomoyo_collect_member
 536                                     (id, &group->member_list))
 537                                         goto unlock;
 538                                 if (!list_empty(&group->member_list) ||
 539                                     atomic_read(&group->head.users))
 540                                         continue;
 541                                 if (!tomoyo_add_to_gc(TOMOYO_ID_GROUP,
 542                                                       &group->head.list))
 543                                         goto unlock;
 544                         }
 545                 }
 546         }
 547         id = TOMOYO_ID_CONDITION;
 548         for (i = 0; i < TOMOYO_MAX_HASH + 1; i++) {
 549                 struct list_head *list = !i ?
 550                         &tomoyo_condition_list : &tomoyo_name_list[i - 1];
 551                 struct tomoyo_shared_acl_head *ptr;
 552                 list_for_each_entry(ptr, list, list) {
 553                         if (atomic_read(&ptr->users))
 554                                 continue;
 555                         if (!tomoyo_add_to_gc(id, &ptr->list))
 556                                 goto unlock;
 557                 }
 558                 id = TOMOYO_ID_NAME;
 559         }
 560 unlock:
 561         tomoyo_read_unlock(idx);
 562         mutex_unlock(&tomoyo_policy_lock);
 563 }
 564
 565 /**
 566  * tomoyo_kfree_entry - Delete entries in tomoyo_gc_list.
 567  *
 568  * Returns true if some entries were kfree()d, false otherwise.
 569  */
 570 static bool tomoyo_kfree_entry(void)
 571 {
 572         struct tomoyo_gc *p;
 573         struct tomoyo_gc *tmp;
 574         bool result = false;
 575
 576         list_for_each_entry_safe(p, tmp, &tomoyo_gc_list, list) {
 577                 struct list_head *element = p->element;
 578
 579                 /*
 580                  * list_del_rcu() in tomoyo_add_to_gc() guarantees that the
 581                  * list element became no longer reachable from the list which
 582                  * the element was originally on (e.g. tomoyo_domain_list).
 583                  * Also, synchronize_srcu() in tomoyo_gc_thread() guarantees
 584                  * that the list element became no longer referenced by syscall
 585                  * users.
 586                  *
 587                  * However, there are three users which may still be using the
 588                  * list element. We need to defer until all of these users
 589                  * forget the list element.
 590                  *
 591                  * Firstly, defer until "struct tomoyo_io_buffer"->r.{domain,
 592                  * group,acl} and "struct tomoyo_io_buffer"->w.domain forget
 593                  * the list element.
 594                  */
 595                 if (tomoyo_struct_used_by_io_buffer(element))
 596                         continue;
 597                 /*
 598                  * Secondly, defer until all other elements in the
 599                  * tomoyo_gc_list list forget the list element.
 600                  */
 601                 if (tomoyo_element_linked_by_gc((const u8 *) element, p->size))
 602                         continue;
 603                 switch (p->type) {
 604                 case TOMOYO_ID_TRANSITION_CONTROL:
 605                         tomoyo_del_transition_control(element);
 606                         break;
 607                 case TOMOYO_ID_AGGREGATOR:
 608                         tomoyo_del_aggregator(element);
 609                         break;
 610                 case TOMOYO_ID_MANAGER:
 611                         tomoyo_del_manager(element);
 612                         break;
 613                 case TOMOYO_ID_CONDITION:
 614                         tomoyo_del_condition(element);
 615                         break;
 616                 case TOMOYO_ID_NAME:
 617                         /*
 618                          * Thirdly, defer until all "struct tomoyo_io_buffer"
 619                          * ->r.w[] forget the list element.
 620                          */
 621                         if (tomoyo_name_used_by_io_buffer(
 622                             container_of(element, typeof(struct tomoyo_name),
 623                                          head.list)->entry.name, p->size))
 624                                 continue;
 625                         tomoyo_del_name(element);
 626                         break;
 627                 case TOMOYO_ID_ACL:
 628                         tomoyo_del_acl(element);
 629                         break;
 630                 case TOMOYO_ID_DOMAIN:
 631                         if (!tomoyo_del_domain(element))
 632                                 continue;
 633                         break;
 634                 case TOMOYO_ID_PATH_GROUP:
 635                         tomoyo_del_path_group(element);
 636                         break;
 637                 case TOMOYO_ID_GROUP:
 638                         tomoyo_del_group(element);
 639                         break;
 640                 case TOMOYO_ID_NUMBER_GROUP:
 641                         tomoyo_del_number_group(element);
 642                         break;
 643                 case TOMOYO_MAX_POLICY:
 644                         break;
 645                 }
 646                 tomoyo_memory_free(element);
 647                 list_del(&p->list);
 648                 kfree(p);
 649                 tomoyo_gc_list_len--;
 650                 result = true;
 651         }
 652         return result;
 653 }
 654
 655 /**
 656  * tomoyo_gc_thread - Garbage collector thread function.
 657  *
 658  * @unused: Unused.
 659  *
 660  * In case OOM-killer choose this thread for termination, we create this thread
 661  * as a short live thread whenever /sys/kernel/security/tomoyo/ interface was
 662  * close()d.
 663  *
 664  * Returns 0.
 665  */
 666 static int tomoyo_gc_thread(void *unused)
 667 {
 668         /* Garbage collector thread is exclusive. */
 669         static DEFINE_MUTEX(tomoyo_gc_mutex);
 670         if (!mutex_trylock(&tomoyo_gc_mutex))
 671                 goto out;
 672
 673         do {
 674                 tomoyo_collect_entry();
 675                 if (list_empty(&tomoyo_gc_list))
 676                         break;
 677                 synchronize_srcu(&tomoyo_ss);
 678         } while (tomoyo_kfree_entry());
 679         {
 680                 struct tomoyo_io_buffer *head;
 681                 struct tomoyo_io_buffer *tmp;
 682
 683                 spin_lock(&tomoyo_io_buffer_list_lock);
 684                 list_for_each_entry_safe(head, tmp, &tomoyo_io_buffer_list,
 685                                          list) {
 686                         if (head->users)
 687                                 continue;
 688                         list_del(&head->list);
 689                         kfree(head->read_buf);
 690                         kfree(head->write_buf);
 691                         kfree(head);
 692                 }
 693                 spin_unlock(&tomoyo_io_buffer_list_lock);
 694         }
 695         mutex_unlock(&tomoyo_gc_mutex);
 696 out:
 697         /* This acts as do_exit(0). */
 698         return 0;
 699 }
 700
 701 /**
 702  * tomoyo_notify_gc - Register/unregister /sys/kernel/security/tomoyo/ users.
 703  *
 704  * @head:        Pointer to "struct tomoyo_io_buffer".
 705  * @is_register: True if register, false if unregister.
 706  *
 707  * Returns nothing.
 708  */
 709 void tomoyo_notify_gc(struct tomoyo_io_buffer *head, const bool is_register)
 710 {
 711         bool is_write = false;
 712
 713         spin_lock(&tomoyo_io_buffer_list_lock);
 714         if (is_register) {
 715                 head->users = 1;
 716                 list_add(&head->list, &tomoyo_io_buffer_list);
 717         } else {
 718                 is_write = head->write_buf != NULL;
 719                 if (!--head->users) {
 720                         list_del(&head->list);
 721                         kfree(head->read_buf);
 722                         kfree(head->write_buf);
 723                         kfree(head);
 724                 }
 725         }
 726         spin_unlock(&tomoyo_io_buffer_list_lock);
 727         if (is_write) {
 728                 struct task_struct *task = kthread_create(tomoyo_gc_thread,
 729                                                           NULL,
 730                                                           "GC for TOMOYO");
 731                 if (!IS_ERR(task))
 732                         wake_up_process(task);
 733         }
 734 }