// SPDX-License-Identifier: GPL-2.0-or-later
/* Key garbage collector
 *
 * Copyright (C) 2009-2011 Red Hat, Inc. All Rights Reserved.
 * Written by David Howells (dhowells@redhat.com)
 */

#include <linux/slab.h>
#include <linux/security.h>
#include <keys/keyring-type.h>
#include "internal.h"

/*
 * Delay between key revocation/expiry in seconds
 */
unsigned key_gc_delay = 5 * 60;

/*
 * Reaper for unused keys.
 */
static void key_garbage_collector(struct work_struct *work);
DECLARE_WORK(key_gc_work, key_garbage_collector);

/*
 * Reaper for links from keyrings to dead keys.
 */
static void key_gc_timer_func(struct timer_list *);
static DEFINE_TIMER(key_gc_timer, key_gc_timer_func);

static time64_t key_gc_next_run = TIME64_MAX;
static struct key_type *key_gc_dead_keytype;

static unsigned long key_gc_flags;
#define KEY_GC_KEY_EXPIRED      0       /* A key expired and needs unlinking */
#define KEY_GC_REAP_KEYTYPE     1       /* A keytype is being unregistered */
#define KEY_GC_REAPING_KEYTYPE  2       /* Cleared when keytype reaped */


/*
 * Any key whose type gets unregistered will be re-typed to this if it can't be
 * immediately unlinked.
 */
struct key_type key_type_dead = {
        .name = ".dead",
};

/*
 * Schedule a garbage collection run.
 * - time precision isn't particularly important
 */
void key_schedule_gc(time64_t gc_at)
{
        unsigned long expires;
        time64_t now = ktime_get_real_seconds();

        kenter("%lld", gc_at - now);

        if (gc_at <= now || test_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags)) {
                kdebug("IMMEDIATE");
                schedule_work(&key_gc_work);
        } else if (gc_at < key_gc_next_run) {
                kdebug("DEFERRED");
                key_gc_next_run = gc_at;
                expires = jiffies + (gc_at - now) * HZ;
                mod_timer(&key_gc_timer, expires);
        }
}

/*
 * Set the expiration time on a key.
 */
void key_set_expiry(struct key *key, time64_t expiry)
{
        key->expiry = expiry;
        if (expiry != TIME64_MAX) {
                if (!(key->type->flags & KEY_TYPE_INSTANT_REAP))
                        expiry += key_gc_delay;
                key_schedule_gc(expiry);
        }
}

/*
 * Schedule a dead links collection run.
 */
void key_schedule_gc_links(void)
{
        set_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags);
        schedule_work(&key_gc_work);
}

/*
 * Some key's cleanup time was met after it expired, so we need to get the
 * reaper to go through a cycle finding expired keys.
 */
static void key_gc_timer_func(struct timer_list *unused)
{
        kenter("");
        key_gc_next_run = TIME64_MAX;
        key_schedule_gc_links();
}

/*
 * Reap keys of dead type.
 *
 * We use three flags to make sure we see three complete cycles of the garbage
 * collector: the first to mark keys of that type as being dead, the second to
 * collect dead links and the third to clean up the dead keys.  We have to be
 * careful as there may already be a cycle in progress.
 *
 * The caller must be holding key_types_sem.
 */
void key_gc_keytype(struct key_type *ktype)
{
        kenter("%s", ktype->name);

        key_gc_dead_keytype = ktype;
        set_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
        smp_mb();
        set_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags);

        kdebug("schedule");
        schedule_work(&key_gc_work);

        kdebug("sleep");
        wait_on_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE,
                    TASK_UNINTERRUPTIBLE);

        key_gc_dead_keytype = NULL;
        kleave("");
}

/*
 * Garbage collect a list of unreferenced, detached keys
 */
static noinline void key_gc_unused_keys(struct list_head *keys)
{
        while (!list_empty(keys)) {
                struct key *key =
                        list_entry(keys->next, struct key, graveyard_link);
                short state = key->state;

                list_del(&key->graveyard_link);

                kdebug("- %u", key->serial);
                key_check(key);

#ifdef CONFIG_KEY_NOTIFICATIONS
                remove_watch_list(key->watchers, key->serial);
                key->watchers = NULL;
#endif

                /* Throw away the key data if the key is instantiated */
                if (state == KEY_IS_POSITIVE && key->type->destroy)
                        key->type->destroy(key);

                security_key_free(key);

                atomic_dec(&key->user->nkeys);
                if (state != KEY_IS_UNINSTANTIATED)
                        atomic_dec(&key->user->nikeys);

                key_user_put(key->user);
                key_put_tag(key->domain_tag);
                kfree(key->description);

                memzero_explicit(key, sizeof(*key));
                kmem_cache_free(key_jar, key);
        }
}

/*
 * Garbage collector for unused keys.
 *
 * This is done in process context so that we don't have to disable interrupts
 * all over the place.  key_put() schedules this rather than trying to do the
 * cleanup itself, which means key_put() doesn't have to sleep.
 */
static void key_garbage_collector(struct work_struct *work)
{
        static LIST_HEAD(graveyard);
        static u8 gc_state;             /* Internal persistent state */
#define KEY_GC_REAP_AGAIN       0x01    /* - Need another cycle */
#define KEY_GC_REAPING_LINKS    0x02    /* - We need to reap links */
#define KEY_GC_REAPING_DEAD_1   0x10    /* - We need to mark dead keys */
#define KEY_GC_REAPING_DEAD_2   0x20    /* - We need to reap dead key links */
#define KEY_GC_REAPING_DEAD_3   0x40    /* - We need to reap dead keys */
#define KEY_GC_FOUND_DEAD_KEY   0x80    /* - We found at least one dead key */

        struct rb_node *cursor;
        struct key *key;
        time64_t new_timer, limit, expiry;

        kenter("[%lx,%x]", key_gc_flags, gc_state);

        limit = ktime_get_real_seconds();

        /* Work out what we're going to be doing in this pass */
        gc_state &= KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2;
        gc_state <<= 1;
        if (test_and_clear_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags))
                gc_state |= KEY_GC_REAPING_LINKS;

        if (test_and_clear_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags))
                gc_state |= KEY_GC_REAPING_DEAD_1;
        kdebug("new pass %x", gc_state);

        new_timer = TIME64_MAX;

        /* As only this function is permitted to remove things from the key
         * serial tree, if cursor is non-NULL then it will always point to a
         * valid node in the tree - even if lock got dropped.
         */
        spin_lock(&key_serial_lock);
        cursor = rb_first(&key_serial_tree);

continue_scanning:
        while (cursor) {
                key = rb_entry(cursor, struct key, serial_node);
                cursor = rb_next(cursor);

                if (!test_bit_acquire(KEY_FLAG_USER_ALIVE, &key->flags)) {
                        /* Clobber key->user after final put seen. */
                        goto found_unreferenced_key;
                }

                if (unlikely(gc_state & KEY_GC_REAPING_DEAD_1)) {
                        if (key->type == key_gc_dead_keytype) {
                                gc_state |= KEY_GC_FOUND_DEAD_KEY;
                                set_bit(KEY_FLAG_DEAD, &key->flags);
                                key->perm = 0;
                                goto skip_dead_key;
                        } else if (key->type == &key_type_keyring &&
                                   key->restrict_link) {
                                goto found_restricted_keyring;
                        }
                }

                expiry = key->expiry;
                if (expiry != TIME64_MAX) {
                        if (!(key->type->flags & KEY_TYPE_INSTANT_REAP))
                                expiry += key_gc_delay;
                        if (expiry > limit && expiry < new_timer) {
                                kdebug("will expire %x in %lld",
                                       key_serial(key), key->expiry - limit);
                                new_timer = key->expiry;
                        }
                }

                if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2))
                        if (key->type == key_gc_dead_keytype)
                                gc_state |= KEY_GC_FOUND_DEAD_KEY;

                if ((gc_state & KEY_GC_REAPING_LINKS) ||
                    unlikely(gc_state & KEY_GC_REAPING_DEAD_2)) {
                        if (key->type == &key_type_keyring)
                                goto found_keyring;
                }

                if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3))
                        if (key->type == key_gc_dead_keytype)
                                goto destroy_dead_key;

        skip_dead_key:
                if (spin_is_contended(&key_serial_lock) || need_resched())
                        goto contended;
        }

contended:
        spin_unlock(&key_serial_lock);

maybe_resched:
        if (cursor) {
                cond_resched();
                spin_lock(&key_serial_lock);
                goto continue_scanning;
        }

        /* We've completed the pass.  Set the timer if we need to and queue a
         * new cycle if necessary.  We keep executing cycles until we find one
         * where we didn't reap any keys.
         */
        kdebug("pass complete");

        if (new_timer != TIME64_MAX) {
                new_timer += key_gc_delay;
                key_schedule_gc(new_timer);
        }

        if (unlikely(gc_state & KEY_GC_REAPING_DEAD_2) ||
            !list_empty(&graveyard)) {
                /* Make sure that all pending keyring payload destructions are
                 * fulfilled and that people aren't now looking at dead or
                 * dying keys that they don't have a reference upon or a link
                 * to.
                 */
                kdebug("gc sync");
                synchronize_rcu();
        }

        if (!list_empty(&graveyard)) {
                kdebug("gc keys");
                key_gc_unused_keys(&graveyard);
        }

        if (unlikely(gc_state & (KEY_GC_REAPING_DEAD_1 |
                                 KEY_GC_REAPING_DEAD_2))) {
                if (!(gc_state & KEY_GC_FOUND_DEAD_KEY)) {
                        /* No remaining dead keys: short circuit the remaining
                         * keytype reap cycles.
                         */
                        kdebug("dead short");
                        gc_state &= ~(KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2);
                        gc_state |= KEY_GC_REAPING_DEAD_3;
                } else {
                        gc_state |= KEY_GC_REAP_AGAIN;
                }
        }

        if (unlikely(gc_state & KEY_GC_REAPING_DEAD_3)) {
                kdebug("dead wake");
                smp_mb();
                clear_bit(KEY_GC_REAPING_KEYTYPE, &key_gc_flags);
                wake_up_bit(&key_gc_flags, KEY_GC_REAPING_KEYTYPE);
        }

        if (gc_state & KEY_GC_REAP_AGAIN)
                schedule_work(&key_gc_work);
        kleave(" [end %x]", gc_state);
        return;

        /* We found an unreferenced key - once we've removed it from the tree,
         * we can safely drop the lock.
         */
found_unreferenced_key:
        kdebug("unrefd key %d", key->serial);
        rb_erase(&key->serial_node, &key_serial_tree);
        spin_unlock(&key_serial_lock);

        list_add_tail(&key->graveyard_link, &graveyard);
        gc_state |= KEY_GC_REAP_AGAIN;
        goto maybe_resched;

        /* We found a restricted keyring and need to update the restriction if
         * it is associated with the dead key type.
         */
found_restricted_keyring:
        spin_unlock(&key_serial_lock);
        keyring_restriction_gc(key, key_gc_dead_keytype);
        goto maybe_resched;

        /* We found a keyring and we need to check the payload for links to
         * dead or expired keys.  We don't flag another reap immediately as we
         * have to wait for the old payload to be destroyed by RCU before we
         * can reap the keys to which it refers.
         */
found_keyring:
        spin_unlock(&key_serial_lock);
        keyring_gc(key, limit);
        goto maybe_resched;

        /* We found a dead key that is still referenced.  Reset its type and
         * destroy its payload with its semaphore held.
         */
destroy_dead_key:
        spin_unlock(&key_serial_lock);
        kdebug("destroy key %d", key->serial);
        down_write(&key->sem);
        key->type = &key_type_dead;
        if (key_gc_dead_keytype->destroy)
                key_gc_dead_keytype->destroy(key);
        memset(&key->payload, KEY_DESTROY, sizeof(key->payload));
        up_write(&key->sem);
        goto maybe_resched;
}