xref: /linux/fs/cachefiles/namei.c (revision 95298d63c67673c654c08952672d016212b26054)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* CacheFiles path walking and related routines
3  *
4  * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
5  * Written by David Howells (dhowells@redhat.com)
6  */
7 
8 #include <linux/module.h>
9 #include <linux/sched.h>
10 #include <linux/file.h>
11 #include <linux/fs.h>
12 #include <linux/fsnotify.h>
13 #include <linux/quotaops.h>
14 #include <linux/xattr.h>
15 #include <linux/mount.h>
16 #include <linux/namei.h>
17 #include <linux/security.h>
18 #include <linux/slab.h>
19 #include "internal.h"
20 
21 #define CACHEFILES_KEYBUF_SIZE 512
22 
23 /*
24  * dump debugging info about an object
25  */
26 static noinline
27 void __cachefiles_printk_object(struct cachefiles_object *object,
28 				const char *prefix)
29 {
30 	struct fscache_cookie *cookie;
31 	const u8 *k;
32 	unsigned loop;
33 
34 	pr_err("%sobject: OBJ%x\n", prefix, object->fscache.debug_id);
35 	pr_err("%sobjstate=%s fl=%lx wbusy=%x ev=%lx[%lx]\n",
36 	       prefix, object->fscache.state->name,
37 	       object->fscache.flags, work_busy(&object->fscache.work),
38 	       object->fscache.events, object->fscache.event_mask);
39 	pr_err("%sops=%u inp=%u exc=%u\n",
40 	       prefix, object->fscache.n_ops, object->fscache.n_in_progress,
41 	       object->fscache.n_exclusive);
42 	pr_err("%sparent=%p\n",
43 	       prefix, object->fscache.parent);
44 
45 	spin_lock(&object->fscache.lock);
46 	cookie = object->fscache.cookie;
47 	if (cookie) {
48 		pr_err("%scookie=%p [pr=%p nd=%p fl=%lx]\n",
49 		       prefix,
50 		       object->fscache.cookie,
51 		       object->fscache.cookie->parent,
52 		       object->fscache.cookie->netfs_data,
53 		       object->fscache.cookie->flags);
54 		pr_err("%skey=[%u] '", prefix, cookie->key_len);
55 		k = (cookie->key_len <= sizeof(cookie->inline_key)) ?
56 			cookie->inline_key : cookie->key;
57 		for (loop = 0; loop < cookie->key_len; loop++)
58 			pr_cont("%02x", k[loop]);
59 		pr_cont("'\n");
60 	} else {
61 		pr_err("%scookie=NULL\n", prefix);
62 	}
63 	spin_unlock(&object->fscache.lock);
64 }
65 
66 /*
67  * dump debugging info about a pair of objects
68  */
69 static noinline void cachefiles_printk_object(struct cachefiles_object *object,
70 					      struct cachefiles_object *xobject)
71 {
72 	if (object)
73 		__cachefiles_printk_object(object, "");
74 	if (xobject)
75 		__cachefiles_printk_object(xobject, "x");
76 }
77 
78 /*
79  * mark the owner of a dentry, if there is one, to indicate that that dentry
80  * has been preemptively deleted
81  * - the caller must hold the i_mutex on the dentry's parent as required to
82  *   call vfs_unlink(), vfs_rmdir() or vfs_rename()
83  */
84 static void cachefiles_mark_object_buried(struct cachefiles_cache *cache,
85 					  struct dentry *dentry,
86 					  enum fscache_why_object_killed why)
87 {
88 	struct cachefiles_object *object;
89 	struct rb_node *p;
90 
91 	_enter(",'%pd'", dentry);
92 
93 	write_lock(&cache->active_lock);
94 
95 	p = cache->active_nodes.rb_node;
96 	while (p) {
97 		object = rb_entry(p, struct cachefiles_object, active_node);
98 		if (object->dentry > dentry)
99 			p = p->rb_left;
100 		else if (object->dentry < dentry)
101 			p = p->rb_right;
102 		else
103 			goto found_dentry;
104 	}
105 
106 	write_unlock(&cache->active_lock);
107 	trace_cachefiles_mark_buried(NULL, dentry, why);
108 	_leave(" [no owner]");
109 	return;
110 
111 	/* found the dentry for  */
112 found_dentry:
113 	kdebug("preemptive burial: OBJ%x [%s] %p",
114 	       object->fscache.debug_id,
115 	       object->fscache.state->name,
116 	       dentry);
117 
118 	trace_cachefiles_mark_buried(object, dentry, why);
119 
120 	if (fscache_object_is_live(&object->fscache)) {
121 		pr_err("\n");
122 		pr_err("Error: Can't preemptively bury live object\n");
123 		cachefiles_printk_object(object, NULL);
124 	} else {
125 		if (why != FSCACHE_OBJECT_IS_STALE)
126 			fscache_object_mark_killed(&object->fscache, why);
127 	}
128 
129 	write_unlock(&cache->active_lock);
130 	_leave(" [owner marked]");
131 }
132 
133 /*
134  * record the fact that an object is now active
135  */
136 static int cachefiles_mark_object_active(struct cachefiles_cache *cache,
137 					 struct cachefiles_object *object)
138 {
139 	struct cachefiles_object *xobject;
140 	struct rb_node **_p, *_parent = NULL;
141 	struct dentry *dentry;
142 
143 	_enter(",%p", object);
144 
145 try_again:
146 	write_lock(&cache->active_lock);
147 
148 	dentry = object->dentry;
149 	trace_cachefiles_mark_active(object, dentry);
150 
151 	if (test_and_set_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags)) {
152 		pr_err("Error: Object already active\n");
153 		cachefiles_printk_object(object, NULL);
154 		BUG();
155 	}
156 
157 	_p = &cache->active_nodes.rb_node;
158 	while (*_p) {
159 		_parent = *_p;
160 		xobject = rb_entry(_parent,
161 				   struct cachefiles_object, active_node);
162 
163 		ASSERT(xobject != object);
164 
165 		if (xobject->dentry > dentry)
166 			_p = &(*_p)->rb_left;
167 		else if (xobject->dentry < dentry)
168 			_p = &(*_p)->rb_right;
169 		else
170 			goto wait_for_old_object;
171 	}
172 
173 	rb_link_node(&object->active_node, _parent, _p);
174 	rb_insert_color(&object->active_node, &cache->active_nodes);
175 
176 	write_unlock(&cache->active_lock);
177 	_leave(" = 0");
178 	return 0;
179 
180 	/* an old object from a previous incarnation is hogging the slot - we
181 	 * need to wait for it to be destroyed */
182 wait_for_old_object:
183 	trace_cachefiles_wait_active(object, dentry, xobject);
184 	clear_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags);
185 
186 	if (fscache_object_is_live(&xobject->fscache)) {
187 		pr_err("\n");
188 		pr_err("Error: Unexpected object collision\n");
189 		cachefiles_printk_object(object, xobject);
190 	}
191 	atomic_inc(&xobject->usage);
192 	write_unlock(&cache->active_lock);
193 
194 	if (test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags)) {
195 		wait_queue_head_t *wq;
196 
197 		signed long timeout = 60 * HZ;
198 		wait_queue_entry_t wait;
199 		bool requeue;
200 
201 		/* if the object we're waiting for is queued for processing,
202 		 * then just put ourselves on the queue behind it */
203 		if (work_pending(&xobject->fscache.work)) {
204 			_debug("queue OBJ%x behind OBJ%x immediately",
205 			       object->fscache.debug_id,
206 			       xobject->fscache.debug_id);
207 			goto requeue;
208 		}
209 
210 		/* otherwise we sleep until either the object we're waiting for
211 		 * is done, or the fscache_object is congested */
212 		wq = bit_waitqueue(&xobject->flags, CACHEFILES_OBJECT_ACTIVE);
213 		init_wait(&wait);
214 		requeue = false;
215 		do {
216 			prepare_to_wait(wq, &wait, TASK_UNINTERRUPTIBLE);
217 			if (!test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags))
218 				break;
219 
220 			requeue = fscache_object_sleep_till_congested(&timeout);
221 		} while (timeout > 0 && !requeue);
222 		finish_wait(wq, &wait);
223 
224 		if (requeue &&
225 		    test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags)) {
226 			_debug("queue OBJ%x behind OBJ%x after wait",
227 			       object->fscache.debug_id,
228 			       xobject->fscache.debug_id);
229 			goto requeue;
230 		}
231 
232 		if (timeout <= 0) {
233 			pr_err("\n");
234 			pr_err("Error: Overlong wait for old active object to go away\n");
235 			cachefiles_printk_object(object, xobject);
236 			goto requeue;
237 		}
238 	}
239 
240 	ASSERT(!test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags));
241 
242 	cache->cache.ops->put_object(&xobject->fscache,
243 		(enum fscache_obj_ref_trace)cachefiles_obj_put_wait_retry);
244 	goto try_again;
245 
246 requeue:
247 	cache->cache.ops->put_object(&xobject->fscache,
248 		(enum fscache_obj_ref_trace)cachefiles_obj_put_wait_timeo);
249 	_leave(" = -ETIMEDOUT");
250 	return -ETIMEDOUT;
251 }
252 
253 /*
254  * Mark an object as being inactive.
255  */
256 void cachefiles_mark_object_inactive(struct cachefiles_cache *cache,
257 				     struct cachefiles_object *object,
258 				     blkcnt_t i_blocks)
259 {
260 	struct dentry *dentry = object->dentry;
261 	struct inode *inode = d_backing_inode(dentry);
262 
263 	trace_cachefiles_mark_inactive(object, dentry, inode);
264 
265 	write_lock(&cache->active_lock);
266 	rb_erase(&object->active_node, &cache->active_nodes);
267 	clear_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags);
268 	write_unlock(&cache->active_lock);
269 
270 	wake_up_bit(&object->flags, CACHEFILES_OBJECT_ACTIVE);
271 
272 	/* This object can now be culled, so we need to let the daemon know
273 	 * that there is something it can remove if it needs to.
274 	 */
275 	atomic_long_add(i_blocks, &cache->b_released);
276 	if (atomic_inc_return(&cache->f_released))
277 		cachefiles_state_changed(cache);
278 }
279 
280 /*
281  * delete an object representation from the cache
282  * - file backed objects are unlinked
283  * - directory backed objects are stuffed into the graveyard for userspace to
284  *   delete
285  * - unlocks the directory mutex
286  */
287 static int cachefiles_bury_object(struct cachefiles_cache *cache,
288 				  struct cachefiles_object *object,
289 				  struct dentry *dir,
290 				  struct dentry *rep,
291 				  bool preemptive,
292 				  enum fscache_why_object_killed why)
293 {
294 	struct dentry *grave, *trap;
295 	struct path path, path_to_graveyard;
296 	char nbuffer[8 + 8 + 1];
297 	int ret;
298 
299 	_enter(",'%pd','%pd'", dir, rep);
300 
301 	_debug("remove %p from %p", rep, dir);
302 
303 	/* non-directories can just be unlinked */
304 	if (!d_is_dir(rep)) {
305 		_debug("unlink stale object");
306 
307 		path.mnt = cache->mnt;
308 		path.dentry = dir;
309 		ret = security_path_unlink(&path, rep);
310 		if (ret < 0) {
311 			cachefiles_io_error(cache, "Unlink security error");
312 		} else {
313 			trace_cachefiles_unlink(object, rep, why);
314 			ret = vfs_unlink(d_inode(dir), rep, NULL);
315 
316 			if (preemptive)
317 				cachefiles_mark_object_buried(cache, rep, why);
318 		}
319 
320 		inode_unlock(d_inode(dir));
321 
322 		if (ret == -EIO)
323 			cachefiles_io_error(cache, "Unlink failed");
324 
325 		_leave(" = %d", ret);
326 		return ret;
327 	}
328 
329 	/* directories have to be moved to the graveyard */
330 	_debug("move stale object to graveyard");
331 	inode_unlock(d_inode(dir));
332 
333 try_again:
334 	/* first step is to make up a grave dentry in the graveyard */
335 	sprintf(nbuffer, "%08x%08x",
336 		(uint32_t) ktime_get_real_seconds(),
337 		(uint32_t) atomic_inc_return(&cache->gravecounter));
338 
339 	/* do the multiway lock magic */
340 	trap = lock_rename(cache->graveyard, dir);
341 
342 	/* do some checks before getting the grave dentry */
343 	if (rep->d_parent != dir || IS_DEADDIR(d_inode(rep))) {
344 		/* the entry was probably culled when we dropped the parent dir
345 		 * lock */
346 		unlock_rename(cache->graveyard, dir);
347 		_leave(" = 0 [culled?]");
348 		return 0;
349 	}
350 
351 	if (!d_can_lookup(cache->graveyard)) {
352 		unlock_rename(cache->graveyard, dir);
353 		cachefiles_io_error(cache, "Graveyard no longer a directory");
354 		return -EIO;
355 	}
356 
357 	if (trap == rep) {
358 		unlock_rename(cache->graveyard, dir);
359 		cachefiles_io_error(cache, "May not make directory loop");
360 		return -EIO;
361 	}
362 
363 	if (d_mountpoint(rep)) {
364 		unlock_rename(cache->graveyard, dir);
365 		cachefiles_io_error(cache, "Mountpoint in cache");
366 		return -EIO;
367 	}
368 
369 	grave = lookup_one_len(nbuffer, cache->graveyard, strlen(nbuffer));
370 	if (IS_ERR(grave)) {
371 		unlock_rename(cache->graveyard, dir);
372 
373 		if (PTR_ERR(grave) == -ENOMEM) {
374 			_leave(" = -ENOMEM");
375 			return -ENOMEM;
376 		}
377 
378 		cachefiles_io_error(cache, "Lookup error %ld",
379 				    PTR_ERR(grave));
380 		return -EIO;
381 	}
382 
383 	if (d_is_positive(grave)) {
384 		unlock_rename(cache->graveyard, dir);
385 		dput(grave);
386 		grave = NULL;
387 		cond_resched();
388 		goto try_again;
389 	}
390 
391 	if (d_mountpoint(grave)) {
392 		unlock_rename(cache->graveyard, dir);
393 		dput(grave);
394 		cachefiles_io_error(cache, "Mountpoint in graveyard");
395 		return -EIO;
396 	}
397 
398 	/* target should not be an ancestor of source */
399 	if (trap == grave) {
400 		unlock_rename(cache->graveyard, dir);
401 		dput(grave);
402 		cachefiles_io_error(cache, "May not make directory loop");
403 		return -EIO;
404 	}
405 
406 	/* attempt the rename */
407 	path.mnt = cache->mnt;
408 	path.dentry = dir;
409 	path_to_graveyard.mnt = cache->mnt;
410 	path_to_graveyard.dentry = cache->graveyard;
411 	ret = security_path_rename(&path, rep, &path_to_graveyard, grave, 0);
412 	if (ret < 0) {
413 		cachefiles_io_error(cache, "Rename security error %d", ret);
414 	} else {
415 		trace_cachefiles_rename(object, rep, grave, why);
416 		ret = vfs_rename(d_inode(dir), rep,
417 				 d_inode(cache->graveyard), grave, NULL, 0);
418 		if (ret != 0 && ret != -ENOMEM)
419 			cachefiles_io_error(cache,
420 					    "Rename failed with error %d", ret);
421 
422 		if (preemptive)
423 			cachefiles_mark_object_buried(cache, rep, why);
424 	}
425 
426 	unlock_rename(cache->graveyard, dir);
427 	dput(grave);
428 	_leave(" = 0");
429 	return 0;
430 }
431 
432 /*
433  * delete an object representation from the cache
434  */
435 int cachefiles_delete_object(struct cachefiles_cache *cache,
436 			     struct cachefiles_object *object)
437 {
438 	struct dentry *dir;
439 	int ret;
440 
441 	_enter(",OBJ%x{%p}", object->fscache.debug_id, object->dentry);
442 
443 	ASSERT(object->dentry);
444 	ASSERT(d_backing_inode(object->dentry));
445 	ASSERT(object->dentry->d_parent);
446 
447 	dir = dget_parent(object->dentry);
448 
449 	inode_lock_nested(d_inode(dir), I_MUTEX_PARENT);
450 
451 	if (test_bit(FSCACHE_OBJECT_KILLED_BY_CACHE, &object->fscache.flags)) {
452 		/* object allocation for the same key preemptively deleted this
453 		 * object's file so that it could create its own file */
454 		_debug("object preemptively buried");
455 		inode_unlock(d_inode(dir));
456 		ret = 0;
457 	} else {
458 		/* we need to check that our parent is _still_ our parent - it
459 		 * may have been renamed */
460 		if (dir == object->dentry->d_parent) {
461 			ret = cachefiles_bury_object(cache, object, dir,
462 						     object->dentry, false,
463 						     FSCACHE_OBJECT_WAS_RETIRED);
464 		} else {
465 			/* it got moved, presumably by cachefilesd culling it,
466 			 * so it's no longer in the key path and we can ignore
467 			 * it */
468 			inode_unlock(d_inode(dir));
469 			ret = 0;
470 		}
471 	}
472 
473 	dput(dir);
474 	_leave(" = %d", ret);
475 	return ret;
476 }
477 
478 /*
479  * walk from the parent object to the child object through the backing
480  * filesystem, creating directories as we go
481  */
482 int cachefiles_walk_to_object(struct cachefiles_object *parent,
483 			      struct cachefiles_object *object,
484 			      const char *key,
485 			      struct cachefiles_xattr *auxdata)
486 {
487 	struct cachefiles_cache *cache;
488 	struct dentry *dir, *next = NULL;
489 	struct inode *inode;
490 	struct path path;
491 	unsigned long start;
492 	const char *name;
493 	int ret, nlen;
494 
495 	_enter("OBJ%x{%p},OBJ%x,%s,",
496 	       parent->fscache.debug_id, parent->dentry,
497 	       object->fscache.debug_id, key);
498 
499 	cache = container_of(parent->fscache.cache,
500 			     struct cachefiles_cache, cache);
501 	path.mnt = cache->mnt;
502 
503 	ASSERT(parent->dentry);
504 	ASSERT(d_backing_inode(parent->dentry));
505 
506 	if (!(d_is_dir(parent->dentry))) {
507 		// TODO: convert file to dir
508 		_leave("looking up in none directory");
509 		return -ENOBUFS;
510 	}
511 
512 	dir = dget(parent->dentry);
513 
514 advance:
515 	/* attempt to transit the first directory component */
516 	name = key;
517 	nlen = strlen(key);
518 
519 	/* key ends in a double NUL */
520 	key = key + nlen + 1;
521 	if (!*key)
522 		key = NULL;
523 
524 lookup_again:
525 	/* search the current directory for the element name */
526 	_debug("lookup '%s'", name);
527 
528 	inode_lock_nested(d_inode(dir), I_MUTEX_PARENT);
529 
530 	start = jiffies;
531 	next = lookup_one_len(name, dir, nlen);
532 	cachefiles_hist(cachefiles_lookup_histogram, start);
533 	if (IS_ERR(next)) {
534 		trace_cachefiles_lookup(object, next, NULL);
535 		goto lookup_error;
536 	}
537 
538 	inode = d_backing_inode(next);
539 	trace_cachefiles_lookup(object, next, inode);
540 	_debug("next -> %p %s", next, inode ? "positive" : "negative");
541 
542 	if (!key)
543 		object->new = !inode;
544 
545 	/* if this element of the path doesn't exist, then the lookup phase
546 	 * failed, and we can release any readers in the certain knowledge that
547 	 * there's nothing for them to actually read */
548 	if (d_is_negative(next))
549 		fscache_object_lookup_negative(&object->fscache);
550 
551 	/* we need to create the object if it's negative */
552 	if (key || object->type == FSCACHE_COOKIE_TYPE_INDEX) {
553 		/* index objects and intervening tree levels must be subdirs */
554 		if (d_is_negative(next)) {
555 			ret = cachefiles_has_space(cache, 1, 0);
556 			if (ret < 0)
557 				goto no_space_error;
558 
559 			path.dentry = dir;
560 			ret = security_path_mkdir(&path, next, 0);
561 			if (ret < 0)
562 				goto create_error;
563 			start = jiffies;
564 			ret = vfs_mkdir(d_inode(dir), next, 0);
565 			cachefiles_hist(cachefiles_mkdir_histogram, start);
566 			if (!key)
567 				trace_cachefiles_mkdir(object, next, ret);
568 			if (ret < 0)
569 				goto create_error;
570 
571 			if (unlikely(d_unhashed(next))) {
572 				dput(next);
573 				inode_unlock(d_inode(dir));
574 				goto lookup_again;
575 			}
576 			ASSERT(d_backing_inode(next));
577 
578 			_debug("mkdir -> %p{%p{ino=%lu}}",
579 			       next, d_backing_inode(next), d_backing_inode(next)->i_ino);
580 
581 		} else if (!d_can_lookup(next)) {
582 			pr_err("inode %lu is not a directory\n",
583 			       d_backing_inode(next)->i_ino);
584 			ret = -ENOBUFS;
585 			goto error;
586 		}
587 
588 	} else {
589 		/* non-index objects start out life as files */
590 		if (d_is_negative(next)) {
591 			ret = cachefiles_has_space(cache, 1, 0);
592 			if (ret < 0)
593 				goto no_space_error;
594 
595 			path.dentry = dir;
596 			ret = security_path_mknod(&path, next, S_IFREG, 0);
597 			if (ret < 0)
598 				goto create_error;
599 			start = jiffies;
600 			ret = vfs_create(d_inode(dir), next, S_IFREG, true);
601 			cachefiles_hist(cachefiles_create_histogram, start);
602 			trace_cachefiles_create(object, next, ret);
603 			if (ret < 0)
604 				goto create_error;
605 
606 			ASSERT(d_backing_inode(next));
607 
608 			_debug("create -> %p{%p{ino=%lu}}",
609 			       next, d_backing_inode(next), d_backing_inode(next)->i_ino);
610 
611 		} else if (!d_can_lookup(next) &&
612 			   !d_is_reg(next)
613 			   ) {
614 			pr_err("inode %lu is not a file or directory\n",
615 			       d_backing_inode(next)->i_ino);
616 			ret = -ENOBUFS;
617 			goto error;
618 		}
619 	}
620 
621 	/* process the next component */
622 	if (key) {
623 		_debug("advance");
624 		inode_unlock(d_inode(dir));
625 		dput(dir);
626 		dir = next;
627 		next = NULL;
628 		goto advance;
629 	}
630 
631 	/* we've found the object we were looking for */
632 	object->dentry = next;
633 
634 	/* if we've found that the terminal object exists, then we need to
635 	 * check its attributes and delete it if it's out of date */
636 	if (!object->new) {
637 		_debug("validate '%pd'", next);
638 
639 		ret = cachefiles_check_object_xattr(object, auxdata);
640 		if (ret == -ESTALE) {
641 			/* delete the object (the deleter drops the directory
642 			 * mutex) */
643 			object->dentry = NULL;
644 
645 			ret = cachefiles_bury_object(cache, object, dir, next,
646 						     true,
647 						     FSCACHE_OBJECT_IS_STALE);
648 			dput(next);
649 			next = NULL;
650 
651 			if (ret < 0)
652 				goto delete_error;
653 
654 			_debug("redo lookup");
655 			fscache_object_retrying_stale(&object->fscache);
656 			goto lookup_again;
657 		}
658 	}
659 
660 	/* note that we're now using this object */
661 	ret = cachefiles_mark_object_active(cache, object);
662 
663 	inode_unlock(d_inode(dir));
664 	dput(dir);
665 	dir = NULL;
666 
667 	if (ret == -ETIMEDOUT)
668 		goto mark_active_timed_out;
669 
670 	_debug("=== OBTAINED_OBJECT ===");
671 
672 	if (object->new) {
673 		/* attach data to a newly constructed terminal object */
674 		ret = cachefiles_set_object_xattr(object, auxdata);
675 		if (ret < 0)
676 			goto check_error;
677 	} else {
678 		/* always update the atime on an object we've just looked up
679 		 * (this is used to keep track of culling, and atimes are only
680 		 * updated by read, write and readdir but not lookup or
681 		 * open) */
682 		path.dentry = next;
683 		touch_atime(&path);
684 	}
685 
686 	/* open a file interface onto a data file */
687 	if (object->type != FSCACHE_COOKIE_TYPE_INDEX) {
688 		if (d_is_reg(object->dentry)) {
689 			const struct address_space_operations *aops;
690 
691 			ret = -EPERM;
692 			aops = d_backing_inode(object->dentry)->i_mapping->a_ops;
693 			if (!aops->bmap)
694 				goto check_error;
695 			if (object->dentry->d_sb->s_blocksize > PAGE_SIZE)
696 				goto check_error;
697 
698 			object->backer = object->dentry;
699 		} else {
700 			BUG(); // TODO: open file in data-class subdir
701 		}
702 	}
703 
704 	object->new = 0;
705 	fscache_obtained_object(&object->fscache);
706 
707 	_leave(" = 0 [%lu]", d_backing_inode(object->dentry)->i_ino);
708 	return 0;
709 
710 no_space_error:
711 	fscache_object_mark_killed(&object->fscache, FSCACHE_OBJECT_NO_SPACE);
712 create_error:
713 	_debug("create error %d", ret);
714 	if (ret == -EIO)
715 		cachefiles_io_error(cache, "Create/mkdir failed");
716 	goto error;
717 
718 mark_active_timed_out:
719 	_debug("mark active timed out");
720 	goto release_dentry;
721 
722 check_error:
723 	_debug("check error %d", ret);
724 	cachefiles_mark_object_inactive(
725 		cache, object, d_backing_inode(object->dentry)->i_blocks);
726 release_dentry:
727 	dput(object->dentry);
728 	object->dentry = NULL;
729 	goto error_out;
730 
731 delete_error:
732 	_debug("delete error %d", ret);
733 	goto error_out2;
734 
735 lookup_error:
736 	_debug("lookup error %ld", PTR_ERR(next));
737 	ret = PTR_ERR(next);
738 	if (ret == -EIO)
739 		cachefiles_io_error(cache, "Lookup failed");
740 	next = NULL;
741 error:
742 	inode_unlock(d_inode(dir));
743 	dput(next);
744 error_out2:
745 	dput(dir);
746 error_out:
747 	_leave(" = error %d", -ret);
748 	return ret;
749 }
750 
751 /*
752  * get a subdirectory
753  */
754 struct dentry *cachefiles_get_directory(struct cachefiles_cache *cache,
755 					struct dentry *dir,
756 					const char *dirname)
757 {
758 	struct dentry *subdir;
759 	unsigned long start;
760 	struct path path;
761 	int ret;
762 
763 	_enter(",,%s", dirname);
764 
765 	/* search the current directory for the element name */
766 	inode_lock(d_inode(dir));
767 
768 retry:
769 	start = jiffies;
770 	subdir = lookup_one_len(dirname, dir, strlen(dirname));
771 	cachefiles_hist(cachefiles_lookup_histogram, start);
772 	if (IS_ERR(subdir)) {
773 		if (PTR_ERR(subdir) == -ENOMEM)
774 			goto nomem_d_alloc;
775 		goto lookup_error;
776 	}
777 
778 	_debug("subdir -> %p %s",
779 	       subdir, d_backing_inode(subdir) ? "positive" : "negative");
780 
781 	/* we need to create the subdir if it doesn't exist yet */
782 	if (d_is_negative(subdir)) {
783 		ret = cachefiles_has_space(cache, 1, 0);
784 		if (ret < 0)
785 			goto mkdir_error;
786 
787 		_debug("attempt mkdir");
788 
789 		path.mnt = cache->mnt;
790 		path.dentry = dir;
791 		ret = security_path_mkdir(&path, subdir, 0700);
792 		if (ret < 0)
793 			goto mkdir_error;
794 		ret = vfs_mkdir(d_inode(dir), subdir, 0700);
795 		if (ret < 0)
796 			goto mkdir_error;
797 
798 		if (unlikely(d_unhashed(subdir))) {
799 			dput(subdir);
800 			goto retry;
801 		}
802 		ASSERT(d_backing_inode(subdir));
803 
804 		_debug("mkdir -> %p{%p{ino=%lu}}",
805 		       subdir,
806 		       d_backing_inode(subdir),
807 		       d_backing_inode(subdir)->i_ino);
808 	}
809 
810 	inode_unlock(d_inode(dir));
811 
812 	/* we need to make sure the subdir is a directory */
813 	ASSERT(d_backing_inode(subdir));
814 
815 	if (!d_can_lookup(subdir)) {
816 		pr_err("%s is not a directory\n", dirname);
817 		ret = -EIO;
818 		goto check_error;
819 	}
820 
821 	ret = -EPERM;
822 	if (!(d_backing_inode(subdir)->i_opflags & IOP_XATTR) ||
823 	    !d_backing_inode(subdir)->i_op->lookup ||
824 	    !d_backing_inode(subdir)->i_op->mkdir ||
825 	    !d_backing_inode(subdir)->i_op->create ||
826 	    !d_backing_inode(subdir)->i_op->rename ||
827 	    !d_backing_inode(subdir)->i_op->rmdir ||
828 	    !d_backing_inode(subdir)->i_op->unlink)
829 		goto check_error;
830 
831 	_leave(" = [%lu]", d_backing_inode(subdir)->i_ino);
832 	return subdir;
833 
834 check_error:
835 	dput(subdir);
836 	_leave(" = %d [check]", ret);
837 	return ERR_PTR(ret);
838 
839 mkdir_error:
840 	inode_unlock(d_inode(dir));
841 	dput(subdir);
842 	pr_err("mkdir %s failed with error %d\n", dirname, ret);
843 	return ERR_PTR(ret);
844 
845 lookup_error:
846 	inode_unlock(d_inode(dir));
847 	ret = PTR_ERR(subdir);
848 	pr_err("Lookup %s failed with error %d\n", dirname, ret);
849 	return ERR_PTR(ret);
850 
851 nomem_d_alloc:
852 	inode_unlock(d_inode(dir));
853 	_leave(" = -ENOMEM");
854 	return ERR_PTR(-ENOMEM);
855 }
856 
857 /*
858  * find out if an object is in use or not
859  * - if finds object and it's not in use:
860  *   - returns a pointer to the object and a reference on it
861  *   - returns with the directory locked
862  */
863 static struct dentry *cachefiles_check_active(struct cachefiles_cache *cache,
864 					      struct dentry *dir,
865 					      char *filename)
866 {
867 	struct cachefiles_object *object;
868 	struct rb_node *_n;
869 	struct dentry *victim;
870 	unsigned long start;
871 	int ret;
872 
873 	//_enter(",%pd/,%s",
874 	//       dir, filename);
875 
876 	/* look up the victim */
877 	inode_lock_nested(d_inode(dir), I_MUTEX_PARENT);
878 
879 	start = jiffies;
880 	victim = lookup_one_len(filename, dir, strlen(filename));
881 	cachefiles_hist(cachefiles_lookup_histogram, start);
882 	if (IS_ERR(victim))
883 		goto lookup_error;
884 
885 	//_debug("victim -> %p %s",
886 	//       victim, d_backing_inode(victim) ? "positive" : "negative");
887 
888 	/* if the object is no longer there then we probably retired the object
889 	 * at the netfs's request whilst the cull was in progress
890 	 */
891 	if (d_is_negative(victim)) {
892 		inode_unlock(d_inode(dir));
893 		dput(victim);
894 		_leave(" = -ENOENT [absent]");
895 		return ERR_PTR(-ENOENT);
896 	}
897 
898 	/* check to see if we're using this object */
899 	read_lock(&cache->active_lock);
900 
901 	_n = cache->active_nodes.rb_node;
902 
903 	while (_n) {
904 		object = rb_entry(_n, struct cachefiles_object, active_node);
905 
906 		if (object->dentry > victim)
907 			_n = _n->rb_left;
908 		else if (object->dentry < victim)
909 			_n = _n->rb_right;
910 		else
911 			goto object_in_use;
912 	}
913 
914 	read_unlock(&cache->active_lock);
915 
916 	//_leave(" = %p", victim);
917 	return victim;
918 
919 object_in_use:
920 	read_unlock(&cache->active_lock);
921 	inode_unlock(d_inode(dir));
922 	dput(victim);
923 	//_leave(" = -EBUSY [in use]");
924 	return ERR_PTR(-EBUSY);
925 
926 lookup_error:
927 	inode_unlock(d_inode(dir));
928 	ret = PTR_ERR(victim);
929 	if (ret == -ENOENT) {
930 		/* file or dir now absent - probably retired by netfs */
931 		_leave(" = -ESTALE [absent]");
932 		return ERR_PTR(-ESTALE);
933 	}
934 
935 	if (ret == -EIO) {
936 		cachefiles_io_error(cache, "Lookup failed");
937 	} else if (ret != -ENOMEM) {
938 		pr_err("Internal error: %d\n", ret);
939 		ret = -EIO;
940 	}
941 
942 	_leave(" = %d", ret);
943 	return ERR_PTR(ret);
944 }
945 
946 /*
947  * cull an object if it's not in use
948  * - called only by cache manager daemon
949  */
950 int cachefiles_cull(struct cachefiles_cache *cache, struct dentry *dir,
951 		    char *filename)
952 {
953 	struct dentry *victim;
954 	int ret;
955 
956 	_enter(",%pd/,%s", dir, filename);
957 
958 	victim = cachefiles_check_active(cache, dir, filename);
959 	if (IS_ERR(victim))
960 		return PTR_ERR(victim);
961 
962 	_debug("victim -> %p %s",
963 	       victim, d_backing_inode(victim) ? "positive" : "negative");
964 
965 	/* okay... the victim is not being used so we can cull it
966 	 * - start by marking it as stale
967 	 */
968 	_debug("victim is cullable");
969 
970 	ret = cachefiles_remove_object_xattr(cache, victim);
971 	if (ret < 0)
972 		goto error_unlock;
973 
974 	/*  actually remove the victim (drops the dir mutex) */
975 	_debug("bury");
976 
977 	ret = cachefiles_bury_object(cache, NULL, dir, victim, false,
978 				     FSCACHE_OBJECT_WAS_CULLED);
979 	if (ret < 0)
980 		goto error;
981 
982 	dput(victim);
983 	_leave(" = 0");
984 	return 0;
985 
986 error_unlock:
987 	inode_unlock(d_inode(dir));
988 error:
989 	dput(victim);
990 	if (ret == -ENOENT) {
991 		/* file or dir now absent - probably retired by netfs */
992 		_leave(" = -ESTALE [absent]");
993 		return -ESTALE;
994 	}
995 
996 	if (ret != -ENOMEM) {
997 		pr_err("Internal error: %d\n", ret);
998 		ret = -EIO;
999 	}
1000 
1001 	_leave(" = %d", ret);
1002 	return ret;
1003 }
1004 
1005 /*
1006  * find out if an object is in use or not
1007  * - called only by cache manager daemon
1008  * - returns -EBUSY or 0 to indicate whether an object is in use or not
1009  */
1010 int cachefiles_check_in_use(struct cachefiles_cache *cache, struct dentry *dir,
1011 			    char *filename)
1012 {
1013 	struct dentry *victim;
1014 
1015 	//_enter(",%pd/,%s",
1016 	//       dir, filename);
1017 
1018 	victim = cachefiles_check_active(cache, dir, filename);
1019 	if (IS_ERR(victim))
1020 		return PTR_ERR(victim);
1021 
1022 	inode_unlock(d_inode(dir));
1023 	dput(victim);
1024 	//_leave(" = 0");
1025 	return 0;
1026 }
1027