xref: /linux/fs/cachefiles/namei.c (revision e58e871becec2d3b04ed91c0c16fe8deac9c9dfa)
1 /* CacheFiles path walking and related routines
2  *
3  * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
4  * Written by David Howells (dhowells@redhat.com)
5  *
6  * This program is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU General Public Licence
8  * as published by the Free Software Foundation; either version
9  * 2 of the Licence, or (at your option) any later version.
10  */
11 
12 #include <linux/module.h>
13 #include <linux/sched.h>
14 #include <linux/file.h>
15 #include <linux/fs.h>
16 #include <linux/fsnotify.h>
17 #include <linux/quotaops.h>
18 #include <linux/xattr.h>
19 #include <linux/mount.h>
20 #include <linux/namei.h>
21 #include <linux/security.h>
22 #include <linux/slab.h>
23 #include <linux/xattr.h>
24 #include "internal.h"
25 
26 #define CACHEFILES_KEYBUF_SIZE 512
27 
28 /*
29  * dump debugging info about an object
30  */
31 static noinline
32 void __cachefiles_printk_object(struct cachefiles_object *object,
33 				const char *prefix,
34 				u8 *keybuf)
35 {
36 	struct fscache_cookie *cookie;
37 	unsigned keylen, loop;
38 
39 	pr_err("%sobject: OBJ%x\n", prefix, object->fscache.debug_id);
40 	pr_err("%sobjstate=%s fl=%lx wbusy=%x ev=%lx[%lx]\n",
41 	       prefix, object->fscache.state->name,
42 	       object->fscache.flags, work_busy(&object->fscache.work),
43 	       object->fscache.events, object->fscache.event_mask);
44 	pr_err("%sops=%u inp=%u exc=%u\n",
45 	       prefix, object->fscache.n_ops, object->fscache.n_in_progress,
46 	       object->fscache.n_exclusive);
47 	pr_err("%sparent=%p\n",
48 	       prefix, object->fscache.parent);
49 
50 	spin_lock(&object->fscache.lock);
51 	cookie = object->fscache.cookie;
52 	if (cookie) {
53 		pr_err("%scookie=%p [pr=%p nd=%p fl=%lx]\n",
54 		       prefix,
55 		       object->fscache.cookie,
56 		       object->fscache.cookie->parent,
57 		       object->fscache.cookie->netfs_data,
58 		       object->fscache.cookie->flags);
59 		if (keybuf && cookie->def)
60 			keylen = cookie->def->get_key(cookie->netfs_data, keybuf,
61 						      CACHEFILES_KEYBUF_SIZE);
62 		else
63 			keylen = 0;
64 	} else {
65 		pr_err("%scookie=NULL\n", prefix);
66 		keylen = 0;
67 	}
68 	spin_unlock(&object->fscache.lock);
69 
70 	if (keylen) {
71 		pr_err("%skey=[%u] '", prefix, keylen);
72 		for (loop = 0; loop < keylen; loop++)
73 			pr_cont("%02x", keybuf[loop]);
74 		pr_cont("'\n");
75 	}
76 }
77 
78 /*
79  * dump debugging info about a pair of objects
80  */
81 static noinline void cachefiles_printk_object(struct cachefiles_object *object,
82 					      struct cachefiles_object *xobject)
83 {
84 	u8 *keybuf;
85 
86 	keybuf = kmalloc(CACHEFILES_KEYBUF_SIZE, GFP_NOIO);
87 	if (object)
88 		__cachefiles_printk_object(object, "", keybuf);
89 	if (xobject)
90 		__cachefiles_printk_object(xobject, "x", keybuf);
91 	kfree(keybuf);
92 }
93 
94 /*
95  * mark the owner of a dentry, if there is one, to indicate that that dentry
96  * has been preemptively deleted
97  * - the caller must hold the i_mutex on the dentry's parent as required to
98  *   call vfs_unlink(), vfs_rmdir() or vfs_rename()
99  */
100 static void cachefiles_mark_object_buried(struct cachefiles_cache *cache,
101 					  struct dentry *dentry,
102 					  enum fscache_why_object_killed why)
103 {
104 	struct cachefiles_object *object;
105 	struct rb_node *p;
106 
107 	_enter(",'%pd'", dentry);
108 
109 	write_lock(&cache->active_lock);
110 
111 	p = cache->active_nodes.rb_node;
112 	while (p) {
113 		object = rb_entry(p, struct cachefiles_object, active_node);
114 		if (object->dentry > dentry)
115 			p = p->rb_left;
116 		else if (object->dentry < dentry)
117 			p = p->rb_right;
118 		else
119 			goto found_dentry;
120 	}
121 
122 	write_unlock(&cache->active_lock);
123 	_leave(" [no owner]");
124 	return;
125 
126 	/* found the dentry for  */
127 found_dentry:
128 	kdebug("preemptive burial: OBJ%x [%s] %p",
129 	       object->fscache.debug_id,
130 	       object->fscache.state->name,
131 	       dentry);
132 
133 	if (fscache_object_is_live(&object->fscache)) {
134 		pr_err("\n");
135 		pr_err("Error: Can't preemptively bury live object\n");
136 		cachefiles_printk_object(object, NULL);
137 	} else {
138 		if (why != FSCACHE_OBJECT_IS_STALE)
139 			fscache_object_mark_killed(&object->fscache, why);
140 	}
141 
142 	write_unlock(&cache->active_lock);
143 	_leave(" [owner marked]");
144 }
145 
146 /*
147  * record the fact that an object is now active
148  */
149 static int cachefiles_mark_object_active(struct cachefiles_cache *cache,
150 					 struct cachefiles_object *object)
151 {
152 	struct cachefiles_object *xobject;
153 	struct rb_node **_p, *_parent = NULL;
154 	struct dentry *dentry;
155 
156 	_enter(",%p", object);
157 
158 try_again:
159 	write_lock(&cache->active_lock);
160 
161 	if (test_and_set_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags)) {
162 		pr_err("Error: Object already active\n");
163 		cachefiles_printk_object(object, NULL);
164 		BUG();
165 	}
166 
167 	dentry = object->dentry;
168 	_p = &cache->active_nodes.rb_node;
169 	while (*_p) {
170 		_parent = *_p;
171 		xobject = rb_entry(_parent,
172 				   struct cachefiles_object, active_node);
173 
174 		ASSERT(xobject != object);
175 
176 		if (xobject->dentry > dentry)
177 			_p = &(*_p)->rb_left;
178 		else if (xobject->dentry < dentry)
179 			_p = &(*_p)->rb_right;
180 		else
181 			goto wait_for_old_object;
182 	}
183 
184 	rb_link_node(&object->active_node, _parent, _p);
185 	rb_insert_color(&object->active_node, &cache->active_nodes);
186 
187 	write_unlock(&cache->active_lock);
188 	_leave(" = 0");
189 	return 0;
190 
191 	/* an old object from a previous incarnation is hogging the slot - we
192 	 * need to wait for it to be destroyed */
193 wait_for_old_object:
194 	if (fscache_object_is_live(&xobject->fscache)) {
195 		pr_err("\n");
196 		pr_err("Error: Unexpected object collision\n");
197 		cachefiles_printk_object(object, xobject);
198 		BUG();
199 	}
200 	atomic_inc(&xobject->usage);
201 	write_unlock(&cache->active_lock);
202 
203 	if (test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags)) {
204 		wait_queue_head_t *wq;
205 
206 		signed long timeout = 60 * HZ;
207 		wait_queue_t wait;
208 		bool requeue;
209 
210 		/* if the object we're waiting for is queued for processing,
211 		 * then just put ourselves on the queue behind it */
212 		if (work_pending(&xobject->fscache.work)) {
213 			_debug("queue OBJ%x behind OBJ%x immediately",
214 			       object->fscache.debug_id,
215 			       xobject->fscache.debug_id);
216 			goto requeue;
217 		}
218 
219 		/* otherwise we sleep until either the object we're waiting for
220 		 * is done, or the fscache_object is congested */
221 		wq = bit_waitqueue(&xobject->flags, CACHEFILES_OBJECT_ACTIVE);
222 		init_wait(&wait);
223 		requeue = false;
224 		do {
225 			prepare_to_wait(wq, &wait, TASK_UNINTERRUPTIBLE);
226 			if (!test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags))
227 				break;
228 
229 			requeue = fscache_object_sleep_till_congested(&timeout);
230 		} while (timeout > 0 && !requeue);
231 		finish_wait(wq, &wait);
232 
233 		if (requeue &&
234 		    test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags)) {
235 			_debug("queue OBJ%x behind OBJ%x after wait",
236 			       object->fscache.debug_id,
237 			       xobject->fscache.debug_id);
238 			goto requeue;
239 		}
240 
241 		if (timeout <= 0) {
242 			pr_err("\n");
243 			pr_err("Error: Overlong wait for old active object to go away\n");
244 			cachefiles_printk_object(object, xobject);
245 			goto requeue;
246 		}
247 	}
248 
249 	ASSERT(!test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags));
250 
251 	cache->cache.ops->put_object(&xobject->fscache);
252 	goto try_again;
253 
254 requeue:
255 	clear_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags);
256 	cache->cache.ops->put_object(&xobject->fscache);
257 	_leave(" = -ETIMEDOUT");
258 	return -ETIMEDOUT;
259 }
260 
261 /*
262  * Mark an object as being inactive.
263  */
264 void cachefiles_mark_object_inactive(struct cachefiles_cache *cache,
265 				     struct cachefiles_object *object,
266 				     blkcnt_t i_blocks)
267 {
268 	write_lock(&cache->active_lock);
269 	rb_erase(&object->active_node, &cache->active_nodes);
270 	clear_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags);
271 	write_unlock(&cache->active_lock);
272 
273 	wake_up_bit(&object->flags, CACHEFILES_OBJECT_ACTIVE);
274 
275 	/* This object can now be culled, so we need to let the daemon know
276 	 * that there is something it can remove if it needs to.
277 	 */
278 	atomic_long_add(i_blocks, &cache->b_released);
279 	if (atomic_inc_return(&cache->f_released))
280 		cachefiles_state_changed(cache);
281 }
282 
283 /*
284  * delete an object representation from the cache
285  * - file backed objects are unlinked
286  * - directory backed objects are stuffed into the graveyard for userspace to
287  *   delete
288  * - unlocks the directory mutex
289  */
290 static int cachefiles_bury_object(struct cachefiles_cache *cache,
291 				  struct dentry *dir,
292 				  struct dentry *rep,
293 				  bool preemptive,
294 				  enum fscache_why_object_killed why)
295 {
296 	struct dentry *grave, *trap;
297 	struct path path, path_to_graveyard;
298 	char nbuffer[8 + 8 + 1];
299 	int ret;
300 
301 	_enter(",'%pd','%pd'", dir, rep);
302 
303 	_debug("remove %p from %p", rep, dir);
304 
305 	/* non-directories can just be unlinked */
306 	if (!d_is_dir(rep)) {
307 		_debug("unlink stale object");
308 
309 		path.mnt = cache->mnt;
310 		path.dentry = dir;
311 		ret = security_path_unlink(&path, rep);
312 		if (ret < 0) {
313 			cachefiles_io_error(cache, "Unlink security error");
314 		} else {
315 			ret = vfs_unlink(d_inode(dir), rep, NULL);
316 
317 			if (preemptive)
318 				cachefiles_mark_object_buried(cache, rep, why);
319 		}
320 
321 		inode_unlock(d_inode(dir));
322 
323 		if (ret == -EIO)
324 			cachefiles_io_error(cache, "Unlink failed");
325 
326 		_leave(" = %d", ret);
327 		return ret;
328 	}
329 
330 	/* directories have to be moved to the graveyard */
331 	_debug("move stale object to graveyard");
332 	inode_unlock(d_inode(dir));
333 
334 try_again:
335 	/* first step is to make up a grave dentry in the graveyard */
336 	sprintf(nbuffer, "%08x%08x",
337 		(uint32_t) get_seconds(),
338 		(uint32_t) atomic_inc_return(&cache->gravecounter));
339 
340 	/* do the multiway lock magic */
341 	trap = lock_rename(cache->graveyard, dir);
342 
343 	/* do some checks before getting the grave dentry */
344 	if (rep->d_parent != dir) {
345 		/* the entry was probably culled when we dropped the parent dir
346 		 * lock */
347 		unlock_rename(cache->graveyard, dir);
348 		_leave(" = 0 [culled?]");
349 		return 0;
350 	}
351 
352 	if (!d_can_lookup(cache->graveyard)) {
353 		unlock_rename(cache->graveyard, dir);
354 		cachefiles_io_error(cache, "Graveyard no longer a directory");
355 		return -EIO;
356 	}
357 
358 	if (trap == rep) {
359 		unlock_rename(cache->graveyard, dir);
360 		cachefiles_io_error(cache, "May not make directory loop");
361 		return -EIO;
362 	}
363 
364 	if (d_mountpoint(rep)) {
365 		unlock_rename(cache->graveyard, dir);
366 		cachefiles_io_error(cache, "Mountpoint in cache");
367 		return -EIO;
368 	}
369 
370 	grave = lookup_one_len(nbuffer, cache->graveyard, strlen(nbuffer));
371 	if (IS_ERR(grave)) {
372 		unlock_rename(cache->graveyard, dir);
373 
374 		if (PTR_ERR(grave) == -ENOMEM) {
375 			_leave(" = -ENOMEM");
376 			return -ENOMEM;
377 		}
378 
379 		cachefiles_io_error(cache, "Lookup error %ld",
380 				    PTR_ERR(grave));
381 		return -EIO;
382 	}
383 
384 	if (d_is_positive(grave)) {
385 		unlock_rename(cache->graveyard, dir);
386 		dput(grave);
387 		grave = NULL;
388 		cond_resched();
389 		goto try_again;
390 	}
391 
392 	if (d_mountpoint(grave)) {
393 		unlock_rename(cache->graveyard, dir);
394 		dput(grave);
395 		cachefiles_io_error(cache, "Mountpoint in graveyard");
396 		return -EIO;
397 	}
398 
399 	/* target should not be an ancestor of source */
400 	if (trap == grave) {
401 		unlock_rename(cache->graveyard, dir);
402 		dput(grave);
403 		cachefiles_io_error(cache, "May not make directory loop");
404 		return -EIO;
405 	}
406 
407 	/* attempt the rename */
408 	path.mnt = cache->mnt;
409 	path.dentry = dir;
410 	path_to_graveyard.mnt = cache->mnt;
411 	path_to_graveyard.dentry = cache->graveyard;
412 	ret = security_path_rename(&path, rep, &path_to_graveyard, grave, 0);
413 	if (ret < 0) {
414 		cachefiles_io_error(cache, "Rename security error %d", ret);
415 	} else {
416 		ret = vfs_rename(d_inode(dir), rep,
417 				 d_inode(cache->graveyard), grave, NULL, 0);
418 		if (ret != 0 && ret != -ENOMEM)
419 			cachefiles_io_error(cache,
420 					    "Rename failed with error %d", ret);
421 
422 		if (preemptive)
423 			cachefiles_mark_object_buried(cache, rep, why);
424 	}
425 
426 	unlock_rename(cache->graveyard, dir);
427 	dput(grave);
428 	_leave(" = 0");
429 	return 0;
430 }
431 
432 /*
433  * delete an object representation from the cache
434  */
435 int cachefiles_delete_object(struct cachefiles_cache *cache,
436 			     struct cachefiles_object *object)
437 {
438 	struct dentry *dir;
439 	int ret;
440 
441 	_enter(",OBJ%x{%p}", object->fscache.debug_id, object->dentry);
442 
443 	ASSERT(object->dentry);
444 	ASSERT(d_backing_inode(object->dentry));
445 	ASSERT(object->dentry->d_parent);
446 
447 	dir = dget_parent(object->dentry);
448 
449 	inode_lock_nested(d_inode(dir), I_MUTEX_PARENT);
450 
451 	if (test_bit(FSCACHE_OBJECT_KILLED_BY_CACHE, &object->fscache.flags)) {
452 		/* object allocation for the same key preemptively deleted this
453 		 * object's file so that it could create its own file */
454 		_debug("object preemptively buried");
455 		inode_unlock(d_inode(dir));
456 		ret = 0;
457 	} else {
458 		/* we need to check that our parent is _still_ our parent - it
459 		 * may have been renamed */
460 		if (dir == object->dentry->d_parent) {
461 			ret = cachefiles_bury_object(cache, dir,
462 						     object->dentry, false,
463 						     FSCACHE_OBJECT_WAS_RETIRED);
464 		} else {
465 			/* it got moved, presumably by cachefilesd culling it,
466 			 * so it's no longer in the key path and we can ignore
467 			 * it */
468 			inode_unlock(d_inode(dir));
469 			ret = 0;
470 		}
471 	}
472 
473 	dput(dir);
474 	_leave(" = %d", ret);
475 	return ret;
476 }
477 
478 /*
479  * walk from the parent object to the child object through the backing
480  * filesystem, creating directories as we go
481  */
482 int cachefiles_walk_to_object(struct cachefiles_object *parent,
483 			      struct cachefiles_object *object,
484 			      const char *key,
485 			      struct cachefiles_xattr *auxdata)
486 {
487 	struct cachefiles_cache *cache;
488 	struct dentry *dir, *next = NULL;
489 	struct path path;
490 	unsigned long start;
491 	const char *name;
492 	int ret, nlen;
493 
494 	_enter("OBJ%x{%p},OBJ%x,%s,",
495 	       parent->fscache.debug_id, parent->dentry,
496 	       object->fscache.debug_id, key);
497 
498 	cache = container_of(parent->fscache.cache,
499 			     struct cachefiles_cache, cache);
500 	path.mnt = cache->mnt;
501 
502 	ASSERT(parent->dentry);
503 	ASSERT(d_backing_inode(parent->dentry));
504 
505 	if (!(d_is_dir(parent->dentry))) {
506 		// TODO: convert file to dir
507 		_leave("looking up in none directory");
508 		return -ENOBUFS;
509 	}
510 
511 	dir = dget(parent->dentry);
512 
513 advance:
514 	/* attempt to transit the first directory component */
515 	name = key;
516 	nlen = strlen(key);
517 
518 	/* key ends in a double NUL */
519 	key = key + nlen + 1;
520 	if (!*key)
521 		key = NULL;
522 
523 lookup_again:
524 	/* search the current directory for the element name */
525 	_debug("lookup '%s'", name);
526 
527 	inode_lock_nested(d_inode(dir), I_MUTEX_PARENT);
528 
529 	start = jiffies;
530 	next = lookup_one_len(name, dir, nlen);
531 	cachefiles_hist(cachefiles_lookup_histogram, start);
532 	if (IS_ERR(next))
533 		goto lookup_error;
534 
535 	_debug("next -> %p %s", next, d_backing_inode(next) ? "positive" : "negative");
536 
537 	if (!key)
538 		object->new = !d_backing_inode(next);
539 
540 	/* if this element of the path doesn't exist, then the lookup phase
541 	 * failed, and we can release any readers in the certain knowledge that
542 	 * there's nothing for them to actually read */
543 	if (d_is_negative(next))
544 		fscache_object_lookup_negative(&object->fscache);
545 
546 	/* we need to create the object if it's negative */
547 	if (key || object->type == FSCACHE_COOKIE_TYPE_INDEX) {
548 		/* index objects and intervening tree levels must be subdirs */
549 		if (d_is_negative(next)) {
550 			ret = cachefiles_has_space(cache, 1, 0);
551 			if (ret < 0)
552 				goto no_space_error;
553 
554 			path.dentry = dir;
555 			ret = security_path_mkdir(&path, next, 0);
556 			if (ret < 0)
557 				goto create_error;
558 			start = jiffies;
559 			ret = vfs_mkdir(d_inode(dir), next, 0);
560 			cachefiles_hist(cachefiles_mkdir_histogram, start);
561 			if (ret < 0)
562 				goto create_error;
563 
564 			ASSERT(d_backing_inode(next));
565 
566 			_debug("mkdir -> %p{%p{ino=%lu}}",
567 			       next, d_backing_inode(next), d_backing_inode(next)->i_ino);
568 
569 		} else if (!d_can_lookup(next)) {
570 			pr_err("inode %lu is not a directory\n",
571 			       d_backing_inode(next)->i_ino);
572 			ret = -ENOBUFS;
573 			goto error;
574 		}
575 
576 	} else {
577 		/* non-index objects start out life as files */
578 		if (d_is_negative(next)) {
579 			ret = cachefiles_has_space(cache, 1, 0);
580 			if (ret < 0)
581 				goto no_space_error;
582 
583 			path.dentry = dir;
584 			ret = security_path_mknod(&path, next, S_IFREG, 0);
585 			if (ret < 0)
586 				goto create_error;
587 			start = jiffies;
588 			ret = vfs_create(d_inode(dir), next, S_IFREG, true);
589 			cachefiles_hist(cachefiles_create_histogram, start);
590 			if (ret < 0)
591 				goto create_error;
592 
593 			ASSERT(d_backing_inode(next));
594 
595 			_debug("create -> %p{%p{ino=%lu}}",
596 			       next, d_backing_inode(next), d_backing_inode(next)->i_ino);
597 
598 		} else if (!d_can_lookup(next) &&
599 			   !d_is_reg(next)
600 			   ) {
601 			pr_err("inode %lu is not a file or directory\n",
602 			       d_backing_inode(next)->i_ino);
603 			ret = -ENOBUFS;
604 			goto error;
605 		}
606 	}
607 
608 	/* process the next component */
609 	if (key) {
610 		_debug("advance");
611 		inode_unlock(d_inode(dir));
612 		dput(dir);
613 		dir = next;
614 		next = NULL;
615 		goto advance;
616 	}
617 
618 	/* we've found the object we were looking for */
619 	object->dentry = next;
620 
621 	/* if we've found that the terminal object exists, then we need to
622 	 * check its attributes and delete it if it's out of date */
623 	if (!object->new) {
624 		_debug("validate '%pd'", next);
625 
626 		ret = cachefiles_check_object_xattr(object, auxdata);
627 		if (ret == -ESTALE) {
628 			/* delete the object (the deleter drops the directory
629 			 * mutex) */
630 			object->dentry = NULL;
631 
632 			ret = cachefiles_bury_object(cache, dir, next, true,
633 						     FSCACHE_OBJECT_IS_STALE);
634 			dput(next);
635 			next = NULL;
636 
637 			if (ret < 0)
638 				goto delete_error;
639 
640 			_debug("redo lookup");
641 			fscache_object_retrying_stale(&object->fscache);
642 			goto lookup_again;
643 		}
644 	}
645 
646 	/* note that we're now using this object */
647 	ret = cachefiles_mark_object_active(cache, object);
648 
649 	inode_unlock(d_inode(dir));
650 	dput(dir);
651 	dir = NULL;
652 
653 	if (ret == -ETIMEDOUT)
654 		goto mark_active_timed_out;
655 
656 	_debug("=== OBTAINED_OBJECT ===");
657 
658 	if (object->new) {
659 		/* attach data to a newly constructed terminal object */
660 		ret = cachefiles_set_object_xattr(object, auxdata);
661 		if (ret < 0)
662 			goto check_error;
663 	} else {
664 		/* always update the atime on an object we've just looked up
665 		 * (this is used to keep track of culling, and atimes are only
666 		 * updated by read, write and readdir but not lookup or
667 		 * open) */
668 		path.dentry = next;
669 		touch_atime(&path);
670 	}
671 
672 	/* open a file interface onto a data file */
673 	if (object->type != FSCACHE_COOKIE_TYPE_INDEX) {
674 		if (d_is_reg(object->dentry)) {
675 			const struct address_space_operations *aops;
676 
677 			ret = -EPERM;
678 			aops = d_backing_inode(object->dentry)->i_mapping->a_ops;
679 			if (!aops->bmap)
680 				goto check_error;
681 			if (object->dentry->d_sb->s_blocksize > PAGE_SIZE)
682 				goto check_error;
683 
684 			object->backer = object->dentry;
685 		} else {
686 			BUG(); // TODO: open file in data-class subdir
687 		}
688 	}
689 
690 	object->new = 0;
691 	fscache_obtained_object(&object->fscache);
692 
693 	_leave(" = 0 [%lu]", d_backing_inode(object->dentry)->i_ino);
694 	return 0;
695 
696 no_space_error:
697 	fscache_object_mark_killed(&object->fscache, FSCACHE_OBJECT_NO_SPACE);
698 create_error:
699 	_debug("create error %d", ret);
700 	if (ret == -EIO)
701 		cachefiles_io_error(cache, "Create/mkdir failed");
702 	goto error;
703 
704 mark_active_timed_out:
705 	_debug("mark active timed out");
706 	goto release_dentry;
707 
708 check_error:
709 	_debug("check error %d", ret);
710 	cachefiles_mark_object_inactive(
711 		cache, object, d_backing_inode(object->dentry)->i_blocks);
712 release_dentry:
713 	dput(object->dentry);
714 	object->dentry = NULL;
715 	goto error_out;
716 
717 delete_error:
718 	_debug("delete error %d", ret);
719 	goto error_out2;
720 
721 lookup_error:
722 	_debug("lookup error %ld", PTR_ERR(next));
723 	ret = PTR_ERR(next);
724 	if (ret == -EIO)
725 		cachefiles_io_error(cache, "Lookup failed");
726 	next = NULL;
727 error:
728 	inode_unlock(d_inode(dir));
729 	dput(next);
730 error_out2:
731 	dput(dir);
732 error_out:
733 	_leave(" = error %d", -ret);
734 	return ret;
735 }
736 
737 /*
738  * get a subdirectory
739  */
740 struct dentry *cachefiles_get_directory(struct cachefiles_cache *cache,
741 					struct dentry *dir,
742 					const char *dirname)
743 {
744 	struct dentry *subdir;
745 	unsigned long start;
746 	struct path path;
747 	int ret;
748 
749 	_enter(",,%s", dirname);
750 
751 	/* search the current directory for the element name */
752 	inode_lock(d_inode(dir));
753 
754 	start = jiffies;
755 	subdir = lookup_one_len(dirname, dir, strlen(dirname));
756 	cachefiles_hist(cachefiles_lookup_histogram, start);
757 	if (IS_ERR(subdir)) {
758 		if (PTR_ERR(subdir) == -ENOMEM)
759 			goto nomem_d_alloc;
760 		goto lookup_error;
761 	}
762 
763 	_debug("subdir -> %p %s",
764 	       subdir, d_backing_inode(subdir) ? "positive" : "negative");
765 
766 	/* we need to create the subdir if it doesn't exist yet */
767 	if (d_is_negative(subdir)) {
768 		ret = cachefiles_has_space(cache, 1, 0);
769 		if (ret < 0)
770 			goto mkdir_error;
771 
772 		_debug("attempt mkdir");
773 
774 		path.mnt = cache->mnt;
775 		path.dentry = dir;
776 		ret = security_path_mkdir(&path, subdir, 0700);
777 		if (ret < 0)
778 			goto mkdir_error;
779 		ret = vfs_mkdir(d_inode(dir), subdir, 0700);
780 		if (ret < 0)
781 			goto mkdir_error;
782 
783 		ASSERT(d_backing_inode(subdir));
784 
785 		_debug("mkdir -> %p{%p{ino=%lu}}",
786 		       subdir,
787 		       d_backing_inode(subdir),
788 		       d_backing_inode(subdir)->i_ino);
789 	}
790 
791 	inode_unlock(d_inode(dir));
792 
793 	/* we need to make sure the subdir is a directory */
794 	ASSERT(d_backing_inode(subdir));
795 
796 	if (!d_can_lookup(subdir)) {
797 		pr_err("%s is not a directory\n", dirname);
798 		ret = -EIO;
799 		goto check_error;
800 	}
801 
802 	ret = -EPERM;
803 	if (!(d_backing_inode(subdir)->i_opflags & IOP_XATTR) ||
804 	    !d_backing_inode(subdir)->i_op->lookup ||
805 	    !d_backing_inode(subdir)->i_op->mkdir ||
806 	    !d_backing_inode(subdir)->i_op->create ||
807 	    !d_backing_inode(subdir)->i_op->rename ||
808 	    !d_backing_inode(subdir)->i_op->rmdir ||
809 	    !d_backing_inode(subdir)->i_op->unlink)
810 		goto check_error;
811 
812 	_leave(" = [%lu]", d_backing_inode(subdir)->i_ino);
813 	return subdir;
814 
815 check_error:
816 	dput(subdir);
817 	_leave(" = %d [check]", ret);
818 	return ERR_PTR(ret);
819 
820 mkdir_error:
821 	inode_unlock(d_inode(dir));
822 	dput(subdir);
823 	pr_err("mkdir %s failed with error %d\n", dirname, ret);
824 	return ERR_PTR(ret);
825 
826 lookup_error:
827 	inode_unlock(d_inode(dir));
828 	ret = PTR_ERR(subdir);
829 	pr_err("Lookup %s failed with error %d\n", dirname, ret);
830 	return ERR_PTR(ret);
831 
832 nomem_d_alloc:
833 	inode_unlock(d_inode(dir));
834 	_leave(" = -ENOMEM");
835 	return ERR_PTR(-ENOMEM);
836 }
837 
838 /*
839  * find out if an object is in use or not
840  * - if finds object and it's not in use:
841  *   - returns a pointer to the object and a reference on it
842  *   - returns with the directory locked
843  */
844 static struct dentry *cachefiles_check_active(struct cachefiles_cache *cache,
845 					      struct dentry *dir,
846 					      char *filename)
847 {
848 	struct cachefiles_object *object;
849 	struct rb_node *_n;
850 	struct dentry *victim;
851 	unsigned long start;
852 	int ret;
853 
854 	//_enter(",%pd/,%s",
855 	//       dir, filename);
856 
857 	/* look up the victim */
858 	inode_lock_nested(d_inode(dir), I_MUTEX_PARENT);
859 
860 	start = jiffies;
861 	victim = lookup_one_len(filename, dir, strlen(filename));
862 	cachefiles_hist(cachefiles_lookup_histogram, start);
863 	if (IS_ERR(victim))
864 		goto lookup_error;
865 
866 	//_debug("victim -> %p %s",
867 	//       victim, d_backing_inode(victim) ? "positive" : "negative");
868 
869 	/* if the object is no longer there then we probably retired the object
870 	 * at the netfs's request whilst the cull was in progress
871 	 */
872 	if (d_is_negative(victim)) {
873 		inode_unlock(d_inode(dir));
874 		dput(victim);
875 		_leave(" = -ENOENT [absent]");
876 		return ERR_PTR(-ENOENT);
877 	}
878 
879 	/* check to see if we're using this object */
880 	read_lock(&cache->active_lock);
881 
882 	_n = cache->active_nodes.rb_node;
883 
884 	while (_n) {
885 		object = rb_entry(_n, struct cachefiles_object, active_node);
886 
887 		if (object->dentry > victim)
888 			_n = _n->rb_left;
889 		else if (object->dentry < victim)
890 			_n = _n->rb_right;
891 		else
892 			goto object_in_use;
893 	}
894 
895 	read_unlock(&cache->active_lock);
896 
897 	//_leave(" = %p", victim);
898 	return victim;
899 
900 object_in_use:
901 	read_unlock(&cache->active_lock);
902 	inode_unlock(d_inode(dir));
903 	dput(victim);
904 	//_leave(" = -EBUSY [in use]");
905 	return ERR_PTR(-EBUSY);
906 
907 lookup_error:
908 	inode_unlock(d_inode(dir));
909 	ret = PTR_ERR(victim);
910 	if (ret == -ENOENT) {
911 		/* file or dir now absent - probably retired by netfs */
912 		_leave(" = -ESTALE [absent]");
913 		return ERR_PTR(-ESTALE);
914 	}
915 
916 	if (ret == -EIO) {
917 		cachefiles_io_error(cache, "Lookup failed");
918 	} else if (ret != -ENOMEM) {
919 		pr_err("Internal error: %d\n", ret);
920 		ret = -EIO;
921 	}
922 
923 	_leave(" = %d", ret);
924 	return ERR_PTR(ret);
925 }
926 
927 /*
928  * cull an object if it's not in use
929  * - called only by cache manager daemon
930  */
931 int cachefiles_cull(struct cachefiles_cache *cache, struct dentry *dir,
932 		    char *filename)
933 {
934 	struct dentry *victim;
935 	int ret;
936 
937 	_enter(",%pd/,%s", dir, filename);
938 
939 	victim = cachefiles_check_active(cache, dir, filename);
940 	if (IS_ERR(victim))
941 		return PTR_ERR(victim);
942 
943 	_debug("victim -> %p %s",
944 	       victim, d_backing_inode(victim) ? "positive" : "negative");
945 
946 	/* okay... the victim is not being used so we can cull it
947 	 * - start by marking it as stale
948 	 */
949 	_debug("victim is cullable");
950 
951 	ret = cachefiles_remove_object_xattr(cache, victim);
952 	if (ret < 0)
953 		goto error_unlock;
954 
955 	/*  actually remove the victim (drops the dir mutex) */
956 	_debug("bury");
957 
958 	ret = cachefiles_bury_object(cache, dir, victim, false,
959 				     FSCACHE_OBJECT_WAS_CULLED);
960 	if (ret < 0)
961 		goto error;
962 
963 	dput(victim);
964 	_leave(" = 0");
965 	return 0;
966 
967 error_unlock:
968 	inode_unlock(d_inode(dir));
969 error:
970 	dput(victim);
971 	if (ret == -ENOENT) {
972 		/* file or dir now absent - probably retired by netfs */
973 		_leave(" = -ESTALE [absent]");
974 		return -ESTALE;
975 	}
976 
977 	if (ret != -ENOMEM) {
978 		pr_err("Internal error: %d\n", ret);
979 		ret = -EIO;
980 	}
981 
982 	_leave(" = %d", ret);
983 	return ret;
984 }
985 
986 /*
987  * find out if an object is in use or not
988  * - called only by cache manager daemon
989  * - returns -EBUSY or 0 to indicate whether an object is in use or not
990  */
991 int cachefiles_check_in_use(struct cachefiles_cache *cache, struct dentry *dir,
992 			    char *filename)
993 {
994 	struct dentry *victim;
995 
996 	//_enter(",%pd/,%s",
997 	//       dir, filename);
998 
999 	victim = cachefiles_check_active(cache, dir, filename);
1000 	if (IS_ERR(victim))
1001 		return PTR_ERR(victim);
1002 
1003 	inode_unlock(d_inode(dir));
1004 	dput(victim);
1005 	//_leave(" = 0");
1006 	return 0;
1007 }
1008