e1000e: DoS while TSO enabled caused by link partner with small MSS
[pandora-kernel.git] / fs / cachefiles / namei.c
1 /* CacheFiles path walking and related routines
2  *
3  * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
4  * Written by David Howells (dhowells@redhat.com)
5  *
6  * This program is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU General Public Licence
8  * as published by the Free Software Foundation; either version
9  * 2 of the Licence, or (at your option) any later version.
10  */
11
12 #include <linux/module.h>
13 #include <linux/sched.h>
14 #include <linux/file.h>
15 #include <linux/fs.h>
16 #include <linux/fsnotify.h>
17 #include <linux/quotaops.h>
18 #include <linux/xattr.h>
19 #include <linux/mount.h>
20 #include <linux/namei.h>
21 #include <linux/security.h>
22 #include <linux/slab.h>
23 #include "internal.h"
24
25 #define CACHEFILES_KEYBUF_SIZE 512
26
27 /*
28  * dump debugging info about an object
29  */
30 static noinline
31 void __cachefiles_printk_object(struct cachefiles_object *object,
32                                 const char *prefix,
33                                 u8 *keybuf)
34 {
35         struct fscache_cookie *cookie;
36         unsigned keylen, loop;
37
38         printk(KERN_ERR "%sobject: OBJ%x\n",
39                prefix, object->fscache.debug_id);
40         printk(KERN_ERR "%sobjstate=%s fl=%lx wbusy=%x ev=%lx[%lx]\n",
41                prefix, fscache_object_states[object->fscache.state],
42                object->fscache.flags, work_busy(&object->fscache.work),
43                object->fscache.events,
44                object->fscache.event_mask & FSCACHE_OBJECT_EVENTS_MASK);
45         printk(KERN_ERR "%sops=%u inp=%u exc=%u\n",
46                prefix, object->fscache.n_ops, object->fscache.n_in_progress,
47                object->fscache.n_exclusive);
48         printk(KERN_ERR "%sparent=%p\n",
49                prefix, object->fscache.parent);
50
51         spin_lock(&object->fscache.lock);
52         cookie = object->fscache.cookie;
53         if (cookie) {
54                 printk(KERN_ERR "%scookie=%p [pr=%p nd=%p fl=%lx]\n",
55                        prefix,
56                        object->fscache.cookie,
57                        object->fscache.cookie->parent,
58                        object->fscache.cookie->netfs_data,
59                        object->fscache.cookie->flags);
60                 if (keybuf)
61                         keylen = cookie->def->get_key(cookie->netfs_data, keybuf,
62                                                       CACHEFILES_KEYBUF_SIZE);
63                 else
64                         keylen = 0;
65         } else {
66                 printk(KERN_ERR "%scookie=NULL\n", prefix);
67                 keylen = 0;
68         }
69         spin_unlock(&object->fscache.lock);
70
71         if (keylen) {
72                 printk(KERN_ERR "%skey=[%u] '", prefix, keylen);
73                 for (loop = 0; loop < keylen; loop++)
74                         printk("%02x", keybuf[loop]);
75                 printk("'\n");
76         }
77 }
78
79 /*
80  * dump debugging info about a pair of objects
81  */
82 static noinline void cachefiles_printk_object(struct cachefiles_object *object,
83                                               struct cachefiles_object *xobject)
84 {
85         u8 *keybuf;
86
87         keybuf = kmalloc(CACHEFILES_KEYBUF_SIZE, GFP_NOIO);
88         if (object)
89                 __cachefiles_printk_object(object, "", keybuf);
90         if (xobject)
91                 __cachefiles_printk_object(xobject, "x", keybuf);
92         kfree(keybuf);
93 }
94
95 /*
96  * mark the owner of a dentry, if there is one, to indicate that that dentry
97  * has been preemptively deleted
98  * - the caller must hold the i_mutex on the dentry's parent as required to
99  *   call vfs_unlink(), vfs_rmdir() or vfs_rename()
100  */
101 static void cachefiles_mark_object_buried(struct cachefiles_cache *cache,
102                                           struct dentry *dentry)
103 {
104         struct cachefiles_object *object;
105         struct rb_node *p;
106
107         _enter(",'%*.*s'",
108                dentry->d_name.len, dentry->d_name.len, dentry->d_name.name);
109
110         write_lock(&cache->active_lock);
111
112         p = cache->active_nodes.rb_node;
113         while (p) {
114                 object = rb_entry(p, struct cachefiles_object, active_node);
115                 if (object->dentry > dentry)
116                         p = p->rb_left;
117                 else if (object->dentry < dentry)
118                         p = p->rb_right;
119                 else
120                         goto found_dentry;
121         }
122
123         write_unlock(&cache->active_lock);
124         _leave(" [no owner]");
125         return;
126
127         /* found the dentry for  */
128 found_dentry:
129         kdebug("preemptive burial: OBJ%x [%s] %p",
130                object->fscache.debug_id,
131                fscache_object_states[object->fscache.state],
132                dentry);
133
134         if (object->fscache.state < FSCACHE_OBJECT_DYING) {
135                 printk(KERN_ERR "\n");
136                 printk(KERN_ERR "CacheFiles: Error:"
137                        " Can't preemptively bury live object\n");
138                 cachefiles_printk_object(object, NULL);
139         } else if (test_and_set_bit(CACHEFILES_OBJECT_BURIED, &object->flags)) {
140                 printk(KERN_ERR "CacheFiles: Error:"
141                        " Object already preemptively buried\n");
142         }
143
144         write_unlock(&cache->active_lock);
145         _leave(" [owner marked]");
146 }
147
148 /*
149  * record the fact that an object is now active
150  */
151 static int cachefiles_mark_object_active(struct cachefiles_cache *cache,
152                                          struct cachefiles_object *object)
153 {
154         struct cachefiles_object *xobject;
155         struct rb_node **_p, *_parent = NULL;
156         struct dentry *dentry;
157
158         _enter(",%p", object);
159
160 try_again:
161         write_lock(&cache->active_lock);
162
163         if (test_and_set_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags)) {
164                 printk(KERN_ERR "CacheFiles: Error: Object already active\n");
165                 cachefiles_printk_object(object, NULL);
166                 BUG();
167         }
168
169         dentry = object->dentry;
170         _p = &cache->active_nodes.rb_node;
171         while (*_p) {
172                 _parent = *_p;
173                 xobject = rb_entry(_parent,
174                                    struct cachefiles_object, active_node);
175
176                 ASSERT(xobject != object);
177
178                 if (xobject->dentry > dentry)
179                         _p = &(*_p)->rb_left;
180                 else if (xobject->dentry < dentry)
181                         _p = &(*_p)->rb_right;
182                 else
183                         goto wait_for_old_object;
184         }
185
186         rb_link_node(&object->active_node, _parent, _p);
187         rb_insert_color(&object->active_node, &cache->active_nodes);
188
189         write_unlock(&cache->active_lock);
190         _leave(" = 0");
191         return 0;
192
193         /* an old object from a previous incarnation is hogging the slot - we
194          * need to wait for it to be destroyed */
195 wait_for_old_object:
196         if (xobject->fscache.state < FSCACHE_OBJECT_DYING) {
197                 printk(KERN_ERR "\n");
198                 printk(KERN_ERR "CacheFiles: Error:"
199                        " Unexpected object collision\n");
200                 cachefiles_printk_object(object, xobject);
201                 BUG();
202         }
203         atomic_inc(&xobject->usage);
204         write_unlock(&cache->active_lock);
205
206         if (test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags)) {
207                 wait_queue_head_t *wq;
208
209                 signed long timeout = 60 * HZ;
210                 wait_queue_t wait;
211                 bool requeue;
212
213                 /* if the object we're waiting for is queued for processing,
214                  * then just put ourselves on the queue behind it */
215                 if (work_pending(&xobject->fscache.work)) {
216                         _debug("queue OBJ%x behind OBJ%x immediately",
217                                object->fscache.debug_id,
218                                xobject->fscache.debug_id);
219                         goto requeue;
220                 }
221
222                 /* otherwise we sleep until either the object we're waiting for
223                  * is done, or the fscache_object is congested */
224                 wq = bit_waitqueue(&xobject->flags, CACHEFILES_OBJECT_ACTIVE);
225                 init_wait(&wait);
226                 requeue = false;
227                 do {
228                         prepare_to_wait(wq, &wait, TASK_UNINTERRUPTIBLE);
229                         if (!test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags))
230                                 break;
231
232                         requeue = fscache_object_sleep_till_congested(&timeout);
233                 } while (timeout > 0 && !requeue);
234                 finish_wait(wq, &wait);
235
236                 if (requeue &&
237                     test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags)) {
238                         _debug("queue OBJ%x behind OBJ%x after wait",
239                                object->fscache.debug_id,
240                                xobject->fscache.debug_id);
241                         goto requeue;
242                 }
243
244                 if (timeout <= 0) {
245                         printk(KERN_ERR "\n");
246                         printk(KERN_ERR "CacheFiles: Error: Overlong"
247                                " wait for old active object to go away\n");
248                         cachefiles_printk_object(object, xobject);
249                         goto requeue;
250                 }
251         }
252
253         ASSERT(!test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags));
254
255         cache->cache.ops->put_object(&xobject->fscache);
256         goto try_again;
257
258 requeue:
259         clear_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags);
260         cache->cache.ops->put_object(&xobject->fscache);
261         _leave(" = -ETIMEDOUT");
262         return -ETIMEDOUT;
263 }
264
265 /*
266  * delete an object representation from the cache
267  * - file backed objects are unlinked
268  * - directory backed objects are stuffed into the graveyard for userspace to
269  *   delete
270  * - unlocks the directory mutex
271  */
272 static int cachefiles_bury_object(struct cachefiles_cache *cache,
273                                   struct dentry *dir,
274                                   struct dentry *rep,
275                                   bool preemptive)
276 {
277         struct dentry *grave, *trap;
278         struct path path, path_to_graveyard;
279         char nbuffer[8 + 8 + 1];
280         int ret;
281
282         _enter(",'%*.*s','%*.*s'",
283                dir->d_name.len, dir->d_name.len, dir->d_name.name,
284                rep->d_name.len, rep->d_name.len, rep->d_name.name);
285
286         _debug("remove %p from %p", rep, dir);
287
288         /* non-directories can just be unlinked */
289         if (!S_ISDIR(rep->d_inode->i_mode)) {
290                 _debug("unlink stale object");
291
292                 path.mnt = cache->mnt;
293                 path.dentry = dir;
294                 ret = security_path_unlink(&path, rep);
295                 if (ret < 0) {
296                         cachefiles_io_error(cache, "Unlink security error");
297                 } else {
298                         ret = vfs_unlink(dir->d_inode, rep);
299
300                         if (preemptive)
301                                 cachefiles_mark_object_buried(cache, rep);
302                 }
303
304                 mutex_unlock(&dir->d_inode->i_mutex);
305
306                 if (ret == -EIO)
307                         cachefiles_io_error(cache, "Unlink failed");
308
309                 _leave(" = %d", ret);
310                 return ret;
311         }
312
313         /* directories have to be moved to the graveyard */
314         _debug("move stale object to graveyard");
315         mutex_unlock(&dir->d_inode->i_mutex);
316
317 try_again:
318         /* first step is to make up a grave dentry in the graveyard */
319         sprintf(nbuffer, "%08x%08x",
320                 (uint32_t) get_seconds(),
321                 (uint32_t) atomic_inc_return(&cache->gravecounter));
322
323         /* do the multiway lock magic */
324         trap = lock_rename(cache->graveyard, dir);
325
326         /* do some checks before getting the grave dentry */
327         if (rep->d_parent != dir) {
328                 /* the entry was probably culled when we dropped the parent dir
329                  * lock */
330                 unlock_rename(cache->graveyard, dir);
331                 _leave(" = 0 [culled?]");
332                 return 0;
333         }
334
335         if (!S_ISDIR(cache->graveyard->d_inode->i_mode)) {
336                 unlock_rename(cache->graveyard, dir);
337                 cachefiles_io_error(cache, "Graveyard no longer a directory");
338                 return -EIO;
339         }
340
341         if (trap == rep) {
342                 unlock_rename(cache->graveyard, dir);
343                 cachefiles_io_error(cache, "May not make directory loop");
344                 return -EIO;
345         }
346
347         if (d_mountpoint(rep)) {
348                 unlock_rename(cache->graveyard, dir);
349                 cachefiles_io_error(cache, "Mountpoint in cache");
350                 return -EIO;
351         }
352
353         grave = lookup_one_len(nbuffer, cache->graveyard, strlen(nbuffer));
354         if (IS_ERR(grave)) {
355                 unlock_rename(cache->graveyard, dir);
356
357                 if (PTR_ERR(grave) == -ENOMEM) {
358                         _leave(" = -ENOMEM");
359                         return -ENOMEM;
360                 }
361
362                 cachefiles_io_error(cache, "Lookup error %ld",
363                                     PTR_ERR(grave));
364                 return -EIO;
365         }
366
367         if (grave->d_inode) {
368                 unlock_rename(cache->graveyard, dir);
369                 dput(grave);
370                 grave = NULL;
371                 cond_resched();
372                 goto try_again;
373         }
374
375         if (d_mountpoint(grave)) {
376                 unlock_rename(cache->graveyard, dir);
377                 dput(grave);
378                 cachefiles_io_error(cache, "Mountpoint in graveyard");
379                 return -EIO;
380         }
381
382         /* target should not be an ancestor of source */
383         if (trap == grave) {
384                 unlock_rename(cache->graveyard, dir);
385                 dput(grave);
386                 cachefiles_io_error(cache, "May not make directory loop");
387                 return -EIO;
388         }
389
390         /* attempt the rename */
391         path.mnt = cache->mnt;
392         path.dentry = dir;
393         path_to_graveyard.mnt = cache->mnt;
394         path_to_graveyard.dentry = cache->graveyard;
395         ret = security_path_rename(&path, rep, &path_to_graveyard, grave);
396         if (ret < 0) {
397                 cachefiles_io_error(cache, "Rename security error %d", ret);
398         } else {
399                 ret = vfs_rename(dir->d_inode, rep,
400                                  cache->graveyard->d_inode, grave);
401                 if (ret != 0 && ret != -ENOMEM)
402                         cachefiles_io_error(cache,
403                                             "Rename failed with error %d", ret);
404
405                 if (preemptive)
406                         cachefiles_mark_object_buried(cache, rep);
407         }
408
409         unlock_rename(cache->graveyard, dir);
410         dput(grave);
411         _leave(" = 0");
412         return 0;
413 }
414
415 /*
416  * delete an object representation from the cache
417  */
418 int cachefiles_delete_object(struct cachefiles_cache *cache,
419                              struct cachefiles_object *object)
420 {
421         struct dentry *dir;
422         int ret;
423
424         _enter(",OBJ%x{%p}", object->fscache.debug_id, object->dentry);
425
426         ASSERT(object->dentry);
427         ASSERT(object->dentry->d_inode);
428         ASSERT(object->dentry->d_parent);
429
430         dir = dget_parent(object->dentry);
431
432         mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_PARENT);
433
434         if (test_bit(CACHEFILES_OBJECT_BURIED, &object->flags)) {
435                 /* object allocation for the same key preemptively deleted this
436                  * object's file so that it could create its own file */
437                 _debug("object preemptively buried");
438                 mutex_unlock(&dir->d_inode->i_mutex);
439                 ret = 0;
440         } else {
441                 /* we need to check that our parent is _still_ our parent - it
442                  * may have been renamed */
443                 if (dir == object->dentry->d_parent) {
444                         ret = cachefiles_bury_object(cache, dir,
445                                                      object->dentry, false);
446                 } else {
447                         /* it got moved, presumably by cachefilesd culling it,
448                          * so it's no longer in the key path and we can ignore
449                          * it */
450                         mutex_unlock(&dir->d_inode->i_mutex);
451                         ret = 0;
452                 }
453         }
454
455         dput(dir);
456         _leave(" = %d", ret);
457         return ret;
458 }
459
460 /*
461  * walk from the parent object to the child object through the backing
462  * filesystem, creating directories as we go
463  */
464 int cachefiles_walk_to_object(struct cachefiles_object *parent,
465                               struct cachefiles_object *object,
466                               const char *key,
467                               struct cachefiles_xattr *auxdata)
468 {
469         struct cachefiles_cache *cache;
470         struct dentry *dir, *next = NULL;
471         struct path path;
472         unsigned long start;
473         const char *name;
474         int ret, nlen;
475
476         _enter("OBJ%x{%p},OBJ%x,%s,",
477                parent->fscache.debug_id, parent->dentry,
478                object->fscache.debug_id, key);
479
480         cache = container_of(parent->fscache.cache,
481                              struct cachefiles_cache, cache);
482         path.mnt = cache->mnt;
483
484         ASSERT(parent->dentry);
485         ASSERT(parent->dentry->d_inode);
486
487         if (!(S_ISDIR(parent->dentry->d_inode->i_mode))) {
488                 // TODO: convert file to dir
489                 _leave("looking up in none directory");
490                 return -ENOBUFS;
491         }
492
493         dir = dget(parent->dentry);
494
495 advance:
496         /* attempt to transit the first directory component */
497         name = key;
498         nlen = strlen(key);
499
500         /* key ends in a double NUL */
501         key = key + nlen + 1;
502         if (!*key)
503                 key = NULL;
504
505 lookup_again:
506         /* search the current directory for the element name */
507         _debug("lookup '%s'", name);
508
509         mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_PARENT);
510
511         start = jiffies;
512         next = lookup_one_len(name, dir, nlen);
513         cachefiles_hist(cachefiles_lookup_histogram, start);
514         if (IS_ERR(next))
515                 goto lookup_error;
516
517         _debug("next -> %p %s", next, next->d_inode ? "positive" : "negative");
518
519         if (!key)
520                 object->new = !next->d_inode;
521
522         /* if this element of the path doesn't exist, then the lookup phase
523          * failed, and we can release any readers in the certain knowledge that
524          * there's nothing for them to actually read */
525         if (!next->d_inode)
526                 fscache_object_lookup_negative(&object->fscache);
527
528         /* we need to create the object if it's negative */
529         if (key || object->type == FSCACHE_COOKIE_TYPE_INDEX) {
530                 /* index objects and intervening tree levels must be subdirs */
531                 if (!next->d_inode) {
532                         ret = cachefiles_has_space(cache, 1, 0);
533                         if (ret < 0)
534                                 goto create_error;
535
536                         path.dentry = dir;
537                         ret = security_path_mkdir(&path, next, 0);
538                         if (ret < 0)
539                                 goto create_error;
540                         start = jiffies;
541                         ret = vfs_mkdir(dir->d_inode, next, 0);
542                         cachefiles_hist(cachefiles_mkdir_histogram, start);
543                         if (ret < 0)
544                                 goto create_error;
545
546                         ASSERT(next->d_inode);
547
548                         _debug("mkdir -> %p{%p{ino=%lu}}",
549                                next, next->d_inode, next->d_inode->i_ino);
550
551                 } else if (!S_ISDIR(next->d_inode->i_mode)) {
552                         kerror("inode %lu is not a directory",
553                                next->d_inode->i_ino);
554                         ret = -ENOBUFS;
555                         goto error;
556                 }
557
558         } else {
559                 /* non-index objects start out life as files */
560                 if (!next->d_inode) {
561                         ret = cachefiles_has_space(cache, 1, 0);
562                         if (ret < 0)
563                                 goto create_error;
564
565                         path.dentry = dir;
566                         ret = security_path_mknod(&path, next, S_IFREG, 0);
567                         if (ret < 0)
568                                 goto create_error;
569                         start = jiffies;
570                         ret = vfs_create(dir->d_inode, next, S_IFREG, NULL);
571                         cachefiles_hist(cachefiles_create_histogram, start);
572                         if (ret < 0)
573                                 goto create_error;
574
575                         ASSERT(next->d_inode);
576
577                         _debug("create -> %p{%p{ino=%lu}}",
578                                next, next->d_inode, next->d_inode->i_ino);
579
580                 } else if (!S_ISDIR(next->d_inode->i_mode) &&
581                            !S_ISREG(next->d_inode->i_mode)
582                            ) {
583                         kerror("inode %lu is not a file or directory",
584                                next->d_inode->i_ino);
585                         ret = -ENOBUFS;
586                         goto error;
587                 }
588         }
589
590         /* process the next component */
591         if (key) {
592                 _debug("advance");
593                 mutex_unlock(&dir->d_inode->i_mutex);
594                 dput(dir);
595                 dir = next;
596                 next = NULL;
597                 goto advance;
598         }
599
600         /* we've found the object we were looking for */
601         object->dentry = next;
602
603         /* if we've found that the terminal object exists, then we need to
604          * check its attributes and delete it if it's out of date */
605         if (!object->new) {
606                 _debug("validate '%*.*s'",
607                        next->d_name.len, next->d_name.len, next->d_name.name);
608
609                 ret = cachefiles_check_object_xattr(object, auxdata);
610                 if (ret == -ESTALE) {
611                         /* delete the object (the deleter drops the directory
612                          * mutex) */
613                         object->dentry = NULL;
614
615                         ret = cachefiles_bury_object(cache, dir, next, true);
616                         dput(next);
617                         next = NULL;
618
619                         if (ret < 0)
620                                 goto delete_error;
621
622                         _debug("redo lookup");
623                         goto lookup_again;
624                 }
625         }
626
627         /* note that we're now using this object */
628         ret = cachefiles_mark_object_active(cache, object);
629
630         mutex_unlock(&dir->d_inode->i_mutex);
631         dput(dir);
632         dir = NULL;
633
634         if (ret == -ETIMEDOUT)
635                 goto mark_active_timed_out;
636
637         _debug("=== OBTAINED_OBJECT ===");
638
639         if (object->new) {
640                 /* attach data to a newly constructed terminal object */
641                 ret = cachefiles_set_object_xattr(object, auxdata);
642                 if (ret < 0)
643                         goto check_error;
644         } else {
645                 /* always update the atime on an object we've just looked up
646                  * (this is used to keep track of culling, and atimes are only
647                  * updated by read, write and readdir but not lookup or
648                  * open) */
649                 touch_atime(cache->mnt, next);
650         }
651
652         /* open a file interface onto a data file */
653         if (object->type != FSCACHE_COOKIE_TYPE_INDEX) {
654                 if (S_ISREG(object->dentry->d_inode->i_mode)) {
655                         const struct address_space_operations *aops;
656
657                         ret = -EPERM;
658                         aops = object->dentry->d_inode->i_mapping->a_ops;
659                         if (!aops->bmap)
660                                 goto check_error;
661
662                         object->backer = object->dentry;
663                 } else {
664                         BUG(); // TODO: open file in data-class subdir
665                 }
666         }
667
668         object->new = 0;
669         fscache_obtained_object(&object->fscache);
670
671         _leave(" = 0 [%lu]", object->dentry->d_inode->i_ino);
672         return 0;
673
674 create_error:
675         _debug("create error %d", ret);
676         if (ret == -EIO)
677                 cachefiles_io_error(cache, "Create/mkdir failed");
678         goto error;
679
680 mark_active_timed_out:
681         _debug("mark active timed out");
682         goto release_dentry;
683
684 check_error:
685         _debug("check error %d", ret);
686         write_lock(&cache->active_lock);
687         rb_erase(&object->active_node, &cache->active_nodes);
688         clear_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags);
689         wake_up_bit(&object->flags, CACHEFILES_OBJECT_ACTIVE);
690         write_unlock(&cache->active_lock);
691 release_dentry:
692         dput(object->dentry);
693         object->dentry = NULL;
694         goto error_out;
695
696 delete_error:
697         _debug("delete error %d", ret);
698         goto error_out2;
699
700 lookup_error:
701         _debug("lookup error %ld", PTR_ERR(next));
702         ret = PTR_ERR(next);
703         if (ret == -EIO)
704                 cachefiles_io_error(cache, "Lookup failed");
705         next = NULL;
706 error:
707         mutex_unlock(&dir->d_inode->i_mutex);
708         dput(next);
709 error_out2:
710         dput(dir);
711 error_out:
712         _leave(" = error %d", -ret);
713         return ret;
714 }
715
716 /*
717  * get a subdirectory
718  */
719 struct dentry *cachefiles_get_directory(struct cachefiles_cache *cache,
720                                         struct dentry *dir,
721                                         const char *dirname)
722 {
723         struct dentry *subdir;
724         unsigned long start;
725         struct path path;
726         int ret;
727
728         _enter(",,%s", dirname);
729
730         /* search the current directory for the element name */
731         mutex_lock(&dir->d_inode->i_mutex);
732
733         start = jiffies;
734         subdir = lookup_one_len(dirname, dir, strlen(dirname));
735         cachefiles_hist(cachefiles_lookup_histogram, start);
736         if (IS_ERR(subdir)) {
737                 if (PTR_ERR(subdir) == -ENOMEM)
738                         goto nomem_d_alloc;
739                 goto lookup_error;
740         }
741
742         _debug("subdir -> %p %s",
743                subdir, subdir->d_inode ? "positive" : "negative");
744
745         /* we need to create the subdir if it doesn't exist yet */
746         if (!subdir->d_inode) {
747                 ret = cachefiles_has_space(cache, 1, 0);
748                 if (ret < 0)
749                         goto mkdir_error;
750
751                 _debug("attempt mkdir");
752
753                 path.mnt = cache->mnt;
754                 path.dentry = dir;
755                 ret = security_path_mkdir(&path, subdir, 0700);
756                 if (ret < 0)
757                         goto mkdir_error;
758                 ret = vfs_mkdir(dir->d_inode, subdir, 0700);
759                 if (ret < 0)
760                         goto mkdir_error;
761
762                 ASSERT(subdir->d_inode);
763
764                 _debug("mkdir -> %p{%p{ino=%lu}}",
765                        subdir,
766                        subdir->d_inode,
767                        subdir->d_inode->i_ino);
768         }
769
770         mutex_unlock(&dir->d_inode->i_mutex);
771
772         /* we need to make sure the subdir is a directory */
773         ASSERT(subdir->d_inode);
774
775         if (!S_ISDIR(subdir->d_inode->i_mode)) {
776                 kerror("%s is not a directory", dirname);
777                 ret = -EIO;
778                 goto check_error;
779         }
780
781         ret = -EPERM;
782         if (!subdir->d_inode->i_op ||
783             !subdir->d_inode->i_op->setxattr ||
784             !subdir->d_inode->i_op->getxattr ||
785             !subdir->d_inode->i_op->lookup ||
786             !subdir->d_inode->i_op->mkdir ||
787             !subdir->d_inode->i_op->create ||
788             !subdir->d_inode->i_op->rename ||
789             !subdir->d_inode->i_op->rmdir ||
790             !subdir->d_inode->i_op->unlink)
791                 goto check_error;
792
793         _leave(" = [%lu]", subdir->d_inode->i_ino);
794         return subdir;
795
796 check_error:
797         dput(subdir);
798         _leave(" = %d [check]", ret);
799         return ERR_PTR(ret);
800
801 mkdir_error:
802         mutex_unlock(&dir->d_inode->i_mutex);
803         dput(subdir);
804         kerror("mkdir %s failed with error %d", dirname, ret);
805         return ERR_PTR(ret);
806
807 lookup_error:
808         mutex_unlock(&dir->d_inode->i_mutex);
809         ret = PTR_ERR(subdir);
810         kerror("Lookup %s failed with error %d", dirname, ret);
811         return ERR_PTR(ret);
812
813 nomem_d_alloc:
814         mutex_unlock(&dir->d_inode->i_mutex);
815         _leave(" = -ENOMEM");
816         return ERR_PTR(-ENOMEM);
817 }
818
819 /*
820  * find out if an object is in use or not
821  * - if finds object and it's not in use:
822  *   - returns a pointer to the object and a reference on it
823  *   - returns with the directory locked
824  */
825 static struct dentry *cachefiles_check_active(struct cachefiles_cache *cache,
826                                               struct dentry *dir,
827                                               char *filename)
828 {
829         struct cachefiles_object *object;
830         struct rb_node *_n;
831         struct dentry *victim;
832         unsigned long start;
833         int ret;
834
835         //_enter(",%*.*s/,%s",
836         //       dir->d_name.len, dir->d_name.len, dir->d_name.name, filename);
837
838         /* look up the victim */
839         mutex_lock_nested(&dir->d_inode->i_mutex, 1);
840
841         start = jiffies;
842         victim = lookup_one_len(filename, dir, strlen(filename));
843         cachefiles_hist(cachefiles_lookup_histogram, start);
844         if (IS_ERR(victim))
845                 goto lookup_error;
846
847         //_debug("victim -> %p %s",
848         //       victim, victim->d_inode ? "positive" : "negative");
849
850         /* if the object is no longer there then we probably retired the object
851          * at the netfs's request whilst the cull was in progress
852          */
853         if (!victim->d_inode) {
854                 mutex_unlock(&dir->d_inode->i_mutex);
855                 dput(victim);
856                 _leave(" = -ENOENT [absent]");
857                 return ERR_PTR(-ENOENT);
858         }
859
860         /* check to see if we're using this object */
861         read_lock(&cache->active_lock);
862
863         _n = cache->active_nodes.rb_node;
864
865         while (_n) {
866                 object = rb_entry(_n, struct cachefiles_object, active_node);
867
868                 if (object->dentry > victim)
869                         _n = _n->rb_left;
870                 else if (object->dentry < victim)
871                         _n = _n->rb_right;
872                 else
873                         goto object_in_use;
874         }
875
876         read_unlock(&cache->active_lock);
877
878         //_leave(" = %p", victim);
879         return victim;
880
881 object_in_use:
882         read_unlock(&cache->active_lock);
883         mutex_unlock(&dir->d_inode->i_mutex);
884         dput(victim);
885         //_leave(" = -EBUSY [in use]");
886         return ERR_PTR(-EBUSY);
887
888 lookup_error:
889         mutex_unlock(&dir->d_inode->i_mutex);
890         ret = PTR_ERR(victim);
891         if (ret == -ENOENT) {
892                 /* file or dir now absent - probably retired by netfs */
893                 _leave(" = -ESTALE [absent]");
894                 return ERR_PTR(-ESTALE);
895         }
896
897         if (ret == -EIO) {
898                 cachefiles_io_error(cache, "Lookup failed");
899         } else if (ret != -ENOMEM) {
900                 kerror("Internal error: %d", ret);
901                 ret = -EIO;
902         }
903
904         _leave(" = %d", ret);
905         return ERR_PTR(ret);
906 }
907
908 /*
909  * cull an object if it's not in use
910  * - called only by cache manager daemon
911  */
912 int cachefiles_cull(struct cachefiles_cache *cache, struct dentry *dir,
913                     char *filename)
914 {
915         struct dentry *victim;
916         int ret;
917
918         _enter(",%*.*s/,%s",
919                dir->d_name.len, dir->d_name.len, dir->d_name.name, filename);
920
921         victim = cachefiles_check_active(cache, dir, filename);
922         if (IS_ERR(victim))
923                 return PTR_ERR(victim);
924
925         _debug("victim -> %p %s",
926                victim, victim->d_inode ? "positive" : "negative");
927
928         /* okay... the victim is not being used so we can cull it
929          * - start by marking it as stale
930          */
931         _debug("victim is cullable");
932
933         ret = cachefiles_remove_object_xattr(cache, victim);
934         if (ret < 0)
935                 goto error_unlock;
936
937         /*  actually remove the victim (drops the dir mutex) */
938         _debug("bury");
939
940         ret = cachefiles_bury_object(cache, dir, victim, false);
941         if (ret < 0)
942                 goto error;
943
944         dput(victim);
945         _leave(" = 0");
946         return 0;
947
948 error_unlock:
949         mutex_unlock(&dir->d_inode->i_mutex);
950 error:
951         dput(victim);
952         if (ret == -ENOENT) {
953                 /* file or dir now absent - probably retired by netfs */
954                 _leave(" = -ESTALE [absent]");
955                 return -ESTALE;
956         }
957
958         if (ret != -ENOMEM) {
959                 kerror("Internal error: %d", ret);
960                 ret = -EIO;
961         }
962
963         _leave(" = %d", ret);
964         return ret;
965 }
966
967 /*
968  * find out if an object is in use or not
969  * - called only by cache manager daemon
970  * - returns -EBUSY or 0 to indicate whether an object is in use or not
971  */
972 int cachefiles_check_in_use(struct cachefiles_cache *cache, struct dentry *dir,
973                             char *filename)
974 {
975         struct dentry *victim;
976
977         //_enter(",%*.*s/,%s",
978         //       dir->d_name.len, dir->d_name.len, dir->d_name.name, filename);
979
980         victim = cachefiles_check_active(cache, dir, filename);
981         if (IS_ERR(victim))
982                 return PTR_ERR(victim);
983
984         mutex_unlock(&dir->d_inode->i_mutex);
985         dput(victim);
986         //_leave(" = 0");
987         return 0;
988 }