CacheFiles: Fix a race in cachefiles_delete_object() vs rename
[linux-2.6.git] / fs / cachefiles / namei.c
1 /* CacheFiles path walking and related routines
2  *
3  * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
4  * Written by David Howells (dhowells@redhat.com)
5  *
6  * This program is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU General Public Licence
8  * as published by the Free Software Foundation; either version
9  * 2 of the Licence, or (at your option) any later version.
10  */
11
12 #include <linux/module.h>
13 #include <linux/sched.h>
14 #include <linux/file.h>
15 #include <linux/fs.h>
16 #include <linux/fsnotify.h>
17 #include <linux/quotaops.h>
18 #include <linux/xattr.h>
19 #include <linux/mount.h>
20 #include <linux/namei.h>
21 #include <linux/security.h>
22 #include "internal.h"
23
24 #define CACHEFILES_KEYBUF_SIZE 512
25
26 /*
27  * dump debugging info about an object
28  */
29 static noinline
30 void __cachefiles_printk_object(struct cachefiles_object *object,
31                                 const char *prefix,
32                                 u8 *keybuf)
33 {
34         struct fscache_cookie *cookie;
35         unsigned keylen, loop;
36
37         printk(KERN_ERR "%sobject: OBJ%x\n",
38                prefix, object->fscache.debug_id);
39         printk(KERN_ERR "%sobjstate=%s fl=%lx swfl=%lx ev=%lx[%lx]\n",
40                prefix, fscache_object_states[object->fscache.state],
41                object->fscache.flags, object->fscache.work.flags,
42                object->fscache.events,
43                object->fscache.event_mask & FSCACHE_OBJECT_EVENTS_MASK);
44         printk(KERN_ERR "%sops=%u inp=%u exc=%u\n",
45                prefix, object->fscache.n_ops, object->fscache.n_in_progress,
46                object->fscache.n_exclusive);
47         printk(KERN_ERR "%sparent=%p\n",
48                prefix, object->fscache.parent);
49
50         spin_lock(&object->fscache.lock);
51         cookie = object->fscache.cookie;
52         if (cookie) {
53                 printk(KERN_ERR "%scookie=%p [pr=%p nd=%p fl=%lx]\n",
54                        prefix,
55                        object->fscache.cookie,
56                        object->fscache.cookie->parent,
57                        object->fscache.cookie->netfs_data,
58                        object->fscache.cookie->flags);
59                 if (keybuf)
60                         keylen = cookie->def->get_key(cookie->netfs_data, keybuf,
61                                                       CACHEFILES_KEYBUF_SIZE);
62                 else
63                         keylen = 0;
64         } else {
65                 printk(KERN_ERR "%scookie=NULL\n", prefix);
66                 keylen = 0;
67         }
68         spin_unlock(&object->fscache.lock);
69
70         if (keylen) {
71                 printk(KERN_ERR "%skey=[%u] '", prefix, keylen);
72                 for (loop = 0; loop < keylen; loop++)
73                         printk("%02x", keybuf[loop]);
74                 printk("'\n");
75         }
76 }
77
78 /*
79  * dump debugging info about a pair of objects
80  */
81 static noinline void cachefiles_printk_object(struct cachefiles_object *object,
82                                               struct cachefiles_object *xobject)
83 {
84         u8 *keybuf;
85
86         keybuf = kmalloc(CACHEFILES_KEYBUF_SIZE, GFP_NOIO);
87         if (object)
88                 __cachefiles_printk_object(object, "", keybuf);
89         if (xobject)
90                 __cachefiles_printk_object(xobject, "x", keybuf);
91         kfree(keybuf);
92 }
93
94 /*
95  * record the fact that an object is now active
96  */
97 static int cachefiles_mark_object_active(struct cachefiles_cache *cache,
98                                          struct cachefiles_object *object)
99 {
100         struct cachefiles_object *xobject;
101         struct rb_node **_p, *_parent = NULL;
102         struct dentry *dentry;
103
104         _enter(",%p", object);
105
106 try_again:
107         write_lock(&cache->active_lock);
108
109         if (test_and_set_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags)) {
110                 printk(KERN_ERR "CacheFiles: Error: Object already active\n");
111                 cachefiles_printk_object(object, NULL);
112                 BUG();
113         }
114
115         dentry = object->dentry;
116         _p = &cache->active_nodes.rb_node;
117         while (*_p) {
118                 _parent = *_p;
119                 xobject = rb_entry(_parent,
120                                    struct cachefiles_object, active_node);
121
122                 ASSERT(xobject != object);
123
124                 if (xobject->dentry > dentry)
125                         _p = &(*_p)->rb_left;
126                 else if (xobject->dentry < dentry)
127                         _p = &(*_p)->rb_right;
128                 else
129                         goto wait_for_old_object;
130         }
131
132         rb_link_node(&object->active_node, _parent, _p);
133         rb_insert_color(&object->active_node, &cache->active_nodes);
134
135         write_unlock(&cache->active_lock);
136         _leave(" = 0");
137         return 0;
138
139         /* an old object from a previous incarnation is hogging the slot - we
140          * need to wait for it to be destroyed */
141 wait_for_old_object:
142         if (xobject->fscache.state < FSCACHE_OBJECT_DYING) {
143                 printk(KERN_ERR "\n");
144                 printk(KERN_ERR "CacheFiles: Error:"
145                        " Unexpected object collision\n");
146                 cachefiles_printk_object(object, xobject);
147                 BUG();
148         }
149         atomic_inc(&xobject->usage);
150         write_unlock(&cache->active_lock);
151
152         if (test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags)) {
153                 wait_queue_head_t *wq;
154
155                 signed long timeout = 60 * HZ;
156                 wait_queue_t wait;
157                 bool requeue;
158
159                 /* if the object we're waiting for is queued for processing,
160                  * then just put ourselves on the queue behind it */
161                 if (slow_work_is_queued(&xobject->fscache.work)) {
162                         _debug("queue OBJ%x behind OBJ%x immediately",
163                                object->fscache.debug_id,
164                                xobject->fscache.debug_id);
165                         goto requeue;
166                 }
167
168                 /* otherwise we sleep until either the object we're waiting for
169                  * is done, or the slow-work facility wants the thread back to
170                  * do other work */
171                 wq = bit_waitqueue(&xobject->flags, CACHEFILES_OBJECT_ACTIVE);
172                 init_wait(&wait);
173                 requeue = false;
174                 do {
175                         prepare_to_wait(wq, &wait, TASK_UNINTERRUPTIBLE);
176                         if (!test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags))
177                                 break;
178                         requeue = slow_work_sleep_till_thread_needed(
179                                 &object->fscache.work, &timeout);
180                 } while (timeout > 0 && !requeue);
181                 finish_wait(wq, &wait);
182
183                 if (requeue &&
184                     test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags)) {
185                         _debug("queue OBJ%x behind OBJ%x after wait",
186                                object->fscache.debug_id,
187                                xobject->fscache.debug_id);
188                         goto requeue;
189                 }
190
191                 if (timeout <= 0) {
192                         printk(KERN_ERR "\n");
193                         printk(KERN_ERR "CacheFiles: Error: Overlong"
194                                " wait for old active object to go away\n");
195                         cachefiles_printk_object(object, xobject);
196                         goto requeue;
197                 }
198         }
199
200         ASSERT(!test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags));
201
202         cache->cache.ops->put_object(&xobject->fscache);
203         goto try_again;
204
205 requeue:
206         clear_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags);
207         cache->cache.ops->put_object(&xobject->fscache);
208         _leave(" = -ETIMEDOUT");
209         return -ETIMEDOUT;
210 }
211
212 /*
213  * delete an object representation from the cache
214  * - file backed objects are unlinked
215  * - directory backed objects are stuffed into the graveyard for userspace to
216  *   delete
217  * - unlocks the directory mutex
218  */
219 static int cachefiles_bury_object(struct cachefiles_cache *cache,
220                                   struct dentry *dir,
221                                   struct dentry *rep)
222 {
223         struct dentry *grave, *trap;
224         char nbuffer[8 + 8 + 1];
225         int ret;
226
227         _enter(",'%*.*s','%*.*s'",
228                dir->d_name.len, dir->d_name.len, dir->d_name.name,
229                rep->d_name.len, rep->d_name.len, rep->d_name.name);
230
231         /* non-directories can just be unlinked */
232         if (!S_ISDIR(rep->d_inode->i_mode)) {
233                 _debug("unlink stale object");
234                 ret = vfs_unlink(dir->d_inode, rep);
235
236                 mutex_unlock(&dir->d_inode->i_mutex);
237
238                 if (ret == -EIO)
239                         cachefiles_io_error(cache, "Unlink failed");
240
241                 _leave(" = %d", ret);
242                 return ret;
243         }
244
245         /* directories have to be moved to the graveyard */
246         _debug("move stale object to graveyard");
247         mutex_unlock(&dir->d_inode->i_mutex);
248
249 try_again:
250         /* first step is to make up a grave dentry in the graveyard */
251         sprintf(nbuffer, "%08x%08x",
252                 (uint32_t) get_seconds(),
253                 (uint32_t) atomic_inc_return(&cache->gravecounter));
254
255         /* do the multiway lock magic */
256         trap = lock_rename(cache->graveyard, dir);
257
258         /* do some checks before getting the grave dentry */
259         if (rep->d_parent != dir) {
260                 /* the entry was probably culled when we dropped the parent dir
261                  * lock */
262                 unlock_rename(cache->graveyard, dir);
263                 _leave(" = 0 [culled?]");
264                 return 0;
265         }
266
267         if (!S_ISDIR(cache->graveyard->d_inode->i_mode)) {
268                 unlock_rename(cache->graveyard, dir);
269                 cachefiles_io_error(cache, "Graveyard no longer a directory");
270                 return -EIO;
271         }
272
273         if (trap == rep) {
274                 unlock_rename(cache->graveyard, dir);
275                 cachefiles_io_error(cache, "May not make directory loop");
276                 return -EIO;
277         }
278
279         if (d_mountpoint(rep)) {
280                 unlock_rename(cache->graveyard, dir);
281                 cachefiles_io_error(cache, "Mountpoint in cache");
282                 return -EIO;
283         }
284
285         grave = lookup_one_len(nbuffer, cache->graveyard, strlen(nbuffer));
286         if (IS_ERR(grave)) {
287                 unlock_rename(cache->graveyard, dir);
288
289                 if (PTR_ERR(grave) == -ENOMEM) {
290                         _leave(" = -ENOMEM");
291                         return -ENOMEM;
292                 }
293
294                 cachefiles_io_error(cache, "Lookup error %ld",
295                                     PTR_ERR(grave));
296                 return -EIO;
297         }
298
299         if (grave->d_inode) {
300                 unlock_rename(cache->graveyard, dir);
301                 dput(grave);
302                 grave = NULL;
303                 cond_resched();
304                 goto try_again;
305         }
306
307         if (d_mountpoint(grave)) {
308                 unlock_rename(cache->graveyard, dir);
309                 dput(grave);
310                 cachefiles_io_error(cache, "Mountpoint in graveyard");
311                 return -EIO;
312         }
313
314         /* target should not be an ancestor of source */
315         if (trap == grave) {
316                 unlock_rename(cache->graveyard, dir);
317                 dput(grave);
318                 cachefiles_io_error(cache, "May not make directory loop");
319                 return -EIO;
320         }
321
322         /* attempt the rename */
323         ret = vfs_rename(dir->d_inode, rep, cache->graveyard->d_inode, grave);
324         if (ret != 0 && ret != -ENOMEM)
325                 cachefiles_io_error(cache, "Rename failed with error %d", ret);
326
327         unlock_rename(cache->graveyard, dir);
328         dput(grave);
329         _leave(" = 0");
330         return 0;
331 }
332
333 /*
334  * delete an object representation from the cache
335  */
336 int cachefiles_delete_object(struct cachefiles_cache *cache,
337                              struct cachefiles_object *object)
338 {
339         struct dentry *dir;
340         int ret;
341
342         _enter(",{%p}", object->dentry);
343
344         ASSERT(object->dentry);
345         ASSERT(object->dentry->d_inode);
346         ASSERT(object->dentry->d_parent);
347
348         dir = dget_parent(object->dentry);
349
350         mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_PARENT);
351
352         /* we need to check that our parent is _still_ our parent - it may have
353          * been renamed */
354         if (dir == object->dentry->d_parent) {
355                 ret = cachefiles_bury_object(cache, dir, object->dentry);
356         } else {
357                 /* it got moved, presumably by cachefilesd culling it, so it's
358                  * no longer in the key path and we can ignore it */
359                 mutex_unlock(&dir->d_inode->i_mutex);
360                 ret = 0;
361         }
362
363         dput(dir);
364         _leave(" = %d", ret);
365         return ret;
366 }
367
368 /*
369  * walk from the parent object to the child object through the backing
370  * filesystem, creating directories as we go
371  */
372 int cachefiles_walk_to_object(struct cachefiles_object *parent,
373                               struct cachefiles_object *object,
374                               const char *key,
375                               struct cachefiles_xattr *auxdata)
376 {
377         struct cachefiles_cache *cache;
378         struct dentry *dir, *next = NULL;
379         unsigned long start;
380         const char *name;
381         int ret, nlen;
382
383         _enter("{%p},,%s,", parent->dentry, key);
384
385         cache = container_of(parent->fscache.cache,
386                              struct cachefiles_cache, cache);
387
388         ASSERT(parent->dentry);
389         ASSERT(parent->dentry->d_inode);
390
391         if (!(S_ISDIR(parent->dentry->d_inode->i_mode))) {
392                 // TODO: convert file to dir
393                 _leave("looking up in none directory");
394                 return -ENOBUFS;
395         }
396
397         dir = dget(parent->dentry);
398
399 advance:
400         /* attempt to transit the first directory component */
401         name = key;
402         nlen = strlen(key);
403
404         /* key ends in a double NUL */
405         key = key + nlen + 1;
406         if (!*key)
407                 key = NULL;
408
409 lookup_again:
410         /* search the current directory for the element name */
411         _debug("lookup '%s'", name);
412
413         mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_PARENT);
414
415         start = jiffies;
416         next = lookup_one_len(name, dir, nlen);
417         cachefiles_hist(cachefiles_lookup_histogram, start);
418         if (IS_ERR(next))
419                 goto lookup_error;
420
421         _debug("next -> %p %s", next, next->d_inode ? "positive" : "negative");
422
423         if (!key)
424                 object->new = !next->d_inode;
425
426         /* if this element of the path doesn't exist, then the lookup phase
427          * failed, and we can release any readers in the certain knowledge that
428          * there's nothing for them to actually read */
429         if (!next->d_inode)
430                 fscache_object_lookup_negative(&object->fscache);
431
432         /* we need to create the object if it's negative */
433         if (key || object->type == FSCACHE_COOKIE_TYPE_INDEX) {
434                 /* index objects and intervening tree levels must be subdirs */
435                 if (!next->d_inode) {
436                         ret = cachefiles_has_space(cache, 1, 0);
437                         if (ret < 0)
438                                 goto create_error;
439
440                         start = jiffies;
441                         ret = vfs_mkdir(dir->d_inode, next, 0);
442                         cachefiles_hist(cachefiles_mkdir_histogram, start);
443                         if (ret < 0)
444                                 goto create_error;
445
446                         ASSERT(next->d_inode);
447
448                         _debug("mkdir -> %p{%p{ino=%lu}}",
449                                next, next->d_inode, next->d_inode->i_ino);
450
451                 } else if (!S_ISDIR(next->d_inode->i_mode)) {
452                         kerror("inode %lu is not a directory",
453                                next->d_inode->i_ino);
454                         ret = -ENOBUFS;
455                         goto error;
456                 }
457
458         } else {
459                 /* non-index objects start out life as files */
460                 if (!next->d_inode) {
461                         ret = cachefiles_has_space(cache, 1, 0);
462                         if (ret < 0)
463                                 goto create_error;
464
465                         start = jiffies;
466                         ret = vfs_create(dir->d_inode, next, S_IFREG, NULL);
467                         cachefiles_hist(cachefiles_create_histogram, start);
468                         if (ret < 0)
469                                 goto create_error;
470
471                         ASSERT(next->d_inode);
472
473                         _debug("create -> %p{%p{ino=%lu}}",
474                                next, next->d_inode, next->d_inode->i_ino);
475
476                 } else if (!S_ISDIR(next->d_inode->i_mode) &&
477                            !S_ISREG(next->d_inode->i_mode)
478                            ) {
479                         kerror("inode %lu is not a file or directory",
480                                next->d_inode->i_ino);
481                         ret = -ENOBUFS;
482                         goto error;
483                 }
484         }
485
486         /* process the next component */
487         if (key) {
488                 _debug("advance");
489                 mutex_unlock(&dir->d_inode->i_mutex);
490                 dput(dir);
491                 dir = next;
492                 next = NULL;
493                 goto advance;
494         }
495
496         /* we've found the object we were looking for */
497         object->dentry = next;
498
499         /* if we've found that the terminal object exists, then we need to
500          * check its attributes and delete it if it's out of date */
501         if (!object->new) {
502                 _debug("validate '%*.*s'",
503                        next->d_name.len, next->d_name.len, next->d_name.name);
504
505                 ret = cachefiles_check_object_xattr(object, auxdata);
506                 if (ret == -ESTALE) {
507                         /* delete the object (the deleter drops the directory
508                          * mutex) */
509                         object->dentry = NULL;
510
511                         ret = cachefiles_bury_object(cache, dir, next);
512                         dput(next);
513                         next = NULL;
514
515                         if (ret < 0)
516                                 goto delete_error;
517
518                         _debug("redo lookup");
519                         goto lookup_again;
520                 }
521         }
522
523         /* note that we're now using this object */
524         ret = cachefiles_mark_object_active(cache, object);
525
526         mutex_unlock(&dir->d_inode->i_mutex);
527         dput(dir);
528         dir = NULL;
529
530         if (ret == -ETIMEDOUT)
531                 goto mark_active_timed_out;
532
533         _debug("=== OBTAINED_OBJECT ===");
534
535         if (object->new) {
536                 /* attach data to a newly constructed terminal object */
537                 ret = cachefiles_set_object_xattr(object, auxdata);
538                 if (ret < 0)
539                         goto check_error;
540         } else {
541                 /* always update the atime on an object we've just looked up
542                  * (this is used to keep track of culling, and atimes are only
543                  * updated by read, write and readdir but not lookup or
544                  * open) */
545                 touch_atime(cache->mnt, next);
546         }
547
548         /* open a file interface onto a data file */
549         if (object->type != FSCACHE_COOKIE_TYPE_INDEX) {
550                 if (S_ISREG(object->dentry->d_inode->i_mode)) {
551                         const struct address_space_operations *aops;
552
553                         ret = -EPERM;
554                         aops = object->dentry->d_inode->i_mapping->a_ops;
555                         if (!aops->bmap)
556                                 goto check_error;
557
558                         object->backer = object->dentry;
559                 } else {
560                         BUG(); // TODO: open file in data-class subdir
561                 }
562         }
563
564         object->new = 0;
565         fscache_obtained_object(&object->fscache);
566
567         _leave(" = 0 [%lu]", object->dentry->d_inode->i_ino);
568         return 0;
569
570 create_error:
571         _debug("create error %d", ret);
572         if (ret == -EIO)
573                 cachefiles_io_error(cache, "Create/mkdir failed");
574         goto error;
575
576 mark_active_timed_out:
577         _debug("mark active timed out");
578         goto release_dentry;
579
580 check_error:
581         _debug("check error %d", ret);
582         write_lock(&cache->active_lock);
583         rb_erase(&object->active_node, &cache->active_nodes);
584         clear_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags);
585         wake_up_bit(&object->flags, CACHEFILES_OBJECT_ACTIVE);
586         write_unlock(&cache->active_lock);
587 release_dentry:
588         dput(object->dentry);
589         object->dentry = NULL;
590         goto error_out;
591
592 delete_error:
593         _debug("delete error %d", ret);
594         goto error_out2;
595
596 lookup_error:
597         _debug("lookup error %ld", PTR_ERR(next));
598         ret = PTR_ERR(next);
599         if (ret == -EIO)
600                 cachefiles_io_error(cache, "Lookup failed");
601         next = NULL;
602 error:
603         mutex_unlock(&dir->d_inode->i_mutex);
604         dput(next);
605 error_out2:
606         dput(dir);
607 error_out:
608         _leave(" = error %d", -ret);
609         return ret;
610 }
611
612 /*
613  * get a subdirectory
614  */
615 struct dentry *cachefiles_get_directory(struct cachefiles_cache *cache,
616                                         struct dentry *dir,
617                                         const char *dirname)
618 {
619         struct dentry *subdir;
620         unsigned long start;
621         int ret;
622
623         _enter(",,%s", dirname);
624
625         /* search the current directory for the element name */
626         mutex_lock(&dir->d_inode->i_mutex);
627
628         start = jiffies;
629         subdir = lookup_one_len(dirname, dir, strlen(dirname));
630         cachefiles_hist(cachefiles_lookup_histogram, start);
631         if (IS_ERR(subdir)) {
632                 if (PTR_ERR(subdir) == -ENOMEM)
633                         goto nomem_d_alloc;
634                 goto lookup_error;
635         }
636
637         _debug("subdir -> %p %s",
638                subdir, subdir->d_inode ? "positive" : "negative");
639
640         /* we need to create the subdir if it doesn't exist yet */
641         if (!subdir->d_inode) {
642                 ret = cachefiles_has_space(cache, 1, 0);
643                 if (ret < 0)
644                         goto mkdir_error;
645
646                 _debug("attempt mkdir");
647
648                 ret = vfs_mkdir(dir->d_inode, subdir, 0700);
649                 if (ret < 0)
650                         goto mkdir_error;
651
652                 ASSERT(subdir->d_inode);
653
654                 _debug("mkdir -> %p{%p{ino=%lu}}",
655                        subdir,
656                        subdir->d_inode,
657                        subdir->d_inode->i_ino);
658         }
659
660         mutex_unlock(&dir->d_inode->i_mutex);
661
662         /* we need to make sure the subdir is a directory */
663         ASSERT(subdir->d_inode);
664
665         if (!S_ISDIR(subdir->d_inode->i_mode)) {
666                 kerror("%s is not a directory", dirname);
667                 ret = -EIO;
668                 goto check_error;
669         }
670
671         ret = -EPERM;
672         if (!subdir->d_inode->i_op ||
673             !subdir->d_inode->i_op->setxattr ||
674             !subdir->d_inode->i_op->getxattr ||
675             !subdir->d_inode->i_op->lookup ||
676             !subdir->d_inode->i_op->mkdir ||
677             !subdir->d_inode->i_op->create ||
678             !subdir->d_inode->i_op->rename ||
679             !subdir->d_inode->i_op->rmdir ||
680             !subdir->d_inode->i_op->unlink)
681                 goto check_error;
682
683         _leave(" = [%lu]", subdir->d_inode->i_ino);
684         return subdir;
685
686 check_error:
687         dput(subdir);
688         _leave(" = %d [check]", ret);
689         return ERR_PTR(ret);
690
691 mkdir_error:
692         mutex_unlock(&dir->d_inode->i_mutex);
693         dput(subdir);
694         kerror("mkdir %s failed with error %d", dirname, ret);
695         return ERR_PTR(ret);
696
697 lookup_error:
698         mutex_unlock(&dir->d_inode->i_mutex);
699         ret = PTR_ERR(subdir);
700         kerror("Lookup %s failed with error %d", dirname, ret);
701         return ERR_PTR(ret);
702
703 nomem_d_alloc:
704         mutex_unlock(&dir->d_inode->i_mutex);
705         _leave(" = -ENOMEM");
706         return ERR_PTR(-ENOMEM);
707 }
708
709 /*
710  * find out if an object is in use or not
711  * - if finds object and it's not in use:
712  *   - returns a pointer to the object and a reference on it
713  *   - returns with the directory locked
714  */
715 static struct dentry *cachefiles_check_active(struct cachefiles_cache *cache,
716                                               struct dentry *dir,
717                                               char *filename)
718 {
719         struct cachefiles_object *object;
720         struct rb_node *_n;
721         struct dentry *victim;
722         unsigned long start;
723         int ret;
724
725         //_enter(",%*.*s/,%s",
726         //       dir->d_name.len, dir->d_name.len, dir->d_name.name, filename);
727
728         /* look up the victim */
729         mutex_lock_nested(&dir->d_inode->i_mutex, 1);
730
731         start = jiffies;
732         victim = lookup_one_len(filename, dir, strlen(filename));
733         cachefiles_hist(cachefiles_lookup_histogram, start);
734         if (IS_ERR(victim))
735                 goto lookup_error;
736
737         //_debug("victim -> %p %s",
738         //       victim, victim->d_inode ? "positive" : "negative");
739
740         /* if the object is no longer there then we probably retired the object
741          * at the netfs's request whilst the cull was in progress
742          */
743         if (!victim->d_inode) {
744                 mutex_unlock(&dir->d_inode->i_mutex);
745                 dput(victim);
746                 _leave(" = -ENOENT [absent]");
747                 return ERR_PTR(-ENOENT);
748         }
749
750         /* check to see if we're using this object */
751         read_lock(&cache->active_lock);
752
753         _n = cache->active_nodes.rb_node;
754
755         while (_n) {
756                 object = rb_entry(_n, struct cachefiles_object, active_node);
757
758                 if (object->dentry > victim)
759                         _n = _n->rb_left;
760                 else if (object->dentry < victim)
761                         _n = _n->rb_right;
762                 else
763                         goto object_in_use;
764         }
765
766         read_unlock(&cache->active_lock);
767
768         //_leave(" = %p", victim);
769         return victim;
770
771 object_in_use:
772         read_unlock(&cache->active_lock);
773         mutex_unlock(&dir->d_inode->i_mutex);
774         dput(victim);
775         //_leave(" = -EBUSY [in use]");
776         return ERR_PTR(-EBUSY);
777
778 lookup_error:
779         mutex_unlock(&dir->d_inode->i_mutex);
780         ret = PTR_ERR(victim);
781         if (ret == -ENOENT) {
782                 /* file or dir now absent - probably retired by netfs */
783                 _leave(" = -ESTALE [absent]");
784                 return ERR_PTR(-ESTALE);
785         }
786
787         if (ret == -EIO) {
788                 cachefiles_io_error(cache, "Lookup failed");
789         } else if (ret != -ENOMEM) {
790                 kerror("Internal error: %d", ret);
791                 ret = -EIO;
792         }
793
794         _leave(" = %d", ret);
795         return ERR_PTR(ret);
796 }
797
798 /*
799  * cull an object if it's not in use
800  * - called only by cache manager daemon
801  */
802 int cachefiles_cull(struct cachefiles_cache *cache, struct dentry *dir,
803                     char *filename)
804 {
805         struct dentry *victim;
806         int ret;
807
808         _enter(",%*.*s/,%s",
809                dir->d_name.len, dir->d_name.len, dir->d_name.name, filename);
810
811         victim = cachefiles_check_active(cache, dir, filename);
812         if (IS_ERR(victim))
813                 return PTR_ERR(victim);
814
815         _debug("victim -> %p %s",
816                victim, victim->d_inode ? "positive" : "negative");
817
818         /* okay... the victim is not being used so we can cull it
819          * - start by marking it as stale
820          */
821         _debug("victim is cullable");
822
823         ret = cachefiles_remove_object_xattr(cache, victim);
824         if (ret < 0)
825                 goto error_unlock;
826
827         /*  actually remove the victim (drops the dir mutex) */
828         _debug("bury");
829
830         ret = cachefiles_bury_object(cache, dir, victim);
831         if (ret < 0)
832                 goto error;
833
834         dput(victim);
835         _leave(" = 0");
836         return 0;
837
838 error_unlock:
839         mutex_unlock(&dir->d_inode->i_mutex);
840 error:
841         dput(victim);
842         if (ret == -ENOENT) {
843                 /* file or dir now absent - probably retired by netfs */
844                 _leave(" = -ESTALE [absent]");
845                 return -ESTALE;
846         }
847
848         if (ret != -ENOMEM) {
849                 kerror("Internal error: %d", ret);
850                 ret = -EIO;
851         }
852
853         _leave(" = %d", ret);
854         return ret;
855 }
856
857 /*
858  * find out if an object is in use or not
859  * - called only by cache manager daemon
860  * - returns -EBUSY or 0 to indicate whether an object is in use or not
861  */
862 int cachefiles_check_in_use(struct cachefiles_cache *cache, struct dentry *dir,
863                             char *filename)
864 {
865         struct dentry *victim;
866
867         //_enter(",%*.*s/,%s",
868         //       dir->d_name.len, dir->d_name.len, dir->d_name.name, filename);
869
870         victim = cachefiles_check_active(cache, dir, filename);
871         if (IS_ERR(victim))
872                 return PTR_ERR(victim);
873
874         mutex_unlock(&dir->d_inode->i_mutex);
875         dput(victim);
876         //_leave(" = 0");
877         return 0;
878 }