Loading...
Note: File does not exist in v3.5.6.
1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * Copyright (C) 2017-2023 Oracle. All Rights Reserved.
4 * Author: Darrick J. Wong <djwong@kernel.org>
5 */
6#include "xfs.h"
7#include "xfs_fs.h"
8#include "xfs_shared.h"
9#include "xfs_format.h"
10#include "xfs_trans_resv.h"
11#include "xfs_mount.h"
12#include "xfs_btree.h"
13#include "xfs_log_format.h"
14#include "xfs_trans.h"
15#include "xfs_inode.h"
16#include "xfs_icache.h"
17#include "xfs_alloc.h"
18#include "xfs_alloc_btree.h"
19#include "xfs_ialloc.h"
20#include "xfs_ialloc_btree.h"
21#include "xfs_refcount_btree.h"
22#include "xfs_rmap.h"
23#include "xfs_rmap_btree.h"
24#include "xfs_log.h"
25#include "xfs_trans_priv.h"
26#include "xfs_da_format.h"
27#include "xfs_da_btree.h"
28#include "xfs_dir2_priv.h"
29#include "xfs_attr.h"
30#include "xfs_reflink.h"
31#include "xfs_ag.h"
32#include "scrub/scrub.h"
33#include "scrub/common.h"
34#include "scrub/trace.h"
35#include "scrub/repair.h"
36#include "scrub/health.h"
37
38/* Common code for the metadata scrubbers. */
39
40/*
41 * Handling operational errors.
42 *
43 * The *_process_error() family of functions are used to process error return
44 * codes from functions called as part of a scrub operation.
45 *
46 * If there's no error, we return true to tell the caller that it's ok
47 * to move on to the next check in its list.
48 *
49 * For non-verifier errors (e.g. ENOMEM) we return false to tell the
50 * caller that something bad happened, and we preserve *error so that
51 * the caller can return the *error up the stack to userspace.
52 *
53 * Verifier errors (EFSBADCRC/EFSCORRUPTED) are recorded by setting
54 * OFLAG_CORRUPT in sm_flags and the *error is cleared. In other words,
55 * we track verifier errors (and failed scrub checks) via OFLAG_CORRUPT,
56 * not via return codes. We return false to tell the caller that
57 * something bad happened. Since the error has been cleared, the caller
58 * will (presumably) return that zero and scrubbing will move on to
59 * whatever's next.
60 *
61 * ftrace can be used to record the precise metadata location and the
62 * approximate code location of the failed operation.
63 */
64
65/* Check for operational errors. */
66static bool
67__xchk_process_error(
68 struct xfs_scrub *sc,
69 xfs_agnumber_t agno,
70 xfs_agblock_t bno,
71 int *error,
72 __u32 errflag,
73 void *ret_ip)
74{
75 switch (*error) {
76 case 0:
77 return true;
78 case -EDEADLOCK:
79 case -ECHRNG:
80 /* Used to restart an op with deadlock avoidance. */
81 trace_xchk_deadlock_retry(
82 sc->ip ? sc->ip : XFS_I(file_inode(sc->file)),
83 sc->sm, *error);
84 break;
85 case -EFSBADCRC:
86 case -EFSCORRUPTED:
87 /* Note the badness but don't abort. */
88 sc->sm->sm_flags |= errflag;
89 *error = 0;
90 fallthrough;
91 default:
92 trace_xchk_op_error(sc, agno, bno, *error,
93 ret_ip);
94 break;
95 }
96 return false;
97}
98
99bool
100xchk_process_error(
101 struct xfs_scrub *sc,
102 xfs_agnumber_t agno,
103 xfs_agblock_t bno,
104 int *error)
105{
106 return __xchk_process_error(sc, agno, bno, error,
107 XFS_SCRUB_OFLAG_CORRUPT, __return_address);
108}
109
110bool
111xchk_xref_process_error(
112 struct xfs_scrub *sc,
113 xfs_agnumber_t agno,
114 xfs_agblock_t bno,
115 int *error)
116{
117 return __xchk_process_error(sc, agno, bno, error,
118 XFS_SCRUB_OFLAG_XFAIL, __return_address);
119}
120
121/* Check for operational errors for a file offset. */
122static bool
123__xchk_fblock_process_error(
124 struct xfs_scrub *sc,
125 int whichfork,
126 xfs_fileoff_t offset,
127 int *error,
128 __u32 errflag,
129 void *ret_ip)
130{
131 switch (*error) {
132 case 0:
133 return true;
134 case -EDEADLOCK:
135 case -ECHRNG:
136 /* Used to restart an op with deadlock avoidance. */
137 trace_xchk_deadlock_retry(sc->ip, sc->sm, *error);
138 break;
139 case -EFSBADCRC:
140 case -EFSCORRUPTED:
141 /* Note the badness but don't abort. */
142 sc->sm->sm_flags |= errflag;
143 *error = 0;
144 fallthrough;
145 default:
146 trace_xchk_file_op_error(sc, whichfork, offset, *error,
147 ret_ip);
148 break;
149 }
150 return false;
151}
152
153bool
154xchk_fblock_process_error(
155 struct xfs_scrub *sc,
156 int whichfork,
157 xfs_fileoff_t offset,
158 int *error)
159{
160 return __xchk_fblock_process_error(sc, whichfork, offset, error,
161 XFS_SCRUB_OFLAG_CORRUPT, __return_address);
162}
163
164bool
165xchk_fblock_xref_process_error(
166 struct xfs_scrub *sc,
167 int whichfork,
168 xfs_fileoff_t offset,
169 int *error)
170{
171 return __xchk_fblock_process_error(sc, whichfork, offset, error,
172 XFS_SCRUB_OFLAG_XFAIL, __return_address);
173}
174
175/*
176 * Handling scrub corruption/optimization/warning checks.
177 *
178 * The *_set_{corrupt,preen,warning}() family of functions are used to
179 * record the presence of metadata that is incorrect (corrupt), could be
180 * optimized somehow (preen), or should be flagged for administrative
181 * review but is not incorrect (warn).
182 *
183 * ftrace can be used to record the precise metadata location and
184 * approximate code location of the failed check.
185 */
186
187/* Record a block which could be optimized. */
188void
189xchk_block_set_preen(
190 struct xfs_scrub *sc,
191 struct xfs_buf *bp)
192{
193 sc->sm->sm_flags |= XFS_SCRUB_OFLAG_PREEN;
194 trace_xchk_block_preen(sc, xfs_buf_daddr(bp), __return_address);
195}
196
197/*
198 * Record an inode which could be optimized. The trace data will
199 * include the block given by bp if bp is given; otherwise it will use
200 * the block location of the inode record itself.
201 */
202void
203xchk_ino_set_preen(
204 struct xfs_scrub *sc,
205 xfs_ino_t ino)
206{
207 sc->sm->sm_flags |= XFS_SCRUB_OFLAG_PREEN;
208 trace_xchk_ino_preen(sc, ino, __return_address);
209}
210
211/* Record something being wrong with the filesystem primary superblock. */
212void
213xchk_set_corrupt(
214 struct xfs_scrub *sc)
215{
216 sc->sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;
217 trace_xchk_fs_error(sc, 0, __return_address);
218}
219
220/* Record a corrupt block. */
221void
222xchk_block_set_corrupt(
223 struct xfs_scrub *sc,
224 struct xfs_buf *bp)
225{
226 sc->sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;
227 trace_xchk_block_error(sc, xfs_buf_daddr(bp), __return_address);
228}
229
230/* Record a corruption while cross-referencing. */
231void
232xchk_block_xref_set_corrupt(
233 struct xfs_scrub *sc,
234 struct xfs_buf *bp)
235{
236 sc->sm->sm_flags |= XFS_SCRUB_OFLAG_XCORRUPT;
237 trace_xchk_block_error(sc, xfs_buf_daddr(bp), __return_address);
238}
239
240/*
241 * Record a corrupt inode. The trace data will include the block given
242 * by bp if bp is given; otherwise it will use the block location of the
243 * inode record itself.
244 */
245void
246xchk_ino_set_corrupt(
247 struct xfs_scrub *sc,
248 xfs_ino_t ino)
249{
250 sc->sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;
251 trace_xchk_ino_error(sc, ino, __return_address);
252}
253
254/* Record a corruption while cross-referencing with an inode. */
255void
256xchk_ino_xref_set_corrupt(
257 struct xfs_scrub *sc,
258 xfs_ino_t ino)
259{
260 sc->sm->sm_flags |= XFS_SCRUB_OFLAG_XCORRUPT;
261 trace_xchk_ino_error(sc, ino, __return_address);
262}
263
264/* Record corruption in a block indexed by a file fork. */
265void
266xchk_fblock_set_corrupt(
267 struct xfs_scrub *sc,
268 int whichfork,
269 xfs_fileoff_t offset)
270{
271 sc->sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;
272 trace_xchk_fblock_error(sc, whichfork, offset, __return_address);
273}
274
275/* Record a corruption while cross-referencing a fork block. */
276void
277xchk_fblock_xref_set_corrupt(
278 struct xfs_scrub *sc,
279 int whichfork,
280 xfs_fileoff_t offset)
281{
282 sc->sm->sm_flags |= XFS_SCRUB_OFLAG_XCORRUPT;
283 trace_xchk_fblock_error(sc, whichfork, offset, __return_address);
284}
285
286/*
287 * Warn about inodes that need administrative review but is not
288 * incorrect.
289 */
290void
291xchk_ino_set_warning(
292 struct xfs_scrub *sc,
293 xfs_ino_t ino)
294{
295 sc->sm->sm_flags |= XFS_SCRUB_OFLAG_WARNING;
296 trace_xchk_ino_warning(sc, ino, __return_address);
297}
298
299/* Warn about a block indexed by a file fork that needs review. */
300void
301xchk_fblock_set_warning(
302 struct xfs_scrub *sc,
303 int whichfork,
304 xfs_fileoff_t offset)
305{
306 sc->sm->sm_flags |= XFS_SCRUB_OFLAG_WARNING;
307 trace_xchk_fblock_warning(sc, whichfork, offset, __return_address);
308}
309
310/* Signal an incomplete scrub. */
311void
312xchk_set_incomplete(
313 struct xfs_scrub *sc)
314{
315 sc->sm->sm_flags |= XFS_SCRUB_OFLAG_INCOMPLETE;
316 trace_xchk_incomplete(sc, __return_address);
317}
318
319/*
320 * rmap scrubbing -- compute the number of blocks with a given owner,
321 * at least according to the reverse mapping data.
322 */
323
324struct xchk_rmap_ownedby_info {
325 const struct xfs_owner_info *oinfo;
326 xfs_filblks_t *blocks;
327};
328
329STATIC int
330xchk_count_rmap_ownedby_irec(
331 struct xfs_btree_cur *cur,
332 const struct xfs_rmap_irec *rec,
333 void *priv)
334{
335 struct xchk_rmap_ownedby_info *sroi = priv;
336 bool irec_attr;
337 bool oinfo_attr;
338
339 irec_attr = rec->rm_flags & XFS_RMAP_ATTR_FORK;
340 oinfo_attr = sroi->oinfo->oi_flags & XFS_OWNER_INFO_ATTR_FORK;
341
342 if (rec->rm_owner != sroi->oinfo->oi_owner)
343 return 0;
344
345 if (XFS_RMAP_NON_INODE_OWNER(rec->rm_owner) || irec_attr == oinfo_attr)
346 (*sroi->blocks) += rec->rm_blockcount;
347
348 return 0;
349}
350
351/*
352 * Calculate the number of blocks the rmap thinks are owned by something.
353 * The caller should pass us an rmapbt cursor.
354 */
355int
356xchk_count_rmap_ownedby_ag(
357 struct xfs_scrub *sc,
358 struct xfs_btree_cur *cur,
359 const struct xfs_owner_info *oinfo,
360 xfs_filblks_t *blocks)
361{
362 struct xchk_rmap_ownedby_info sroi = {
363 .oinfo = oinfo,
364 .blocks = blocks,
365 };
366
367 *blocks = 0;
368 return xfs_rmap_query_all(cur, xchk_count_rmap_ownedby_irec,
369 &sroi);
370}
371
372/*
373 * AG scrubbing
374 *
375 * These helpers facilitate locking an allocation group's header
376 * buffers, setting up cursors for all btrees that are present, and
377 * cleaning everything up once we're through.
378 */
379
380/* Decide if we want to return an AG header read failure. */
381static inline bool
382want_ag_read_header_failure(
383 struct xfs_scrub *sc,
384 unsigned int type)
385{
386 /* Return all AG header read failures when scanning btrees. */
387 if (sc->sm->sm_type != XFS_SCRUB_TYPE_AGF &&
388 sc->sm->sm_type != XFS_SCRUB_TYPE_AGFL &&
389 sc->sm->sm_type != XFS_SCRUB_TYPE_AGI)
390 return true;
391 /*
392 * If we're scanning a given type of AG header, we only want to
393 * see read failures from that specific header. We'd like the
394 * other headers to cross-check them, but this isn't required.
395 */
396 if (sc->sm->sm_type == type)
397 return true;
398 return false;
399}
400
401/*
402 * Grab the AG header buffers for the attached perag structure.
403 *
404 * The headers should be released by xchk_ag_free, but as a fail safe we attach
405 * all the buffers we grab to the scrub transaction so they'll all be freed
406 * when we cancel it.
407 */
408static inline int
409xchk_perag_read_headers(
410 struct xfs_scrub *sc,
411 struct xchk_ag *sa)
412{
413 int error;
414
415 error = xfs_ialloc_read_agi(sa->pag, sc->tp, &sa->agi_bp);
416 if (error && want_ag_read_header_failure(sc, XFS_SCRUB_TYPE_AGI))
417 return error;
418
419 error = xfs_alloc_read_agf(sa->pag, sc->tp, 0, &sa->agf_bp);
420 if (error && want_ag_read_header_failure(sc, XFS_SCRUB_TYPE_AGF))
421 return error;
422
423 return 0;
424}
425
426/*
427 * Grab the AG headers for the attached perag structure and wait for pending
428 * intents to drain.
429 */
430static int
431xchk_perag_drain_and_lock(
432 struct xfs_scrub *sc)
433{
434 struct xchk_ag *sa = &sc->sa;
435 int error = 0;
436
437 ASSERT(sa->pag != NULL);
438 ASSERT(sa->agi_bp == NULL);
439 ASSERT(sa->agf_bp == NULL);
440
441 do {
442 if (xchk_should_terminate(sc, &error))
443 return error;
444
445 error = xchk_perag_read_headers(sc, sa);
446 if (error)
447 return error;
448
449 /*
450 * If we've grabbed an inode for scrubbing then we assume that
451 * holding its ILOCK will suffice to coordinate with any intent
452 * chains involving this inode.
453 */
454 if (sc->ip)
455 return 0;
456
457 /*
458 * Decide if this AG is quiet enough for all metadata to be
459 * consistent with each other. XFS allows the AG header buffer
460 * locks to cycle across transaction rolls while processing
461 * chains of deferred ops, which means that there could be
462 * other threads in the middle of processing a chain of
463 * deferred ops. For regular operations we are careful about
464 * ordering operations to prevent collisions between threads
465 * (which is why we don't need a per-AG lock), but scrub and
466 * repair have to serialize against chained operations.
467 *
468 * We just locked all the AG headers buffers; now take a look
469 * to see if there are any intents in progress. If there are,
470 * drop the AG headers and wait for the intents to drain.
471 * Since we hold all the AG header locks for the duration of
472 * the scrub, this is the only time we have to sample the
473 * intents counter; any threads increasing it after this point
474 * can't possibly be in the middle of a chain of AG metadata
475 * updates.
476 *
477 * Obviously, this should be slanted against scrub and in favor
478 * of runtime threads.
479 */
480 if (!xfs_perag_intent_busy(sa->pag))
481 return 0;
482
483 if (sa->agf_bp) {
484 xfs_trans_brelse(sc->tp, sa->agf_bp);
485 sa->agf_bp = NULL;
486 }
487
488 if (sa->agi_bp) {
489 xfs_trans_brelse(sc->tp, sa->agi_bp);
490 sa->agi_bp = NULL;
491 }
492
493 if (!(sc->flags & XCHK_FSGATES_DRAIN))
494 return -ECHRNG;
495 error = xfs_perag_intent_drain(sa->pag);
496 if (error == -ERESTARTSYS)
497 error = -EINTR;
498 } while (!error);
499
500 return error;
501}
502
503/*
504 * Grab the per-AG structure, grab all AG header buffers, and wait until there
505 * aren't any pending intents. Returns -ENOENT if we can't grab the perag
506 * structure.
507 */
508int
509xchk_ag_read_headers(
510 struct xfs_scrub *sc,
511 xfs_agnumber_t agno,
512 struct xchk_ag *sa)
513{
514 struct xfs_mount *mp = sc->mp;
515
516 ASSERT(!sa->pag);
517 sa->pag = xfs_perag_get(mp, agno);
518 if (!sa->pag)
519 return -ENOENT;
520
521 return xchk_perag_drain_and_lock(sc);
522}
523
524/* Release all the AG btree cursors. */
525void
526xchk_ag_btcur_free(
527 struct xchk_ag *sa)
528{
529 if (sa->refc_cur)
530 xfs_btree_del_cursor(sa->refc_cur, XFS_BTREE_ERROR);
531 if (sa->rmap_cur)
532 xfs_btree_del_cursor(sa->rmap_cur, XFS_BTREE_ERROR);
533 if (sa->fino_cur)
534 xfs_btree_del_cursor(sa->fino_cur, XFS_BTREE_ERROR);
535 if (sa->ino_cur)
536 xfs_btree_del_cursor(sa->ino_cur, XFS_BTREE_ERROR);
537 if (sa->cnt_cur)
538 xfs_btree_del_cursor(sa->cnt_cur, XFS_BTREE_ERROR);
539 if (sa->bno_cur)
540 xfs_btree_del_cursor(sa->bno_cur, XFS_BTREE_ERROR);
541
542 sa->refc_cur = NULL;
543 sa->rmap_cur = NULL;
544 sa->fino_cur = NULL;
545 sa->ino_cur = NULL;
546 sa->bno_cur = NULL;
547 sa->cnt_cur = NULL;
548}
549
550/* Initialize all the btree cursors for an AG. */
551void
552xchk_ag_btcur_init(
553 struct xfs_scrub *sc,
554 struct xchk_ag *sa)
555{
556 struct xfs_mount *mp = sc->mp;
557
558 if (sa->agf_bp &&
559 xchk_ag_btree_healthy_enough(sc, sa->pag, XFS_BTNUM_BNO)) {
560 /* Set up a bnobt cursor for cross-referencing. */
561 sa->bno_cur = xfs_allocbt_init_cursor(mp, sc->tp, sa->agf_bp,
562 sa->pag, XFS_BTNUM_BNO);
563 }
564
565 if (sa->agf_bp &&
566 xchk_ag_btree_healthy_enough(sc, sa->pag, XFS_BTNUM_CNT)) {
567 /* Set up a cntbt cursor for cross-referencing. */
568 sa->cnt_cur = xfs_allocbt_init_cursor(mp, sc->tp, sa->agf_bp,
569 sa->pag, XFS_BTNUM_CNT);
570 }
571
572 /* Set up a inobt cursor for cross-referencing. */
573 if (sa->agi_bp &&
574 xchk_ag_btree_healthy_enough(sc, sa->pag, XFS_BTNUM_INO)) {
575 sa->ino_cur = xfs_inobt_init_cursor(sa->pag, sc->tp, sa->agi_bp,
576 XFS_BTNUM_INO);
577 }
578
579 /* Set up a finobt cursor for cross-referencing. */
580 if (sa->agi_bp && xfs_has_finobt(mp) &&
581 xchk_ag_btree_healthy_enough(sc, sa->pag, XFS_BTNUM_FINO)) {
582 sa->fino_cur = xfs_inobt_init_cursor(sa->pag, sc->tp, sa->agi_bp,
583 XFS_BTNUM_FINO);
584 }
585
586 /* Set up a rmapbt cursor for cross-referencing. */
587 if (sa->agf_bp && xfs_has_rmapbt(mp) &&
588 xchk_ag_btree_healthy_enough(sc, sa->pag, XFS_BTNUM_RMAP)) {
589 sa->rmap_cur = xfs_rmapbt_init_cursor(mp, sc->tp, sa->agf_bp,
590 sa->pag);
591 }
592
593 /* Set up a refcountbt cursor for cross-referencing. */
594 if (sa->agf_bp && xfs_has_reflink(mp) &&
595 xchk_ag_btree_healthy_enough(sc, sa->pag, XFS_BTNUM_REFC)) {
596 sa->refc_cur = xfs_refcountbt_init_cursor(mp, sc->tp,
597 sa->agf_bp, sa->pag);
598 }
599}
600
601/* Release the AG header context and btree cursors. */
602void
603xchk_ag_free(
604 struct xfs_scrub *sc,
605 struct xchk_ag *sa)
606{
607 xchk_ag_btcur_free(sa);
608 xrep_reset_perag_resv(sc);
609 if (sa->agf_bp) {
610 xfs_trans_brelse(sc->tp, sa->agf_bp);
611 sa->agf_bp = NULL;
612 }
613 if (sa->agi_bp) {
614 xfs_trans_brelse(sc->tp, sa->agi_bp);
615 sa->agi_bp = NULL;
616 }
617 if (sa->pag) {
618 xfs_perag_put(sa->pag);
619 sa->pag = NULL;
620 }
621}
622
623/*
624 * For scrub, grab the perag structure, the AGI, and the AGF headers, in that
625 * order. Locking order requires us to get the AGI before the AGF. We use the
626 * transaction to avoid deadlocking on crosslinked metadata buffers; either the
627 * caller passes one in (bmap scrub) or we have to create a transaction
628 * ourselves. Returns ENOENT if the perag struct cannot be grabbed.
629 */
630int
631xchk_ag_init(
632 struct xfs_scrub *sc,
633 xfs_agnumber_t agno,
634 struct xchk_ag *sa)
635{
636 int error;
637
638 error = xchk_ag_read_headers(sc, agno, sa);
639 if (error)
640 return error;
641
642 xchk_ag_btcur_init(sc, sa);
643 return 0;
644}
645
646/* Per-scrubber setup functions */
647
648void
649xchk_trans_cancel(
650 struct xfs_scrub *sc)
651{
652 xfs_trans_cancel(sc->tp);
653 sc->tp = NULL;
654}
655
656/*
657 * Grab an empty transaction so that we can re-grab locked buffers if
658 * one of our btrees turns out to be cyclic.
659 *
660 * If we're going to repair something, we need to ask for the largest possible
661 * log reservation so that we can handle the worst case scenario for metadata
662 * updates while rebuilding a metadata item. We also need to reserve as many
663 * blocks in the head transaction as we think we're going to need to rebuild
664 * the metadata object.
665 */
666int
667xchk_trans_alloc(
668 struct xfs_scrub *sc,
669 uint resblks)
670{
671 if (sc->sm->sm_flags & XFS_SCRUB_IFLAG_REPAIR)
672 return xfs_trans_alloc(sc->mp, &M_RES(sc->mp)->tr_itruncate,
673 resblks, 0, 0, &sc->tp);
674
675 return xfs_trans_alloc_empty(sc->mp, &sc->tp);
676}
677
678/* Set us up with a transaction and an empty context. */
679int
680xchk_setup_fs(
681 struct xfs_scrub *sc)
682{
683 uint resblks;
684
685 resblks = xrep_calc_ag_resblks(sc);
686 return xchk_trans_alloc(sc, resblks);
687}
688
689/* Set us up with AG headers and btree cursors. */
690int
691xchk_setup_ag_btree(
692 struct xfs_scrub *sc,
693 bool force_log)
694{
695 struct xfs_mount *mp = sc->mp;
696 int error;
697
698 /*
699 * If the caller asks us to checkpont the log, do so. This
700 * expensive operation should be performed infrequently and only
701 * as a last resort. Any caller that sets force_log should
702 * document why they need to do so.
703 */
704 if (force_log) {
705 error = xchk_checkpoint_log(mp);
706 if (error)
707 return error;
708 }
709
710 error = xchk_setup_fs(sc);
711 if (error)
712 return error;
713
714 return xchk_ag_init(sc, sc->sm->sm_agno, &sc->sa);
715}
716
717/* Push everything out of the log onto disk. */
718int
719xchk_checkpoint_log(
720 struct xfs_mount *mp)
721{
722 int error;
723
724 error = xfs_log_force(mp, XFS_LOG_SYNC);
725 if (error)
726 return error;
727 xfs_ail_push_all_sync(mp->m_ail);
728 return 0;
729}
730
731/* Verify that an inode is allocated ondisk, then return its cached inode. */
732int
733xchk_iget(
734 struct xfs_scrub *sc,
735 xfs_ino_t inum,
736 struct xfs_inode **ipp)
737{
738 ASSERT(sc->tp != NULL);
739
740 return xfs_iget(sc->mp, sc->tp, inum, XFS_IGET_UNTRUSTED, 0, ipp);
741}
742
743/*
744 * Try to grab an inode in a manner that avoids races with physical inode
745 * allocation. If we can't, return the locked AGI buffer so that the caller
746 * can single-step the loading process to see where things went wrong.
747 * Callers must have a valid scrub transaction.
748 *
749 * If the iget succeeds, return 0, a NULL AGI, and the inode.
750 *
751 * If the iget fails, return the error, the locked AGI, and a NULL inode. This
752 * can include -EINVAL and -ENOENT for invalid inode numbers or inodes that are
753 * no longer allocated; or any other corruption or runtime error.
754 *
755 * If the AGI read fails, return the error, a NULL AGI, and NULL inode.
756 *
757 * If a fatal signal is pending, return -EINTR, a NULL AGI, and a NULL inode.
758 */
759int
760xchk_iget_agi(
761 struct xfs_scrub *sc,
762 xfs_ino_t inum,
763 struct xfs_buf **agi_bpp,
764 struct xfs_inode **ipp)
765{
766 struct xfs_mount *mp = sc->mp;
767 struct xfs_trans *tp = sc->tp;
768 struct xfs_perag *pag;
769 int error;
770
771 ASSERT(sc->tp != NULL);
772
773again:
774 *agi_bpp = NULL;
775 *ipp = NULL;
776 error = 0;
777
778 if (xchk_should_terminate(sc, &error))
779 return error;
780
781 /*
782 * Attach the AGI buffer to the scrub transaction to avoid deadlocks
783 * in the iget cache miss path.
784 */
785 pag = xfs_perag_get(mp, XFS_INO_TO_AGNO(mp, inum));
786 error = xfs_ialloc_read_agi(pag, tp, agi_bpp);
787 xfs_perag_put(pag);
788 if (error)
789 return error;
790
791 error = xfs_iget(mp, tp, inum,
792 XFS_IGET_NORETRY | XFS_IGET_UNTRUSTED, 0, ipp);
793 if (error == -EAGAIN) {
794 /*
795 * The inode may be in core but temporarily unavailable and may
796 * require the AGI buffer before it can be returned. Drop the
797 * AGI buffer and retry the lookup.
798 *
799 * Incore lookup will fail with EAGAIN on a cache hit if the
800 * inode is queued to the inactivation list. The inactivation
801 * worker may remove the inode from the unlinked list and hence
802 * needs the AGI.
803 *
804 * Hence xchk_iget_agi() needs to drop the AGI lock on EAGAIN
805 * to allow inodegc to make progress and move the inode to
806 * IRECLAIMABLE state where xfs_iget will be able to return it
807 * again if it can lock the inode.
808 */
809 xfs_trans_brelse(tp, *agi_bpp);
810 delay(1);
811 goto again;
812 }
813 if (error)
814 return error;
815
816 /* We got the inode, so we can release the AGI. */
817 ASSERT(*ipp != NULL);
818 xfs_trans_brelse(tp, *agi_bpp);
819 *agi_bpp = NULL;
820 return 0;
821}
822
823#ifdef CONFIG_XFS_QUOTA
824/*
825 * Try to attach dquots to this inode if we think we might want to repair it.
826 * Callers must not hold any ILOCKs. If the dquots are broken and cannot be
827 * attached, a quotacheck will be scheduled.
828 */
829int
830xchk_ino_dqattach(
831 struct xfs_scrub *sc)
832{
833 ASSERT(sc->tp != NULL);
834 ASSERT(sc->ip != NULL);
835
836 if (!xchk_could_repair(sc))
837 return 0;
838
839 return xrep_ino_dqattach(sc);
840}
841#endif
842
843/* Install an inode that we opened by handle for scrubbing. */
844int
845xchk_install_handle_inode(
846 struct xfs_scrub *sc,
847 struct xfs_inode *ip)
848{
849 if (VFS_I(ip)->i_generation != sc->sm->sm_gen) {
850 xchk_irele(sc, ip);
851 return -ENOENT;
852 }
853
854 sc->ip = ip;
855 return 0;
856}
857
858/*
859 * Install an already-referenced inode for scrubbing. Get our own reference to
860 * the inode to make disposal simpler. The inode must not be in I_FREEING or
861 * I_WILL_FREE state!
862 */
863int
864xchk_install_live_inode(
865 struct xfs_scrub *sc,
866 struct xfs_inode *ip)
867{
868 if (!igrab(VFS_I(ip))) {
869 xchk_ino_set_corrupt(sc, ip->i_ino);
870 return -EFSCORRUPTED;
871 }
872
873 sc->ip = ip;
874 return 0;
875}
876
877/*
878 * In preparation to scrub metadata structures that hang off of an inode,
879 * grab either the inode referenced in the scrub control structure or the
880 * inode passed in. If the inumber does not reference an allocated inode
881 * record, the function returns ENOENT to end the scrub early. The inode
882 * is not locked.
883 */
884int
885xchk_iget_for_scrubbing(
886 struct xfs_scrub *sc)
887{
888 struct xfs_imap imap;
889 struct xfs_mount *mp = sc->mp;
890 struct xfs_perag *pag;
891 struct xfs_buf *agi_bp;
892 struct xfs_inode *ip_in = XFS_I(file_inode(sc->file));
893 struct xfs_inode *ip = NULL;
894 xfs_agnumber_t agno = XFS_INO_TO_AGNO(mp, sc->sm->sm_ino);
895 int error;
896
897 ASSERT(sc->tp == NULL);
898
899 /* We want to scan the inode we already had opened. */
900 if (sc->sm->sm_ino == 0 || sc->sm->sm_ino == ip_in->i_ino)
901 return xchk_install_live_inode(sc, ip_in);
902
903 /* Reject internal metadata files and obviously bad inode numbers. */
904 if (xfs_internal_inum(mp, sc->sm->sm_ino))
905 return -ENOENT;
906 if (!xfs_verify_ino(sc->mp, sc->sm->sm_ino))
907 return -ENOENT;
908
909 /* Try a safe untrusted iget. */
910 error = xchk_iget_safe(sc, sc->sm->sm_ino, &ip);
911 if (!error)
912 return xchk_install_handle_inode(sc, ip);
913 if (error == -ENOENT)
914 return error;
915 if (error != -EINVAL)
916 goto out_error;
917
918 /*
919 * EINVAL with IGET_UNTRUSTED probably means one of several things:
920 * userspace gave us an inode number that doesn't correspond to fs
921 * space; the inode btree lacks a record for this inode; or there is a
922 * record, and it says this inode is free.
923 *
924 * We want to look up this inode in the inobt to distinguish two
925 * scenarios: (1) the inobt says the inode is free, in which case
926 * there's nothing to do; and (2) the inobt says the inode is
927 * allocated, but loading it failed due to corruption.
928 *
929 * Allocate a transaction and grab the AGI to prevent inobt activity
930 * in this AG. Retry the iget in case someone allocated a new inode
931 * after the first iget failed.
932 */
933 error = xchk_trans_alloc(sc, 0);
934 if (error)
935 goto out_error;
936
937 error = xchk_iget_agi(sc, sc->sm->sm_ino, &agi_bp, &ip);
938 if (error == 0) {
939 /* Actually got the inode, so install it. */
940 xchk_trans_cancel(sc);
941 return xchk_install_handle_inode(sc, ip);
942 }
943 if (error == -ENOENT)
944 goto out_gone;
945 if (error != -EINVAL)
946 goto out_cancel;
947
948 /* Ensure that we have protected against inode allocation/freeing. */
949 if (agi_bp == NULL) {
950 ASSERT(agi_bp != NULL);
951 error = -ECANCELED;
952 goto out_cancel;
953 }
954
955 /*
956 * Untrusted iget failed a second time. Let's try an inobt lookup.
957 * If the inobt thinks this the inode neither can exist inside the
958 * filesystem nor is allocated, return ENOENT to signal that the check
959 * can be skipped.
960 *
961 * If the lookup returns corruption, we'll mark this inode corrupt and
962 * exit to userspace. There's little chance of fixing anything until
963 * the inobt is straightened out, but there's nothing we can do here.
964 *
965 * If the lookup encounters any other error, exit to userspace.
966 *
967 * If the lookup succeeds, something else must be very wrong in the fs
968 * such that setting up the incore inode failed in some strange way.
969 * Treat those as corruptions.
970 */
971 pag = xfs_perag_get(mp, XFS_INO_TO_AGNO(mp, sc->sm->sm_ino));
972 if (!pag) {
973 error = -EFSCORRUPTED;
974 goto out_cancel;
975 }
976
977 error = xfs_imap(pag, sc->tp, sc->sm->sm_ino, &imap,
978 XFS_IGET_UNTRUSTED);
979 xfs_perag_put(pag);
980 if (error == -EINVAL || error == -ENOENT)
981 goto out_gone;
982 if (!error)
983 error = -EFSCORRUPTED;
984
985out_cancel:
986 xchk_trans_cancel(sc);
987out_error:
988 trace_xchk_op_error(sc, agno, XFS_INO_TO_AGBNO(mp, sc->sm->sm_ino),
989 error, __return_address);
990 return error;
991out_gone:
992 /* The file is gone, so there's nothing to check. */
993 xchk_trans_cancel(sc);
994 return -ENOENT;
995}
996
997/* Release an inode, possibly dropping it in the process. */
998void
999xchk_irele(
1000 struct xfs_scrub *sc,
1001 struct xfs_inode *ip)
1002{
1003 if (current->journal_info != NULL) {
1004 ASSERT(current->journal_info == sc->tp);
1005
1006 /*
1007 * If we are in a transaction, we /cannot/ drop the inode
1008 * ourselves, because the VFS will trigger writeback, which
1009 * can require a transaction. Clear DONTCACHE to force the
1010 * inode to the LRU, where someone else can take care of
1011 * dropping it.
1012 *
1013 * Note that when we grabbed our reference to the inode, it
1014 * could have had an active ref and DONTCACHE set if a sysadmin
1015 * is trying to coerce a change in file access mode. icache
1016 * hits do not clear DONTCACHE, so we must do it here.
1017 */
1018 spin_lock(&VFS_I(ip)->i_lock);
1019 VFS_I(ip)->i_state &= ~I_DONTCACHE;
1020 spin_unlock(&VFS_I(ip)->i_lock);
1021 } else if (atomic_read(&VFS_I(ip)->i_count) == 1) {
1022 /*
1023 * If this is the last reference to the inode and the caller
1024 * permits it, set DONTCACHE to avoid thrashing.
1025 */
1026 d_mark_dontcache(VFS_I(ip));
1027 }
1028
1029 xfs_irele(ip);
1030}
1031
1032/*
1033 * Set us up to scrub metadata mapped by a file's fork. Callers must not use
1034 * this to operate on user-accessible regular file data because the MMAPLOCK is
1035 * not taken.
1036 */
1037int
1038xchk_setup_inode_contents(
1039 struct xfs_scrub *sc,
1040 unsigned int resblks)
1041{
1042 int error;
1043
1044 error = xchk_iget_for_scrubbing(sc);
1045 if (error)
1046 return error;
1047
1048 /* Lock the inode so the VFS cannot touch this file. */
1049 xchk_ilock(sc, XFS_IOLOCK_EXCL);
1050
1051 error = xchk_trans_alloc(sc, resblks);
1052 if (error)
1053 goto out;
1054
1055 error = xchk_ino_dqattach(sc);
1056 if (error)
1057 goto out;
1058
1059 xchk_ilock(sc, XFS_ILOCK_EXCL);
1060out:
1061 /* scrub teardown will unlock and release the inode for us */
1062 return error;
1063}
1064
1065void
1066xchk_ilock(
1067 struct xfs_scrub *sc,
1068 unsigned int ilock_flags)
1069{
1070 xfs_ilock(sc->ip, ilock_flags);
1071 sc->ilock_flags |= ilock_flags;
1072}
1073
1074bool
1075xchk_ilock_nowait(
1076 struct xfs_scrub *sc,
1077 unsigned int ilock_flags)
1078{
1079 if (xfs_ilock_nowait(sc->ip, ilock_flags)) {
1080 sc->ilock_flags |= ilock_flags;
1081 return true;
1082 }
1083
1084 return false;
1085}
1086
1087void
1088xchk_iunlock(
1089 struct xfs_scrub *sc,
1090 unsigned int ilock_flags)
1091{
1092 sc->ilock_flags &= ~ilock_flags;
1093 xfs_iunlock(sc->ip, ilock_flags);
1094}
1095
1096/*
1097 * Predicate that decides if we need to evaluate the cross-reference check.
1098 * If there was an error accessing the cross-reference btree, just delete
1099 * the cursor and skip the check.
1100 */
1101bool
1102xchk_should_check_xref(
1103 struct xfs_scrub *sc,
1104 int *error,
1105 struct xfs_btree_cur **curpp)
1106{
1107 /* No point in xref if we already know we're corrupt. */
1108 if (xchk_skip_xref(sc->sm))
1109 return false;
1110
1111 if (*error == 0)
1112 return true;
1113
1114 if (curpp) {
1115 /* If we've already given up on xref, just bail out. */
1116 if (!*curpp)
1117 return false;
1118
1119 /* xref error, delete cursor and bail out. */
1120 xfs_btree_del_cursor(*curpp, XFS_BTREE_ERROR);
1121 *curpp = NULL;
1122 }
1123
1124 sc->sm->sm_flags |= XFS_SCRUB_OFLAG_XFAIL;
1125 trace_xchk_xref_error(sc, *error, __return_address);
1126
1127 /*
1128 * Errors encountered during cross-referencing with another
1129 * data structure should not cause this scrubber to abort.
1130 */
1131 *error = 0;
1132 return false;
1133}
1134
1135/* Run the structure verifiers on in-memory buffers to detect bad memory. */
1136void
1137xchk_buffer_recheck(
1138 struct xfs_scrub *sc,
1139 struct xfs_buf *bp)
1140{
1141 xfs_failaddr_t fa;
1142
1143 if (bp->b_ops == NULL) {
1144 xchk_block_set_corrupt(sc, bp);
1145 return;
1146 }
1147 if (bp->b_ops->verify_struct == NULL) {
1148 xchk_set_incomplete(sc);
1149 return;
1150 }
1151 fa = bp->b_ops->verify_struct(bp);
1152 if (!fa)
1153 return;
1154 sc->sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;
1155 trace_xchk_block_error(sc, xfs_buf_daddr(bp), fa);
1156}
1157
1158static inline int
1159xchk_metadata_inode_subtype(
1160 struct xfs_scrub *sc,
1161 unsigned int scrub_type)
1162{
1163 __u32 smtype = sc->sm->sm_type;
1164 unsigned int sick_mask = sc->sick_mask;
1165 int error;
1166
1167 sc->sm->sm_type = scrub_type;
1168
1169 switch (scrub_type) {
1170 case XFS_SCRUB_TYPE_INODE:
1171 error = xchk_inode(sc);
1172 break;
1173 case XFS_SCRUB_TYPE_BMBTD:
1174 error = xchk_bmap_data(sc);
1175 break;
1176 default:
1177 ASSERT(0);
1178 error = -EFSCORRUPTED;
1179 break;
1180 }
1181
1182 sc->sick_mask = sick_mask;
1183 sc->sm->sm_type = smtype;
1184 return error;
1185}
1186
1187/*
1188 * Scrub the attr/data forks of a metadata inode. The metadata inode must be
1189 * pointed to by sc->ip and the ILOCK must be held.
1190 */
1191int
1192xchk_metadata_inode_forks(
1193 struct xfs_scrub *sc)
1194{
1195 bool shared;
1196 int error;
1197
1198 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
1199 return 0;
1200
1201 /* Check the inode record. */
1202 error = xchk_metadata_inode_subtype(sc, XFS_SCRUB_TYPE_INODE);
1203 if (error || (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT))
1204 return error;
1205
1206 /* Metadata inodes don't live on the rt device. */
1207 if (sc->ip->i_diflags & XFS_DIFLAG_REALTIME) {
1208 xchk_ino_set_corrupt(sc, sc->ip->i_ino);
1209 return 0;
1210 }
1211
1212 /* They should never participate in reflink. */
1213 if (xfs_is_reflink_inode(sc->ip)) {
1214 xchk_ino_set_corrupt(sc, sc->ip->i_ino);
1215 return 0;
1216 }
1217
1218 /* They also should never have extended attributes. */
1219 if (xfs_inode_hasattr(sc->ip)) {
1220 xchk_ino_set_corrupt(sc, sc->ip->i_ino);
1221 return 0;
1222 }
1223
1224 /* Invoke the data fork scrubber. */
1225 error = xchk_metadata_inode_subtype(sc, XFS_SCRUB_TYPE_BMBTD);
1226 if (error || (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT))
1227 return error;
1228
1229 /* Look for incorrect shared blocks. */
1230 if (xfs_has_reflink(sc->mp)) {
1231 error = xfs_reflink_inode_has_shared_extents(sc->tp, sc->ip,
1232 &shared);
1233 if (!xchk_fblock_process_error(sc, XFS_DATA_FORK, 0,
1234 &error))
1235 return error;
1236 if (shared)
1237 xchk_ino_set_corrupt(sc, sc->ip->i_ino);
1238 }
1239
1240 return 0;
1241}
1242
1243/*
1244 * Enable filesystem hooks (i.e. runtime code patching) before starting a scrub
1245 * operation. Callers must not hold any locks that intersect with the CPU
1246 * hotplug lock (e.g. writeback locks) because code patching must halt the CPUs
1247 * to change kernel code.
1248 */
1249void
1250xchk_fsgates_enable(
1251 struct xfs_scrub *sc,
1252 unsigned int scrub_fsgates)
1253{
1254 ASSERT(!(scrub_fsgates & ~XCHK_FSGATES_ALL));
1255 ASSERT(!(sc->flags & scrub_fsgates));
1256
1257 trace_xchk_fsgates_enable(sc, scrub_fsgates);
1258
1259 if (scrub_fsgates & XCHK_FSGATES_DRAIN)
1260 xfs_drain_wait_enable();
1261
1262 sc->flags |= scrub_fsgates;
1263}
1264
1265/*
1266 * Decide if this is this a cached inode that's also allocated. The caller
1267 * must hold a reference to an AG and the AGI buffer lock to prevent inodes
1268 * from being allocated or freed.
1269 *
1270 * Look up an inode by number in the given file system. If the inode number
1271 * is invalid, return -EINVAL. If the inode is not in cache, return -ENODATA.
1272 * If the inode is being reclaimed, return -ENODATA because we know the inode
1273 * cache cannot be updating the ondisk metadata.
1274 *
1275 * Otherwise, the incore inode is the one we want, and it is either live,
1276 * somewhere in the inactivation machinery, or reclaimable. The inode is
1277 * allocated if i_mode is nonzero. In all three cases, the cached inode will
1278 * be more up to date than the ondisk inode buffer, so we must use the incore
1279 * i_mode.
1280 */
1281int
1282xchk_inode_is_allocated(
1283 struct xfs_scrub *sc,
1284 xfs_agino_t agino,
1285 bool *inuse)
1286{
1287 struct xfs_mount *mp = sc->mp;
1288 struct xfs_perag *pag = sc->sa.pag;
1289 xfs_ino_t ino;
1290 struct xfs_inode *ip;
1291 int error;
1292
1293 /* caller must hold perag reference */
1294 if (pag == NULL) {
1295 ASSERT(pag != NULL);
1296 return -EINVAL;
1297 }
1298
1299 /* caller must have AGI buffer */
1300 if (sc->sa.agi_bp == NULL) {
1301 ASSERT(sc->sa.agi_bp != NULL);
1302 return -EINVAL;
1303 }
1304
1305 /* reject inode numbers outside existing AGs */
1306 ino = XFS_AGINO_TO_INO(sc->mp, pag->pag_agno, agino);
1307 if (!xfs_verify_ino(mp, ino))
1308 return -EINVAL;
1309
1310 error = -ENODATA;
1311 rcu_read_lock();
1312 ip = radix_tree_lookup(&pag->pag_ici_root, agino);
1313 if (!ip) {
1314 /* cache miss */
1315 goto out_rcu;
1316 }
1317
1318 /*
1319 * If the inode number doesn't match, the incore inode got reused
1320 * during an RCU grace period and the radix tree hasn't been updated.
1321 * This isn't the inode we want.
1322 */
1323 spin_lock(&ip->i_flags_lock);
1324 if (ip->i_ino != ino)
1325 goto out_skip;
1326
1327 trace_xchk_inode_is_allocated(ip);
1328
1329 /*
1330 * We have an incore inode that matches the inode we want, and the
1331 * caller holds the perag structure and the AGI buffer. Let's check
1332 * our assumptions below:
1333 */
1334
1335#ifdef DEBUG
1336 /*
1337 * (1) If the incore inode is live (i.e. referenced from the dcache),
1338 * it will not be INEW, nor will it be in the inactivation or reclaim
1339 * machinery. The ondisk inode had better be allocated. This is the
1340 * most trivial case.
1341 */
1342 if (!(ip->i_flags & (XFS_NEED_INACTIVE | XFS_INEW | XFS_IRECLAIMABLE |
1343 XFS_INACTIVATING))) {
1344 /* live inode */
1345 ASSERT(VFS_I(ip)->i_mode != 0);
1346 }
1347
1348 /*
1349 * If the incore inode is INEW, there are several possibilities:
1350 *
1351 * (2) For a file that is being created, note that we allocate the
1352 * ondisk inode before allocating, initializing, and adding the incore
1353 * inode to the radix tree.
1354 *
1355 * (3) If the incore inode is being recycled, the inode has to be
1356 * allocated because we don't allow freed inodes to be recycled.
1357 * Recycling doesn't touch i_mode.
1358 */
1359 if (ip->i_flags & XFS_INEW) {
1360 /* created on disk already or recycling */
1361 ASSERT(VFS_I(ip)->i_mode != 0);
1362 }
1363
1364 /*
1365 * (4) If the inode is queued for inactivation (NEED_INACTIVE) but
1366 * inactivation has not started (!INACTIVATING), it is still allocated.
1367 */
1368 if ((ip->i_flags & XFS_NEED_INACTIVE) &&
1369 !(ip->i_flags & XFS_INACTIVATING)) {
1370 /* definitely before difree */
1371 ASSERT(VFS_I(ip)->i_mode != 0);
1372 }
1373#endif
1374
1375 /*
1376 * If the incore inode is undergoing inactivation (INACTIVATING), there
1377 * are two possibilities:
1378 *
1379 * (5) It is before the point where it would get freed ondisk, in which
1380 * case i_mode is still nonzero.
1381 *
1382 * (6) It has already been freed, in which case i_mode is zero.
1383 *
1384 * We don't take the ILOCK here, but difree and dialloc update the AGI,
1385 * and we've taken the AGI buffer lock, which prevents that from
1386 * happening.
1387 */
1388
1389 /*
1390 * (7) Inodes undergoing inactivation (INACTIVATING) or queued for
1391 * reclaim (IRECLAIMABLE) could be allocated or free. i_mode still
1392 * reflects the ondisk state.
1393 */
1394
1395 /*
1396 * (8) If the inode is in IFLUSHING, it's safe to query i_mode because
1397 * the flush code uses i_mode to format the ondisk inode.
1398 */
1399
1400 /*
1401 * (9) If the inode is in IRECLAIM and was reachable via the radix
1402 * tree, it still has the same i_mode as it did before it entered
1403 * reclaim. The inode object is still alive because we hold the RCU
1404 * read lock.
1405 */
1406
1407 *inuse = VFS_I(ip)->i_mode != 0;
1408 error = 0;
1409
1410out_skip:
1411 spin_unlock(&ip->i_flags_lock);
1412out_rcu:
1413 rcu_read_unlock();
1414 return error;
1415}