1// SPDX-License-Identifier: GPL-2.0-or-later
  2/*
  3 * Copyright (c) 2021-2024 Oracle.  All Rights Reserved.
  4 * Author: Darrick J. Wong <djwong@kernel.org>
  5 */
  6#include "xfs.h"
  7#include "xfs_fs.h"
  8#include "xfs_shared.h"
  9#include "xfs_format.h"
 10#include "xfs_trans_resv.h"
 11#include "xfs_mount.h"
 12#include "xfs_log_format.h"
 13#include "xfs_trans.h"
 14#include "xfs_inode.h"
 15#include "xfs_icache.h"
 16#include "xfs_bmap_util.h"
 17#include "xfs_iwalk.h"
 18#include "xfs_ialloc.h"
 19#include "xfs_sb.h"
 20#include "scrub/scrub.h"
 21#include "scrub/common.h"
 22#include "scrub/repair.h"
 23#include "scrub/xfile.h"
 24#include "scrub/xfarray.h"
 25#include "scrub/iscan.h"
 26#include "scrub/nlinks.h"
 27#include "scrub/trace.h"
 28
 29/*
 30 * Live Inode Link Count Repair
 31 * ============================
 32 *
 33 * Use the live inode link count information that we collected to replace the
 34 * nlink values of the incore inodes.  A scrub->repair cycle should have left
 35 * the live data and hooks active, so this is safe so long as we make sure the
 36 * inode is locked.
 37 */
 38
 39/*
 40 * Correct the link count of the given inode.  Because we have to grab locks
 41 * and resources in a certain order, it's possible that this will be a no-op.
 42 */
 43STATIC int
 44xrep_nlinks_repair_inode(
 45	struct xchk_nlink_ctrs	*xnc)
 46{
 47	struct xchk_nlink	obs;
 48	struct xfs_scrub	*sc = xnc->sc;
 49	struct xfs_mount	*mp = sc->mp;
 50	struct xfs_inode	*ip = sc->ip;
 51	uint64_t		total_links;
 52	uint64_t		actual_nlink;
 53	bool			dirty = false;
 54	int			error;
 55
 56	xchk_ilock(sc, XFS_IOLOCK_EXCL);
 57
 58	error = xfs_trans_alloc(mp, &M_RES(mp)->tr_link, 0, 0, 0, &sc->tp);
 59	if (error)
 60		return error;
 61
 62	xchk_ilock(sc, XFS_ILOCK_EXCL);
 63	xfs_trans_ijoin(sc->tp, ip, 0);
 64
 65	mutex_lock(&xnc->lock);
 66
 67	if (xchk_iscan_aborted(&xnc->collect_iscan)) {
 68		error = -ECANCELED;
 69		goto out_scanlock;
 70	}
 71
 72	error = xfarray_load_sparse(xnc->nlinks, ip->i_ino, &obs);
 73	if (error)
 74		goto out_scanlock;
 75
 76	/*
 77	 * We're done accessing the shared scan data, so we can drop the lock.
 78	 * We still hold @ip's ILOCK, so its link count cannot change.
 79	 */
 80	mutex_unlock(&xnc->lock);
 81
 82	total_links = xchk_nlink_total(ip, &obs);
 83	actual_nlink = VFS_I(ip)->i_nlink;
 84
 85	/*
 86	 * Non-directories cannot have directories pointing up to them.
 87	 *
 88	 * We previously set error to zero, but set it again because one static
 89	 * checker author fears that programmers will fail to maintain this
 90	 * invariant and built their tool to flag this as a security risk.  A
 91	 * different tool author made their bot complain about the redundant
 92	 * store.  This is a never-ending and stupid battle; both tools missed
 93	 * *actual bugs* elsewhere; and I no longer care.
 94	 */
 95	if (!S_ISDIR(VFS_I(ip)->i_mode) && obs.children != 0) {
 96		trace_xrep_nlinks_unfixable_inode(mp, ip, &obs);
 97		error = 0;
 98		goto out_trans;
 99	}
100
101	/*
102	 * We did not find any links to this inode.  If the inode agrees, we
103	 * have nothing further to do.  If not, the inode has a nonzero link
104	 * count and we don't have anywhere to graft the child onto.  Dropping
105	 * a live inode's link count to zero can cause unexpected shutdowns in
106	 * inactivation, so leave it alone.
107	 */
108	if (total_links == 0) {
109		if (actual_nlink != 0)
110			trace_xrep_nlinks_unfixable_inode(mp, ip, &obs);
111		goto out_trans;
112	}
113
114	/* Commit the new link count if it changed. */
115	if (total_links != actual_nlink) {
116		if (total_links > XFS_MAXLINK) {
117			trace_xrep_nlinks_unfixable_inode(mp, ip, &obs);
118			goto out_trans;
119		}
120
121		trace_xrep_nlinks_update_inode(mp, ip, &obs);
122
123		set_nlink(VFS_I(ip), total_links);
124		dirty = true;
125	}
126
127	if (!dirty) {
128		error = 0;
129		goto out_trans;
130	}
131
132	xfs_trans_log_inode(sc->tp, ip, XFS_ILOG_CORE);
133
134	error = xrep_trans_commit(sc);
135	xchk_iunlock(sc, XFS_ILOCK_EXCL | XFS_IOLOCK_EXCL);
136	return error;
137
138out_scanlock:
139	mutex_unlock(&xnc->lock);
140out_trans:
141	xchk_trans_cancel(sc);
142	xchk_iunlock(sc, XFS_ILOCK_EXCL | XFS_IOLOCK_EXCL);
143	return error;
144}
145
146/*
147 * Try to visit every inode in the filesystem for repairs.  Move on if we can't
148 * grab an inode, since we're still making forward progress.
149 */
150static int
151xrep_nlinks_iter(
152	struct xchk_nlink_ctrs	*xnc,
153	struct xfs_inode	**ipp)
154{
155	int			error;
156
157	do {
158		error = xchk_iscan_iter(&xnc->compare_iscan, ipp);
159	} while (error == -EBUSY);
160
161	return error;
162}
163
164/* Commit the new inode link counters. */
165int
166xrep_nlinks(
167	struct xfs_scrub	*sc)
168{
169	struct xchk_nlink_ctrs	*xnc = sc->buf;
170	int			error;
171
172	/*
173	 * We need ftype for an accurate count of the number of child
174	 * subdirectory links.  Child subdirectories with a back link (dotdot
175	 * entry) but no forward link are unfixable, so we cannot repair the
176	 * link count of the parent directory based on the back link count
177	 * alone.  Filesystems without ftype support are rare (old V4) so we
178	 * just skip out here.
179	 */
180	if (!xfs_has_ftype(sc->mp))
181		return -EOPNOTSUPP;
182
183	/*
184	 * Use the inobt to walk all allocated inodes to compare and fix the
185	 * link counts.  Retry iget every tenth of a second for up to 30
186	 * seconds -- even if repair misses a few inodes, we still try to fix
187	 * as many of them as we can.
188	 */
189	xchk_iscan_start(sc, 30000, 100, &xnc->compare_iscan);
190	ASSERT(sc->ip == NULL);
191
192	while ((error = xrep_nlinks_iter(xnc, &sc->ip)) == 1) {
193		/*
194		 * Commit the scrub transaction so that we can create repair
195		 * transactions with the correct reservations.
196		 */
197		xchk_trans_cancel(sc);
198
199		error = xrep_nlinks_repair_inode(xnc);
200		xchk_iscan_mark_visited(&xnc->compare_iscan, sc->ip);
201		xchk_irele(sc, sc->ip);
202		sc->ip = NULL;
203		if (error)
204			break;
205
206		if (xchk_should_terminate(sc, &error))
207			break;
208
209		/*
210		 * Create a new empty transaction so that we can advance the
211		 * iscan cursor without deadlocking if the inobt has a cycle.
212		 * We can only push the inactivation workqueues with an empty
213		 * transaction.
214		 */
215		error = xchk_trans_alloc_empty(sc);
216		if (error)
217			break;
218	}
219	xchk_iscan_iter_finish(&xnc->compare_iscan);
220	xchk_iscan_teardown(&xnc->compare_iscan);
221
222	return error;
223}