354 lines · c
1// SPDX-License-Identifier: GPL-2.0-or-later2/*3 * Copyright (c) 2021-2024 Oracle. All Rights Reserved.4 * Author: Darrick J. Wong <djwong@kernel.org>5 */6#include "xfs.h"7#include "xfs_fs.h"8#include "xfs_shared.h"9#include "xfs_format.h"10#include "xfs_trans_resv.h"11#include "xfs_mount.h"12#include "xfs_log_format.h"13#include "xfs_trans.h"14#include "xfs_inode.h"15#include "xfs_icache.h"16#include "xfs_bmap_util.h"17#include "xfs_iwalk.h"18#include "xfs_ialloc.h"19#include "xfs_sb.h"20#include "xfs_ag.h"21#include "xfs_dir2.h"22#include "xfs_parent.h"23#include "scrub/scrub.h"24#include "scrub/common.h"25#include "scrub/repair.h"26#include "scrub/xfile.h"27#include "scrub/xfarray.h"28#include "scrub/iscan.h"29#include "scrub/orphanage.h"30#include "scrub/nlinks.h"31#include "scrub/trace.h"32#include "scrub/tempfile.h"33 34/*35 * Live Inode Link Count Repair36 * ============================37 *38 * Use the live inode link count information that we collected to replace the39 * nlink values of the incore inodes. A scrub->repair cycle should have left40 * the live data and hooks active, so this is safe so long as we make sure the41 * inode is locked.42 */43 44/* Set up to repair inode link counts. */45int46xrep_setup_nlinks(47 struct xfs_scrub *sc)48{49 return xrep_orphanage_try_create(sc);50}51 52/*53 * Inodes that aren't the root directory or the orphanage, have a nonzero link54 * count, and no observed parents should be moved to the orphanage.55 */56static inline bool57xrep_nlinks_is_orphaned(58 struct xfs_scrub *sc,59 struct xfs_inode *ip,60 unsigned int actual_nlink,61 const struct xchk_nlink *obs)62{63 struct xfs_mount *mp = ip->i_mount;64 65 if (obs->parents != 0)66 return false;67 if (ip == mp->m_rootip || ip == sc->orphanage)68 return false;69 return actual_nlink != 0;70}71 72/* Remove an inode from the unlinked list. */73STATIC int74xrep_nlinks_iunlink_remove(75 struct xfs_scrub *sc)76{77 struct xfs_perag *pag;78 int error;79 80 pag = xfs_perag_get(sc->mp, XFS_INO_TO_AGNO(sc->mp, sc->ip->i_ino));81 error = xfs_iunlink_remove(sc->tp, pag, sc->ip);82 xfs_perag_put(pag);83 return error;84}85 86/*87 * Correct the link count of the given inode. Because we have to grab locks88 * and resources in a certain order, it's possible that this will be a no-op.89 */90STATIC int91xrep_nlinks_repair_inode(92 struct xchk_nlink_ctrs *xnc)93{94 struct xchk_nlink obs;95 struct xfs_scrub *sc = xnc->sc;96 struct xfs_mount *mp = sc->mp;97 struct xfs_inode *ip = sc->ip;98 uint64_t total_links;99 uint64_t actual_nlink;100 bool orphanage_available = false;101 bool dirty = false;102 int error;103 104 /*105 * Ignore temporary files being used to stage repairs, since we assume106 * they're correct for non-directories, and the directory repair code107 * doesn't bump the link counts for the children.108 */109 if (xrep_is_tempfile(ip))110 return 0;111 112 /*113 * If the filesystem has an orphanage attached to the scrub context,114 * prepare for a link count repair that could involve @ip being adopted115 * by the lost+found.116 */117 if (xrep_orphanage_can_adopt(sc)) {118 error = xrep_orphanage_iolock_two(sc);119 if (error)120 return error;121 122 error = xrep_adoption_trans_alloc(sc, &xnc->adoption);123 if (error) {124 xchk_iunlock(sc, XFS_IOLOCK_EXCL);125 xrep_orphanage_iunlock(sc, XFS_IOLOCK_EXCL);126 } else {127 orphanage_available = true;128 }129 }130 131 /*132 * Either there is no orphanage or we couldn't allocate resources for133 * that kind of update. Let's try again with only the resources we134 * need for a simple link count update, since that's much more common.135 */136 if (!orphanage_available) {137 xchk_ilock(sc, XFS_IOLOCK_EXCL);138 139 error = xfs_trans_alloc(mp, &M_RES(mp)->tr_link, 0, 0, 0,140 &sc->tp);141 if (error) {142 xchk_iunlock(sc, XFS_IOLOCK_EXCL);143 return error;144 }145 146 xchk_ilock(sc, XFS_ILOCK_EXCL);147 xfs_trans_ijoin(sc->tp, ip, 0);148 }149 150 mutex_lock(&xnc->lock);151 152 if (xchk_iscan_aborted(&xnc->collect_iscan)) {153 error = -ECANCELED;154 goto out_scanlock;155 }156 157 error = xfarray_load_sparse(xnc->nlinks, ip->i_ino, &obs);158 if (error)159 goto out_scanlock;160 161 /*162 * We're done accessing the shared scan data, so we can drop the lock.163 * We still hold @ip's ILOCK, so its link count cannot change.164 */165 mutex_unlock(&xnc->lock);166 167 total_links = xchk_nlink_total(ip, &obs);168 actual_nlink = VFS_I(ip)->i_nlink;169 170 /*171 * Non-directories cannot have directories pointing up to them.172 *173 * We previously set error to zero, but set it again because one static174 * checker author fears that programmers will fail to maintain this175 * invariant and built their tool to flag this as a security risk. A176 * different tool author made their bot complain about the redundant177 * store. This is a never-ending and stupid battle; both tools missed178 * *actual bugs* elsewhere; and I no longer care.179 */180 if (!S_ISDIR(VFS_I(ip)->i_mode) && obs.children != 0) {181 trace_xrep_nlinks_unfixable_inode(mp, ip, &obs);182 error = 0;183 goto out_trans;184 }185 186 /*187 * Decide if we're going to move this file to the orphanage, and fix188 * up the incore link counts if we are.189 */190 if (orphanage_available &&191 xrep_nlinks_is_orphaned(sc, ip, actual_nlink, &obs)) {192 /* Figure out what name we're going to use here. */193 error = xrep_adoption_compute_name(&xnc->adoption, &xnc->xname);194 if (error)195 goto out_trans;196 197 /*198 * Reattach this file to the directory tree by moving it to199 * the orphanage per the adoption parameters that we already200 * computed.201 */202 error = xrep_adoption_move(&xnc->adoption);203 if (error)204 goto out_trans;205 206 /*207 * Re-read the link counts since the reparenting will have208 * updated our scan info.209 */210 mutex_lock(&xnc->lock);211 error = xfarray_load_sparse(xnc->nlinks, ip->i_ino, &obs);212 mutex_unlock(&xnc->lock);213 if (error)214 goto out_trans;215 216 total_links = xchk_nlink_total(ip, &obs);217 actual_nlink = VFS_I(ip)->i_nlink;218 dirty = true;219 }220 221 /*222 * If this inode is linked from the directory tree and on the unlinked223 * list, remove it from the unlinked list.224 */225 if (total_links > 0 && xfs_inode_on_unlinked_list(ip)) {226 error = xrep_nlinks_iunlink_remove(sc);227 if (error)228 goto out_trans;229 dirty = true;230 }231 232 /*233 * If this inode is not linked from the directory tree yet not on the234 * unlinked list, put it on the unlinked list.235 */236 if (total_links == 0 && !xfs_inode_on_unlinked_list(ip)) {237 error = xfs_iunlink(sc->tp, ip);238 if (error)239 goto out_trans;240 dirty = true;241 }242 243 /* Commit the new link count if it changed. */244 if (total_links != actual_nlink) {245 trace_xrep_nlinks_update_inode(mp, ip, &obs);246 247 set_nlink(VFS_I(ip), min_t(unsigned long long, total_links,248 XFS_NLINK_PINNED));249 dirty = true;250 }251 252 if (!dirty) {253 error = 0;254 goto out_trans;255 }256 257 xfs_trans_log_inode(sc->tp, ip, XFS_ILOG_CORE);258 259 error = xrep_trans_commit(sc);260 goto out_unlock;261 262out_scanlock:263 mutex_unlock(&xnc->lock);264out_trans:265 xchk_trans_cancel(sc);266out_unlock:267 xchk_iunlock(sc, XFS_ILOCK_EXCL);268 if (orphanage_available) {269 xrep_orphanage_iunlock(sc, XFS_ILOCK_EXCL);270 xrep_orphanage_iunlock(sc, XFS_IOLOCK_EXCL);271 }272 xchk_iunlock(sc, XFS_IOLOCK_EXCL);273 return error;274}275 276/*277 * Try to visit every inode in the filesystem for repairs. Move on if we can't278 * grab an inode, since we're still making forward progress.279 */280static int281xrep_nlinks_iter(282 struct xchk_nlink_ctrs *xnc,283 struct xfs_inode **ipp)284{285 int error;286 287 do {288 error = xchk_iscan_iter(&xnc->compare_iscan, ipp);289 } while (error == -EBUSY);290 291 return error;292}293 294/* Commit the new inode link counters. */295int296xrep_nlinks(297 struct xfs_scrub *sc)298{299 struct xchk_nlink_ctrs *xnc = sc->buf;300 int error;301 302 /*303 * We need ftype for an accurate count of the number of child304 * subdirectory links. Child subdirectories with a back link (dotdot305 * entry) but no forward link are moved to the orphanage, so we cannot306 * repair the link count of the parent directory based on the back link307 * count alone. Filesystems without ftype support are rare (old V4) so308 * we just skip out here.309 */310 if (!xfs_has_ftype(sc->mp))311 return -EOPNOTSUPP;312 313 /*314 * Use the inobt to walk all allocated inodes to compare and fix the315 * link counts. Retry iget every tenth of a second for up to 30316 * seconds -- even if repair misses a few inodes, we still try to fix317 * as many of them as we can.318 */319 xchk_iscan_start(sc, 30000, 100, &xnc->compare_iscan);320 ASSERT(sc->ip == NULL);321 322 while ((error = xrep_nlinks_iter(xnc, &sc->ip)) == 1) {323 /*324 * Commit the scrub transaction so that we can create repair325 * transactions with the correct reservations.326 */327 xchk_trans_cancel(sc);328 329 error = xrep_nlinks_repair_inode(xnc);330 xchk_iscan_mark_visited(&xnc->compare_iscan, sc->ip);331 xchk_irele(sc, sc->ip);332 sc->ip = NULL;333 if (error)334 break;335 336 if (xchk_should_terminate(sc, &error))337 break;338 339 /*340 * Create a new empty transaction so that we can advance the341 * iscan cursor without deadlocking if the inobt has a cycle.342 * We can only push the inactivation workqueues with an empty343 * transaction.344 */345 error = xchk_trans_alloc_empty(sc);346 if (error)347 break;348 }349 xchk_iscan_iter_finish(&xnc->compare_iscan);350 xchk_iscan_teardown(&xnc->compare_iscan);351 352 return error;353}354