1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * Copyright (c) 2021-2024 Oracle. All Rights Reserved.
4 * Author: Darrick J. Wong <djwong@kernel.org>
5 */
6#include "xfs.h"
7#include "xfs_fs.h"
8#include "xfs_shared.h"
9#include "xfs_format.h"
10#include "xfs_trans_resv.h"
11#include "xfs_mount.h"
12#include "xfs_log_format.h"
13#include "xfs_trans.h"
14#include "xfs_inode.h"
15#include "xfs_icache.h"
16#include "xfs_bmap_util.h"
17#include "xfs_iwalk.h"
18#include "xfs_ialloc.h"
19#include "xfs_sb.h"
20#include "scrub/scrub.h"
21#include "scrub/common.h"
22#include "scrub/repair.h"
23#include "scrub/xfile.h"
24#include "scrub/xfarray.h"
25#include "scrub/iscan.h"
26#include "scrub/nlinks.h"
27#include "scrub/trace.h"
28
29/*
30 * Live Inode Link Count Repair
31 * ============================
32 *
33 * Use the live inode link count information that we collected to replace the
34 * nlink values of the incore inodes. A scrub->repair cycle should have left
35 * the live data and hooks active, so this is safe so long as we make sure the
36 * inode is locked.
37 */
38
39/*
40 * Correct the link count of the given inode. Because we have to grab locks
41 * and resources in a certain order, it's possible that this will be a no-op.
42 */
43STATIC int
44xrep_nlinks_repair_inode(
45 struct xchk_nlink_ctrs *xnc)
46{
47 struct xchk_nlink obs;
48 struct xfs_scrub *sc = xnc->sc;
49 struct xfs_mount *mp = sc->mp;
50 struct xfs_inode *ip = sc->ip;
51 uint64_t total_links;
52 uint64_t actual_nlink;
53 bool dirty = false;
54 int error;
55
56 xchk_ilock(sc, XFS_IOLOCK_EXCL);
57
58 error = xfs_trans_alloc(mp, &M_RES(mp)->tr_link, 0, 0, 0, &sc->tp);
59 if (error)
60 return error;
61
62 xchk_ilock(sc, XFS_ILOCK_EXCL);
63 xfs_trans_ijoin(sc->tp, ip, 0);
64
65 mutex_lock(&xnc->lock);
66
67 if (xchk_iscan_aborted(&xnc->collect_iscan)) {
68 error = -ECANCELED;
69 goto out_scanlock;
70 }
71
72 error = xfarray_load_sparse(xnc->nlinks, ip->i_ino, &obs);
73 if (error)
74 goto out_scanlock;
75
76 /*
77 * We're done accessing the shared scan data, so we can drop the lock.
78 * We still hold @ip's ILOCK, so its link count cannot change.
79 */
80 mutex_unlock(&xnc->lock);
81
82 total_links = xchk_nlink_total(ip, &obs);
83 actual_nlink = VFS_I(ip)->i_nlink;
84
85 /*
86 * Non-directories cannot have directories pointing up to them.
87 *
88 * We previously set error to zero, but set it again because one static
89 * checker author fears that programmers will fail to maintain this
90 * invariant and built their tool to flag this as a security risk. A
91 * different tool author made their bot complain about the redundant
92 * store. This is a never-ending and stupid battle; both tools missed
93 * *actual bugs* elsewhere; and I no longer care.
94 */
95 if (!S_ISDIR(VFS_I(ip)->i_mode) && obs.children != 0) {
96 trace_xrep_nlinks_unfixable_inode(mp, ip, &obs);
97 error = 0;
98 goto out_trans;
99 }
100
101 /*
102 * We did not find any links to this inode. If the inode agrees, we
103 * have nothing further to do. If not, the inode has a nonzero link
104 * count and we don't have anywhere to graft the child onto. Dropping
105 * a live inode's link count to zero can cause unexpected shutdowns in
106 * inactivation, so leave it alone.
107 */
108 if (total_links == 0) {
109 if (actual_nlink != 0)
110 trace_xrep_nlinks_unfixable_inode(mp, ip, &obs);
111 goto out_trans;
112 }
113
114 /* Commit the new link count if it changed. */
115 if (total_links != actual_nlink) {
116 if (total_links > XFS_MAXLINK) {
117 trace_xrep_nlinks_unfixable_inode(mp, ip, &obs);
118 goto out_trans;
119 }
120
121 trace_xrep_nlinks_update_inode(mp, ip, &obs);
122
123 set_nlink(VFS_I(ip), total_links);
124 dirty = true;
125 }
126
127 if (!dirty) {
128 error = 0;
129 goto out_trans;
130 }
131
132 xfs_trans_log_inode(sc->tp, ip, XFS_ILOG_CORE);
133
134 error = xrep_trans_commit(sc);
135 xchk_iunlock(sc, XFS_ILOCK_EXCL | XFS_IOLOCK_EXCL);
136 return error;
137
138out_scanlock:
139 mutex_unlock(&xnc->lock);
140out_trans:
141 xchk_trans_cancel(sc);
142 xchk_iunlock(sc, XFS_ILOCK_EXCL | XFS_IOLOCK_EXCL);
143 return error;
144}
145
146/*
147 * Try to visit every inode in the filesystem for repairs. Move on if we can't
148 * grab an inode, since we're still making forward progress.
149 */
150static int
151xrep_nlinks_iter(
152 struct xchk_nlink_ctrs *xnc,
153 struct xfs_inode **ipp)
154{
155 int error;
156
157 do {
158 error = xchk_iscan_iter(&xnc->compare_iscan, ipp);
159 } while (error == -EBUSY);
160
161 return error;
162}
163
164/* Commit the new inode link counters. */
165int
166xrep_nlinks(
167 struct xfs_scrub *sc)
168{
169 struct xchk_nlink_ctrs *xnc = sc->buf;
170 int error;
171
172 /*
173 * We need ftype for an accurate count of the number of child
174 * subdirectory links. Child subdirectories with a back link (dotdot
175 * entry) but no forward link are unfixable, so we cannot repair the
176 * link count of the parent directory based on the back link count
177 * alone. Filesystems without ftype support are rare (old V4) so we
178 * just skip out here.
179 */
180 if (!xfs_has_ftype(sc->mp))
181 return -EOPNOTSUPP;
182
183 /*
184 * Use the inobt to walk all allocated inodes to compare and fix the
185 * link counts. Retry iget every tenth of a second for up to 30
186 * seconds -- even if repair misses a few inodes, we still try to fix
187 * as many of them as we can.
188 */
189 xchk_iscan_start(sc, 30000, 100, &xnc->compare_iscan);
190 ASSERT(sc->ip == NULL);
191
192 while ((error = xrep_nlinks_iter(xnc, ipp: &sc->ip)) == 1) {
193 /*
194 * Commit the scrub transaction so that we can create repair
195 * transactions with the correct reservations.
196 */
197 xchk_trans_cancel(sc);
198
199 error = xrep_nlinks_repair_inode(xnc);
200 xchk_iscan_mark_visited(&xnc->compare_iscan, sc->ip);
201 xchk_irele(sc, sc->ip);
202 sc->ip = NULL;
203 if (error)
204 break;
205
206 if (xchk_should_terminate(sc, &error))
207 break;
208
209 /*
210 * Create a new empty transaction so that we can advance the
211 * iscan cursor without deadlocking if the inobt has a cycle.
212 * We can only push the inactivation workqueues with an empty
213 * transaction.
214 */
215 error = xchk_trans_alloc_empty(sc);
216 if (error)
217 break;
218 }
219 xchk_iscan_iter_finish(&xnc->compare_iscan);
220 xchk_iscan_teardown(&xnc->compare_iscan);
221
222 return error;
223}
224

source code of linux/fs/xfs/scrub/nlinks_repair.c