1 | // SPDX-License-Identifier: GPL-2.0-or-later |
2 | /* |
3 | * Copyright (c) 2021-2024 Oracle. All Rights Reserved. |
4 | * Author: Darrick J. Wong <djwong@kernel.org> |
5 | */ |
6 | #include "xfs.h" |
7 | #include "xfs_fs.h" |
8 | #include "xfs_shared.h" |
9 | #include "xfs_format.h" |
10 | #include "xfs_trans_resv.h" |
11 | #include "xfs_mount.h" |
12 | #include "xfs_log_format.h" |
13 | #include "xfs_trans.h" |
14 | #include "xfs_inode.h" |
15 | #include "xfs_icache.h" |
16 | #include "xfs_bmap_util.h" |
17 | #include "xfs_iwalk.h" |
18 | #include "xfs_ialloc.h" |
19 | #include "xfs_sb.h" |
20 | #include "scrub/scrub.h" |
21 | #include "scrub/common.h" |
22 | #include "scrub/repair.h" |
23 | #include "scrub/xfile.h" |
24 | #include "scrub/xfarray.h" |
25 | #include "scrub/iscan.h" |
26 | #include "scrub/nlinks.h" |
27 | #include "scrub/trace.h" |
28 | |
29 | /* |
30 | * Live Inode Link Count Repair |
31 | * ============================ |
32 | * |
33 | * Use the live inode link count information that we collected to replace the |
34 | * nlink values of the incore inodes. A scrub->repair cycle should have left |
35 | * the live data and hooks active, so this is safe so long as we make sure the |
36 | * inode is locked. |
37 | */ |
38 | |
39 | /* |
40 | * Correct the link count of the given inode. Because we have to grab locks |
41 | * and resources in a certain order, it's possible that this will be a no-op. |
42 | */ |
43 | STATIC int |
44 | xrep_nlinks_repair_inode( |
45 | struct xchk_nlink_ctrs *xnc) |
46 | { |
47 | struct xchk_nlink obs; |
48 | struct xfs_scrub *sc = xnc->sc; |
49 | struct xfs_mount *mp = sc->mp; |
50 | struct xfs_inode *ip = sc->ip; |
51 | uint64_t total_links; |
52 | uint64_t actual_nlink; |
53 | bool dirty = false; |
54 | int error; |
55 | |
56 | xchk_ilock(sc, XFS_IOLOCK_EXCL); |
57 | |
58 | error = xfs_trans_alloc(mp, &M_RES(mp)->tr_link, 0, 0, 0, &sc->tp); |
59 | if (error) |
60 | return error; |
61 | |
62 | xchk_ilock(sc, XFS_ILOCK_EXCL); |
63 | xfs_trans_ijoin(sc->tp, ip, 0); |
64 | |
65 | mutex_lock(&xnc->lock); |
66 | |
67 | if (xchk_iscan_aborted(&xnc->collect_iscan)) { |
68 | error = -ECANCELED; |
69 | goto out_scanlock; |
70 | } |
71 | |
72 | error = xfarray_load_sparse(xnc->nlinks, ip->i_ino, &obs); |
73 | if (error) |
74 | goto out_scanlock; |
75 | |
76 | /* |
77 | * We're done accessing the shared scan data, so we can drop the lock. |
78 | * We still hold @ip's ILOCK, so its link count cannot change. |
79 | */ |
80 | mutex_unlock(&xnc->lock); |
81 | |
82 | total_links = xchk_nlink_total(ip, &obs); |
83 | actual_nlink = VFS_I(ip)->i_nlink; |
84 | |
85 | /* |
86 | * Non-directories cannot have directories pointing up to them. |
87 | * |
88 | * We previously set error to zero, but set it again because one static |
89 | * checker author fears that programmers will fail to maintain this |
90 | * invariant and built their tool to flag this as a security risk. A |
91 | * different tool author made their bot complain about the redundant |
92 | * store. This is a never-ending and stupid battle; both tools missed |
93 | * *actual bugs* elsewhere; and I no longer care. |
94 | */ |
95 | if (!S_ISDIR(VFS_I(ip)->i_mode) && obs.children != 0) { |
96 | trace_xrep_nlinks_unfixable_inode(mp, ip, &obs); |
97 | error = 0; |
98 | goto out_trans; |
99 | } |
100 | |
101 | /* |
102 | * We did not find any links to this inode. If the inode agrees, we |
103 | * have nothing further to do. If not, the inode has a nonzero link |
104 | * count and we don't have anywhere to graft the child onto. Dropping |
105 | * a live inode's link count to zero can cause unexpected shutdowns in |
106 | * inactivation, so leave it alone. |
107 | */ |
108 | if (total_links == 0) { |
109 | if (actual_nlink != 0) |
110 | trace_xrep_nlinks_unfixable_inode(mp, ip, &obs); |
111 | goto out_trans; |
112 | } |
113 | |
114 | /* Commit the new link count if it changed. */ |
115 | if (total_links != actual_nlink) { |
116 | if (total_links > XFS_MAXLINK) { |
117 | trace_xrep_nlinks_unfixable_inode(mp, ip, &obs); |
118 | goto out_trans; |
119 | } |
120 | |
121 | trace_xrep_nlinks_update_inode(mp, ip, &obs); |
122 | |
123 | set_nlink(VFS_I(ip), total_links); |
124 | dirty = true; |
125 | } |
126 | |
127 | if (!dirty) { |
128 | error = 0; |
129 | goto out_trans; |
130 | } |
131 | |
132 | xfs_trans_log_inode(sc->tp, ip, XFS_ILOG_CORE); |
133 | |
134 | error = xrep_trans_commit(sc); |
135 | xchk_iunlock(sc, XFS_ILOCK_EXCL | XFS_IOLOCK_EXCL); |
136 | return error; |
137 | |
138 | out_scanlock: |
139 | mutex_unlock(&xnc->lock); |
140 | out_trans: |
141 | xchk_trans_cancel(sc); |
142 | xchk_iunlock(sc, XFS_ILOCK_EXCL | XFS_IOLOCK_EXCL); |
143 | return error; |
144 | } |
145 | |
146 | /* |
147 | * Try to visit every inode in the filesystem for repairs. Move on if we can't |
148 | * grab an inode, since we're still making forward progress. |
149 | */ |
150 | static int |
151 | xrep_nlinks_iter( |
152 | struct xchk_nlink_ctrs *xnc, |
153 | struct xfs_inode **ipp) |
154 | { |
155 | int error; |
156 | |
157 | do { |
158 | error = xchk_iscan_iter(&xnc->compare_iscan, ipp); |
159 | } while (error == -EBUSY); |
160 | |
161 | return error; |
162 | } |
163 | |
164 | /* Commit the new inode link counters. */ |
165 | int |
166 | xrep_nlinks( |
167 | struct xfs_scrub *sc) |
168 | { |
169 | struct xchk_nlink_ctrs *xnc = sc->buf; |
170 | int error; |
171 | |
172 | /* |
173 | * We need ftype for an accurate count of the number of child |
174 | * subdirectory links. Child subdirectories with a back link (dotdot |
175 | * entry) but no forward link are unfixable, so we cannot repair the |
176 | * link count of the parent directory based on the back link count |
177 | * alone. Filesystems without ftype support are rare (old V4) so we |
178 | * just skip out here. |
179 | */ |
180 | if (!xfs_has_ftype(sc->mp)) |
181 | return -EOPNOTSUPP; |
182 | |
183 | /* |
184 | * Use the inobt to walk all allocated inodes to compare and fix the |
185 | * link counts. Retry iget every tenth of a second for up to 30 |
186 | * seconds -- even if repair misses a few inodes, we still try to fix |
187 | * as many of them as we can. |
188 | */ |
189 | xchk_iscan_start(sc, 30000, 100, &xnc->compare_iscan); |
190 | ASSERT(sc->ip == NULL); |
191 | |
192 | while ((error = xrep_nlinks_iter(xnc, ipp: &sc->ip)) == 1) { |
193 | /* |
194 | * Commit the scrub transaction so that we can create repair |
195 | * transactions with the correct reservations. |
196 | */ |
197 | xchk_trans_cancel(sc); |
198 | |
199 | error = xrep_nlinks_repair_inode(xnc); |
200 | xchk_iscan_mark_visited(&xnc->compare_iscan, sc->ip); |
201 | xchk_irele(sc, sc->ip); |
202 | sc->ip = NULL; |
203 | if (error) |
204 | break; |
205 | |
206 | if (xchk_should_terminate(sc, &error)) |
207 | break; |
208 | |
209 | /* |
210 | * Create a new empty transaction so that we can advance the |
211 | * iscan cursor without deadlocking if the inobt has a cycle. |
212 | * We can only push the inactivation workqueues with an empty |
213 | * transaction. |
214 | */ |
215 | error = xchk_trans_alloc_empty(sc); |
216 | if (error) |
217 | break; |
218 | } |
219 | xchk_iscan_iter_finish(&xnc->compare_iscan); |
220 | xchk_iscan_teardown(&xnc->compare_iscan); |
221 | |
222 | return error; |
223 | } |
224 | |