1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * Copyright (C) 2018-2023 Oracle. All Rights Reserved.
4 * Author: Darrick J. Wong <djwong@kernel.org>
5 */
6#include "xfs.h"
7#include "xfs_fs.h"
8#include "xfs_shared.h"
9#include "xfs_format.h"
10#include "xfs_trans_resv.h"
11#include "xfs_mount.h"
12#include "xfs_defer.h"
13#include "xfs_btree.h"
14#include "xfs_bit.h"
15#include "xfs_format.h"
16#include "xfs_log_format.h"
17#include "xfs_trans.h"
18#include "xfs_sb.h"
19#include "xfs_inode.h"
20#include "xfs_inode_fork.h"
21#include "xfs_alloc.h"
22#include "xfs_bmap.h"
23#include "xfs_quota.h"
24#include "xfs_qm.h"
25#include "xfs_dquot.h"
26#include "xfs_dquot_item.h"
27#include "xfs_reflink.h"
28#include "xfs_bmap_btree.h"
29#include "xfs_trans_space.h"
30#include "scrub/xfs_scrub.h"
31#include "scrub/scrub.h"
32#include "scrub/common.h"
33#include "scrub/quota.h"
34#include "scrub/trace.h"
35#include "scrub/repair.h"
36
37/*
38 * Quota Repair
39 * ============
40 *
41 * Quota repairs are fairly simplistic; we fix everything that the dquot
42 * verifiers complain about, cap any counters or limits that make no sense,
43 * and schedule a quotacheck if we had to fix anything. We also repair any
44 * data fork extent records that don't apply to metadata files.
45 */
46
47struct xrep_quota_info {
48 struct xfs_scrub *sc;
49 bool need_quotacheck;
50};
51
52/*
53 * Allocate a new block into a sparse hole in the quota file backing this
54 * dquot, initialize the block, and commit the whole mess.
55 */
56STATIC int
57xrep_quota_item_fill_bmap_hole(
58 struct xfs_scrub *sc,
59 struct xfs_dquot *dq,
60 struct xfs_bmbt_irec *irec)
61{
62 struct xfs_buf *bp;
63 struct xfs_mount *mp = sc->mp;
64 int nmaps = 1;
65 int error;
66
67 xfs_trans_ijoin(sc->tp, sc->ip, 0);
68
69 /* Map a block into the file. */
70 error = xfs_trans_reserve_more(sc->tp, XFS_QM_DQALLOC_SPACE_RES(mp),
71 0);
72 if (error)
73 return error;
74
75 error = xfs_bmapi_write(sc->tp, sc->ip, dq->q_fileoffset,
76 XFS_DQUOT_CLUSTER_SIZE_FSB, XFS_BMAPI_METADATA, 0,
77 irec, &nmaps);
78 if (error)
79 return error;
80 if (nmaps != 1)
81 return -ENOSPC;
82
83 dq->q_blkno = XFS_FSB_TO_DADDR(mp, irec->br_startblock);
84
85 trace_xrep_dquot_item_fill_bmap_hole(sc->mp, dq->q_type, dq->q_id);
86
87 /* Initialize the new block. */
88 error = xfs_trans_get_buf(sc->tp, mp->m_ddev_targp, dq->q_blkno,
89 mp->m_quotainfo->qi_dqchunklen, 0, &bp);
90 if (error)
91 return error;
92 bp->b_ops = &xfs_dquot_buf_ops;
93
94 xfs_qm_init_dquot_blk(sc->tp, dq->q_id, dq->q_type, bp);
95 xfs_buf_set_ref(bp, XFS_DQUOT_REF);
96
97 /*
98 * Finish the mapping transactions and roll one more time to
99 * disconnect sc->ip from sc->tp.
100 */
101 error = xrep_defer_finish(sc);
102 if (error)
103 return error;
104 return xfs_trans_roll(&sc->tp);
105}
106
107/* Make sure there's a written block backing this dquot */
108STATIC int
109xrep_quota_item_bmap(
110 struct xfs_scrub *sc,
111 struct xfs_dquot *dq,
112 bool *dirty)
113{
114 struct xfs_bmbt_irec irec;
115 struct xfs_mount *mp = sc->mp;
116 struct xfs_quotainfo *qi = mp->m_quotainfo;
117 xfs_fileoff_t offset = dq->q_id / qi->qi_dqperchunk;
118 int nmaps = 1;
119 int error;
120
121 /* The computed file offset should always be valid. */
122 if (!xfs_verify_fileoff(mp, offset)) {
123 ASSERT(xfs_verify_fileoff(mp, offset));
124 return -EFSCORRUPTED;
125 }
126 dq->q_fileoffset = offset;
127
128 error = xfs_bmapi_read(sc->ip, offset, 1, &irec, &nmaps, 0);
129 if (error)
130 return error;
131
132 if (nmaps < 1 || !xfs_bmap_is_real_extent(&irec)) {
133 /* Hole/delalloc extent; allocate a real block. */
134 error = xrep_quota_item_fill_bmap_hole(sc, dq, &irec);
135 if (error)
136 return error;
137 } else if (irec.br_state != XFS_EXT_NORM) {
138 /* Unwritten extent, which we already took care of? */
139 ASSERT(irec.br_state == XFS_EXT_NORM);
140 return -EFSCORRUPTED;
141 } else if (dq->q_blkno != XFS_FSB_TO_DADDR(mp, irec.br_startblock)) {
142 /*
143 * If the cached daddr is incorrect, repair probably punched a
144 * hole out of the quota file and filled it back in with a new
145 * block. Update the block mapping in the dquot.
146 */
147 dq->q_blkno = XFS_FSB_TO_DADDR(mp, irec.br_startblock);
148 }
149
150 *dirty = true;
151 return 0;
152}
153
154/* Reset quota timers if incorrectly set. */
155static inline void
156xrep_quota_item_timer(
157 struct xfs_scrub *sc,
158 const struct xfs_dquot_res *res,
159 bool *dirty)
160{
161 if ((res->softlimit && res->count > res->softlimit) ||
162 (res->hardlimit && res->count > res->hardlimit)) {
163 if (!res->timer)
164 *dirty = true;
165 } else {
166 if (res->timer)
167 *dirty = true;
168 }
169}
170
171/* Scrub the fields in an individual quota item. */
172STATIC int
173xrep_quota_item(
174 struct xrep_quota_info *rqi,
175 struct xfs_dquot *dq)
176{
177 struct xfs_scrub *sc = rqi->sc;
178 struct xfs_mount *mp = sc->mp;
179 xfs_ino_t fs_icount;
180 bool dirty = false;
181 int error = 0;
182
183 /* Last chance to abort before we start committing fixes. */
184 if (xchk_should_terminate(sc, &error))
185 return error;
186
187 /*
188 * We might need to fix holes in the bmap record for the storage
189 * backing this dquot, so we need to lock the dquot and the quota file.
190 * dqiterate gave us a locked dquot, so drop the dquot lock to get the
191 * ILOCK_EXCL.
192 */
193 xfs_dqunlock(dq);
194 xchk_ilock(sc, XFS_ILOCK_EXCL);
195 xfs_dqlock(dq);
196
197 error = xrep_quota_item_bmap(sc, dq, &dirty);
198 xchk_iunlock(sc, XFS_ILOCK_EXCL);
199 if (error)
200 return error;
201
202 /* Check the limits. */
203 if (dq->q_blk.softlimit > dq->q_blk.hardlimit) {
204 dq->q_blk.softlimit = dq->q_blk.hardlimit;
205 dirty = true;
206 }
207
208 if (dq->q_ino.softlimit > dq->q_ino.hardlimit) {
209 dq->q_ino.softlimit = dq->q_ino.hardlimit;
210 dirty = true;
211 }
212
213 if (dq->q_rtb.softlimit > dq->q_rtb.hardlimit) {
214 dq->q_rtb.softlimit = dq->q_rtb.hardlimit;
215 dirty = true;
216 }
217
218 /*
219 * Check that usage doesn't exceed physical limits. However, on
220 * a reflink filesystem we're allowed to exceed physical space
221 * if there are no quota limits. We don't know what the real number
222 * is, but we can make quotacheck find out for us.
223 */
224 if (!xfs_has_reflink(mp) && dq->q_blk.count > mp->m_sb.sb_dblocks) {
225 dq->q_blk.reserved -= dq->q_blk.count;
226 dq->q_blk.reserved += mp->m_sb.sb_dblocks;
227 dq->q_blk.count = mp->m_sb.sb_dblocks;
228 rqi->need_quotacheck = true;
229 dirty = true;
230 }
231 fs_icount = percpu_counter_sum(&mp->m_icount);
232 if (dq->q_ino.count > fs_icount) {
233 dq->q_ino.reserved -= dq->q_ino.count;
234 dq->q_ino.reserved += fs_icount;
235 dq->q_ino.count = fs_icount;
236 rqi->need_quotacheck = true;
237 dirty = true;
238 }
239 if (dq->q_rtb.count > mp->m_sb.sb_rblocks) {
240 dq->q_rtb.reserved -= dq->q_rtb.count;
241 dq->q_rtb.reserved += mp->m_sb.sb_rblocks;
242 dq->q_rtb.count = mp->m_sb.sb_rblocks;
243 rqi->need_quotacheck = true;
244 dirty = true;
245 }
246
247 xrep_quota_item_timer(sc, &dq->q_blk, &dirty);
248 xrep_quota_item_timer(sc, &dq->q_ino, &dirty);
249 xrep_quota_item_timer(sc, &dq->q_rtb, &dirty);
250
251 if (!dirty)
252 return 0;
253
254 trace_xrep_dquot_item(sc->mp, dq->q_type, dq->q_id);
255
256 dq->q_flags |= XFS_DQFLAG_DIRTY;
257 xfs_trans_dqjoin(sc->tp, dq);
258 if (dq->q_id) {
259 xfs_qm_adjust_dqlimits(dq);
260 xfs_qm_adjust_dqtimers(dq);
261 }
262 xfs_trans_log_dquot(sc->tp, dq);
263 error = xfs_trans_roll(&sc->tp);
264 xfs_dqlock(dq);
265 return error;
266}
267
268/* Fix a quota timer so that we can pass the verifier. */
269STATIC void
270xrep_quota_fix_timer(
271 struct xfs_mount *mp,
272 const struct xfs_disk_dquot *ddq,
273 __be64 softlimit,
274 __be64 countnow,
275 __be32 *timer,
276 time64_t timelimit)
277{
278 uint64_t soft = be64_to_cpu(softlimit);
279 uint64_t count = be64_to_cpu(countnow);
280 time64_t new_timer;
281 uint32_t t;
282
283 if (!soft || count <= soft || *timer != 0)
284 return;
285
286 new_timer = xfs_dquot_set_timeout(mp,
287 ktime_get_real_seconds() + timelimit);
288 if (ddq->d_type & XFS_DQTYPE_BIGTIME)
289 t = xfs_dq_unix_to_bigtime(new_timer);
290 else
291 t = new_timer;
292
293 *timer = cpu_to_be32(t);
294}
295
296/* Fix anything the verifiers complain about. */
297STATIC int
298xrep_quota_block(
299 struct xfs_scrub *sc,
300 xfs_daddr_t daddr,
301 xfs_dqtype_t dqtype,
302 xfs_dqid_t id)
303{
304 struct xfs_dqblk *dqblk;
305 struct xfs_disk_dquot *ddq;
306 struct xfs_quotainfo *qi = sc->mp->m_quotainfo;
307 struct xfs_def_quota *defq = xfs_get_defquota(qi, dqtype);
308 struct xfs_buf *bp = NULL;
309 enum xfs_blft buftype = 0;
310 int i;
311 int error;
312
313 error = xfs_trans_read_buf(sc->mp, sc->tp, sc->mp->m_ddev_targp, daddr,
314 qi->qi_dqchunklen, 0, &bp, &xfs_dquot_buf_ops);
315 switch (error) {
316 case -EFSBADCRC:
317 case -EFSCORRUPTED:
318 /* Failed verifier, retry read with no ops. */
319 error = xfs_trans_read_buf(sc->mp, sc->tp,
320 sc->mp->m_ddev_targp, daddr, qi->qi_dqchunklen,
321 0, &bp, NULL);
322 if (error)
323 return error;
324 break;
325 case 0:
326 dqblk = bp->b_addr;
327 ddq = &dqblk[0].dd_diskdq;
328
329 /*
330 * If there's nothing that would impede a dqiterate, we're
331 * done.
332 */
333 if ((ddq->d_type & XFS_DQTYPE_REC_MASK) != dqtype ||
334 id == be32_to_cpu(ddq->d_id)) {
335 xfs_trans_brelse(sc->tp, bp);
336 return 0;
337 }
338 break;
339 default:
340 return error;
341 }
342
343 /* Something's wrong with the block, fix the whole thing. */
344 dqblk = bp->b_addr;
345 bp->b_ops = &xfs_dquot_buf_ops;
346 for (i = 0; i < qi->qi_dqperchunk; i++, dqblk++) {
347 ddq = &dqblk->dd_diskdq;
348
349 trace_xrep_disk_dquot(sc->mp, dqtype, id + i);
350
351 ddq->d_magic = cpu_to_be16(XFS_DQUOT_MAGIC);
352 ddq->d_version = XFS_DQUOT_VERSION;
353 ddq->d_type = dqtype;
354 ddq->d_id = cpu_to_be32(id + i);
355
356 if (xfs_has_bigtime(sc->mp) && ddq->d_id)
357 ddq->d_type |= XFS_DQTYPE_BIGTIME;
358
359 xrep_quota_fix_timer(sc->mp, ddq, ddq->d_blk_softlimit,
360 ddq->d_bcount, &ddq->d_btimer,
361 defq->blk.time);
362
363 xrep_quota_fix_timer(sc->mp, ddq, ddq->d_ino_softlimit,
364 ddq->d_icount, &ddq->d_itimer,
365 defq->ino.time);
366
367 xrep_quota_fix_timer(sc->mp, ddq, ddq->d_rtb_softlimit,
368 ddq->d_rtbcount, &ddq->d_rtbtimer,
369 defq->rtb.time);
370
371 /* We only support v5 filesystems so always set these. */
372 uuid_copy(&dqblk->dd_uuid, &sc->mp->m_sb.sb_meta_uuid);
373 xfs_update_cksum((char *)dqblk, sizeof(struct xfs_dqblk),
374 XFS_DQUOT_CRC_OFF);
375 dqblk->dd_lsn = 0;
376 }
377 switch (dqtype) {
378 case XFS_DQTYPE_USER:
379 buftype = XFS_BLFT_UDQUOT_BUF;
380 break;
381 case XFS_DQTYPE_GROUP:
382 buftype = XFS_BLFT_GDQUOT_BUF;
383 break;
384 case XFS_DQTYPE_PROJ:
385 buftype = XFS_BLFT_PDQUOT_BUF;
386 break;
387 }
388 xfs_trans_buf_set_type(sc->tp, bp, buftype);
389 xfs_trans_log_buf(sc->tp, bp, 0, BBTOB(bp->b_length) - 1);
390 return xrep_roll_trans(sc);
391}
392
393/*
394 * Repair a quota file's data fork. The function returns with the inode
395 * joined.
396 */
397STATIC int
398xrep_quota_data_fork(
399 struct xfs_scrub *sc,
400 xfs_dqtype_t dqtype)
401{
402 struct xfs_bmbt_irec irec = { 0 };
403 struct xfs_iext_cursor icur;
404 struct xfs_quotainfo *qi = sc->mp->m_quotainfo;
405 struct xfs_ifork *ifp;
406 xfs_fileoff_t max_dqid_off;
407 xfs_fileoff_t off;
408 xfs_fsblock_t fsbno;
409 bool truncate = false;
410 bool joined = false;
411 int error = 0;
412
413 error = xrep_metadata_inode_forks(sc);
414 if (error)
415 goto out;
416
417 /* Check for data fork problems that apply only to quota files. */
418 max_dqid_off = XFS_DQ_ID_MAX / qi->qi_dqperchunk;
419 ifp = xfs_ifork_ptr(sc->ip, XFS_DATA_FORK);
420 for_each_xfs_iext(ifp, &icur, &irec) {
421 if (isnullstartblock(irec.br_startblock)) {
422 error = -EFSCORRUPTED;
423 goto out;
424 }
425
426 if (irec.br_startoff > max_dqid_off ||
427 irec.br_startoff + irec.br_blockcount - 1 > max_dqid_off) {
428 truncate = true;
429 break;
430 }
431
432 /* Convert unwritten extents to real ones. */
433 if (irec.br_state == XFS_EXT_UNWRITTEN) {
434 struct xfs_bmbt_irec nrec;
435 int nmap = 1;
436
437 if (!joined) {
438 xfs_trans_ijoin(sc->tp, sc->ip, 0);
439 joined = true;
440 }
441
442 error = xfs_bmapi_write(sc->tp, sc->ip,
443 irec.br_startoff, irec.br_blockcount,
444 XFS_BMAPI_CONVERT, 0, &nrec, &nmap);
445 if (error)
446 goto out;
447 if (nmap != 1) {
448 error = -ENOSPC;
449 goto out;
450 }
451 ASSERT(nrec.br_startoff == irec.br_startoff);
452 ASSERT(nrec.br_blockcount == irec.br_blockcount);
453
454 error = xfs_defer_finish(&sc->tp);
455 if (error)
456 goto out;
457 }
458 }
459
460 if (!joined) {
461 xfs_trans_ijoin(sc->tp, sc->ip, 0);
462 joined = true;
463 }
464
465 if (truncate) {
466 /* Erase everything after the block containing the max dquot */
467 error = xfs_bunmapi_range(&sc->tp, sc->ip, 0,
468 max_dqid_off * sc->mp->m_sb.sb_blocksize,
469 XFS_MAX_FILEOFF);
470 if (error)
471 goto out;
472
473 /* Remove all CoW reservations. */
474 error = xfs_reflink_cancel_cow_blocks(sc->ip, &sc->tp, 0,
475 XFS_MAX_FILEOFF, true);
476 if (error)
477 goto out;
478 sc->ip->i_diflags2 &= ~XFS_DIFLAG2_REFLINK;
479
480 /*
481 * Always re-log the inode so that our permanent transaction
482 * can keep on rolling it forward in the log.
483 */
484 xfs_trans_log_inode(sc->tp, sc->ip, XFS_ILOG_CORE);
485 }
486
487 /* Now go fix anything that fails the verifiers. */
488 for_each_xfs_iext(ifp, &icur, &irec) {
489 for (fsbno = irec.br_startblock, off = irec.br_startoff;
490 fsbno < irec.br_startblock + irec.br_blockcount;
491 fsbno += XFS_DQUOT_CLUSTER_SIZE_FSB,
492 off += XFS_DQUOT_CLUSTER_SIZE_FSB) {
493 error = xrep_quota_block(sc,
494 XFS_FSB_TO_DADDR(sc->mp, fsbno),
495 dqtype, off * qi->qi_dqperchunk);
496 if (error)
497 goto out;
498 }
499 }
500
501out:
502 return error;
503}
504
505/*
506 * Go fix anything in the quota items that we could have been mad about. Now
507 * that we've checked the quota inode data fork we have to drop ILOCK_EXCL to
508 * use the regular dquot functions.
509 */
510STATIC int
511xrep_quota_problems(
512 struct xfs_scrub *sc,
513 xfs_dqtype_t dqtype)
514{
515 struct xchk_dqiter cursor = { };
516 struct xrep_quota_info rqi = { .sc = sc };
517 struct xfs_dquot *dq;
518 int error;
519
520 xchk_dqiter_init(&cursor, sc, dqtype);
521 while ((error = xchk_dquot_iter(&cursor, &dq)) == 1) {
522 error = xrep_quota_item(&rqi, dq);
523 xfs_qm_dqput(dq);
524 if (error)
525 break;
526 }
527 if (error)
528 return error;
529
530 /* Make a quotacheck happen. */
531 if (rqi.need_quotacheck)
532 xrep_force_quotacheck(sc, dqtype);
533 return 0;
534}
535
536/* Repair all of a quota type's items. */
537int
538xrep_quota(
539 struct xfs_scrub *sc)
540{
541 xfs_dqtype_t dqtype;
542 int error;
543
544 dqtype = xchk_quota_to_dqtype(sc);
545
546 /*
547 * Re-take the ILOCK so that we can fix any problems that we found
548 * with the data fork mappings, or with the dquot bufs themselves.
549 */
550 if (!(sc->ilock_flags & XFS_ILOCK_EXCL))
551 xchk_ilock(sc, XFS_ILOCK_EXCL);
552 error = xrep_quota_data_fork(sc, dqtype);
553 if (error)
554 return error;
555
556 /*
557 * Finish deferred items and roll the transaction to unjoin the quota
558 * inode from transaction so that we can unlock the quota inode; we
559 * play only with dquots from now on.
560 */
561 error = xrep_defer_finish(sc);
562 if (error)
563 return error;
564 error = xfs_trans_roll(&sc->tp);
565 if (error)
566 return error;
567 xchk_iunlock(sc, sc->ilock_flags);
568
569 /* Fix anything the dquot verifiers don't complain about. */
570 error = xrep_quota_problems(sc, dqtype);
571 if (error)
572 return error;
573
574 return xrep_trans_commit(sc);
575}
576

source code of linux/fs/xfs/scrub/quota_repair.c