1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * Copyright (c) 2000-2006 Silicon Graphics, Inc.
4 * All Rights Reserved.
5 */
6 #include "xfs_platform.h"
7 #include "xfs_fs.h"
8 #include "xfs_shared.h"
9 #include "xfs_format.h"
10 #include "xfs_log_format.h"
11 #include "xfs_trans_resv.h"
12 #include "xfs_mount.h"
13 #include "xfs_ag.h"
14 #include "xfs_inode.h"
15 #include "xfs_errortag.h"
16 #include "xfs_error.h"
17 #include "xfs_icache.h"
18 #include "xfs_trans.h"
19 #include "xfs_ialloc.h"
20 #include "xfs_dir2.h"
21 #include "xfs_health.h"
22 #include "xfs_metafile.h"
23
24 #include <linux/iversion.h>
25
26 /*
27 * If we are doing readahead on an inode buffer, we might be in log recovery
28 * reading an inode allocation buffer that hasn't yet been replayed, and hence
29 * has not had the inode cores stamped into it. Hence for readahead, the buffer
30 * may be potentially invalid.
31 *
32 * If the readahead buffer is invalid, we need to mark it with an error so that a
33 * followup read will re-read it from disk.
34 *
35 * We don't report the error otherwise to avoid warnings during log recovery and
36 * we don't get unnecessary panics on debug kernels. Use EIO here because all
37 * we want to do is say readahead failed; there is no-one to report the error
38 * to, so this will distinguish it from a non-ra verifier failure.
39 *
40 * Changes to this readahead error behaviour also need to be reflected in
41 * xfs_dquot_buf_readahead_verify().
42 */
43 static void
xfs_inode_buf_verify(struct xfs_buf * bp,bool readahead)44 xfs_inode_buf_verify(
45 struct xfs_buf *bp,
46 bool readahead)
47 {
48 struct xfs_mount *mp = bp->b_mount;
49 int i;
50 int ni;
51
52 /*
53 * Validate the magic number and version of every inode in the buffer
54 */
55 ni = XFS_BB_TO_FSB(mp, bp->b_length) * mp->m_sb.sb_inopblock;
56 for (i = 0; i < ni; i++) {
57 struct xfs_dinode *dip;
58 xfs_agino_t unlinked_ino;
59 int di_ok;
60
61 dip = xfs_buf_offset(bp, (i << mp->m_sb.sb_inodelog));
62 unlinked_ino = be32_to_cpu(dip->di_next_unlinked);
63 di_ok = xfs_verify_magic16(bp, dip->di_magic) &&
64 xfs_dinode_good_version(mp, dip->di_version) &&
65 xfs_verify_agino_or_null(bp->b_pag, unlinked_ino);
66 if (unlikely(!di_ok ||
67 XFS_TEST_ERROR(mp, XFS_ERRTAG_ITOBP_INOTOBP))) {
68 if (readahead) {
69 xfs_buf_ioerror(bp, -EIO);
70 return;
71 }
72
73 #ifdef DEBUG
74 xfs_alert(mp,
75 "bad inode magic/vsn daddr %lld #%d (magic=%x)",
76 (unsigned long long)xfs_buf_daddr(bp), i,
77 be16_to_cpu(dip->di_magic));
78 #endif
79 xfs_buf_verifier_error(bp, -EFSCORRUPTED,
80 __func__, dip, sizeof(*dip),
81 NULL);
82 return;
83 }
84 }
85 }
86
87
88 static void
xfs_inode_buf_read_verify(struct xfs_buf * bp)89 xfs_inode_buf_read_verify(
90 struct xfs_buf *bp)
91 {
92 xfs_inode_buf_verify(bp, false);
93 }
94
95 static void
xfs_inode_buf_readahead_verify(struct xfs_buf * bp)96 xfs_inode_buf_readahead_verify(
97 struct xfs_buf *bp)
98 {
99 xfs_inode_buf_verify(bp, true);
100 }
101
102 static void
xfs_inode_buf_write_verify(struct xfs_buf * bp)103 xfs_inode_buf_write_verify(
104 struct xfs_buf *bp)
105 {
106 xfs_inode_buf_verify(bp, false);
107 }
108
109 const struct xfs_buf_ops xfs_inode_buf_ops = {
110 .name = "xfs_inode",
111 .magic16 = { cpu_to_be16(XFS_DINODE_MAGIC),
112 cpu_to_be16(XFS_DINODE_MAGIC) },
113 .verify_read = xfs_inode_buf_read_verify,
114 .verify_write = xfs_inode_buf_write_verify,
115 };
116
117 const struct xfs_buf_ops xfs_inode_buf_ra_ops = {
118 .name = "xfs_inode_ra",
119 .magic16 = { cpu_to_be16(XFS_DINODE_MAGIC),
120 cpu_to_be16(XFS_DINODE_MAGIC) },
121 .verify_read = xfs_inode_buf_readahead_verify,
122 .verify_write = xfs_inode_buf_write_verify,
123 };
124
125
126 /*
127 * Read the inode cluster at @bno and return it in @bpp.
128 */
129 int
xfs_read_icluster(struct xfs_perag * pag,struct xfs_trans * tp,xfs_agblock_t agbno,struct xfs_buf ** bpp)130 xfs_read_icluster(
131 struct xfs_perag *pag,
132 struct xfs_trans *tp,
133 xfs_agblock_t agbno,
134 struct xfs_buf **bpp)
135 {
136 struct xfs_mount *mp = pag_mount(pag);
137 int error;
138
139 error = xfs_trans_read_buf(mp, tp, mp->m_ddev_targp,
140 xfs_agbno_to_daddr(pag, agbno),
141 XFS_FSB_TO_BB(mp, M_IGEO(mp)->blocks_per_cluster),
142 0, bpp, &xfs_inode_buf_ops);
143 if (xfs_metadata_is_sick(error))
144 xfs_agno_mark_sick(mp, pag_agno(pag), XFS_SICK_AG_INODES);
145 return error;
146 }
147
xfs_inode_decode_bigtime(uint64_t ts)148 static inline struct timespec64 xfs_inode_decode_bigtime(uint64_t ts)
149 {
150 struct timespec64 tv;
151 uint32_t n;
152
153 tv.tv_sec = xfs_bigtime_to_unix(div_u64_rem(ts, NSEC_PER_SEC, &n));
154 tv.tv_nsec = n;
155
156 return tv;
157 }
158
159 /* Convert an ondisk timestamp to an incore timestamp. */
160 struct timespec64
xfs_inode_from_disk_ts(struct xfs_dinode * dip,const xfs_timestamp_t ts)161 xfs_inode_from_disk_ts(
162 struct xfs_dinode *dip,
163 const xfs_timestamp_t ts)
164 {
165 struct timespec64 tv;
166 struct xfs_legacy_timestamp *lts;
167
168 if (xfs_dinode_has_bigtime(dip))
169 return xfs_inode_decode_bigtime(be64_to_cpu(ts));
170
171 lts = (struct xfs_legacy_timestamp *)&ts;
172 tv.tv_sec = (int)be32_to_cpu(lts->t_sec);
173 tv.tv_nsec = (int)be32_to_cpu(lts->t_nsec);
174
175 return tv;
176 }
177
178 int
xfs_inode_from_disk(struct xfs_inode * ip,struct xfs_dinode * from)179 xfs_inode_from_disk(
180 struct xfs_inode *ip,
181 struct xfs_dinode *from)
182 {
183 struct inode *inode = VFS_I(ip);
184 int error;
185 xfs_failaddr_t fa;
186
187 ASSERT(ip->i_cowfp == NULL);
188
189 fa = xfs_dinode_verify(ip->i_mount, I_INO(ip), from);
190 if (fa) {
191 xfs_inode_verifier_error(ip, -EFSCORRUPTED, "dinode", from,
192 sizeof(*from), fa);
193 return -EFSCORRUPTED;
194 }
195
196 /*
197 * First get the permanent information that is needed to allocate an
198 * inode. If the inode is unused, mode is zero and we shouldn't mess
199 * with the uninitialized part of it.
200 */
201 if (!xfs_has_v3inodes(ip->i_mount))
202 ip->i_flushiter = be16_to_cpu(from->di_flushiter);
203 inode->i_generation = be32_to_cpu(from->di_gen);
204 inode->i_mode = be16_to_cpu(from->di_mode);
205 if (!inode->i_mode)
206 return 0;
207
208 /*
209 * Convert v1 inodes immediately to v2 inode format as this is the
210 * minimum inode version format we support in the rest of the code.
211 * They will also be unconditionally written back to disk as v2 inodes.
212 */
213 if (unlikely(from->di_version == 1)) {
214 /* di_metatype used to be di_onlink */
215 set_nlink(inode, be16_to_cpu(from->di_metatype));
216 ip->i_projid = 0;
217 } else {
218 set_nlink(inode, be32_to_cpu(from->di_nlink));
219 ip->i_projid = (prid_t)be16_to_cpu(from->di_projid_hi) << 16 |
220 be16_to_cpu(from->di_projid_lo);
221 if (xfs_dinode_is_metadir(from))
222 ip->i_metatype = be16_to_cpu(from->di_metatype);
223 }
224
225 i_uid_write(inode, be32_to_cpu(from->di_uid));
226 i_gid_write(inode, be32_to_cpu(from->di_gid));
227
228 /*
229 * Time is signed, so need to convert to signed 32 bit before
230 * storing in inode timestamp which may be 64 bit. Otherwise
231 * a time before epoch is converted to a time long after epoch
232 * on 64 bit systems.
233 */
234 inode_set_atime_to_ts(inode,
235 xfs_inode_from_disk_ts(from, from->di_atime));
236 inode_set_mtime_to_ts(inode,
237 xfs_inode_from_disk_ts(from, from->di_mtime));
238 inode_set_ctime_to_ts(inode,
239 xfs_inode_from_disk_ts(from, from->di_ctime));
240
241 ip->i_disk_size = be64_to_cpu(from->di_size);
242 ip->i_nblocks = be64_to_cpu(from->di_nblocks);
243 ip->i_extsize = be32_to_cpu(from->di_extsize);
244 ip->i_forkoff = from->di_forkoff;
245 ip->i_diflags = be16_to_cpu(from->di_flags);
246 ip->i_next_unlinked = be32_to_cpu(from->di_next_unlinked);
247
248 if (from->di_dmevmask || from->di_dmstate)
249 xfs_iflags_set(ip, XFS_IPRESERVE_DM_FIELDS);
250
251 if (xfs_has_v3inodes(ip->i_mount)) {
252 inode_set_iversion_queried(inode,
253 be64_to_cpu(from->di_changecount));
254 ip->i_crtime = xfs_inode_from_disk_ts(from, from->di_crtime);
255 ip->i_diflags2 = be64_to_cpu(from->di_flags2);
256 /* also covers the di_used_blocks union arm: */
257 ip->i_cowextsize = be32_to_cpu(from->di_cowextsize);
258 BUILD_BUG_ON(sizeof(from->di_cowextsize) !=
259 sizeof(from->di_used_blocks));
260 }
261
262 error = xfs_iformat_data_fork(ip, from);
263 if (error)
264 return error;
265 if (from->di_forkoff) {
266 error = xfs_iformat_attr_fork(ip, from);
267 if (error)
268 goto out_destroy_data_fork;
269 }
270 if (xfs_is_reflink_inode(ip))
271 xfs_ifork_init_cow(ip);
272 if (xfs_is_metadir_inode(ip)) {
273 XFS_STATS_DEC(ip->i_mount, xs_inodes_active);
274 XFS_STATS_INC(ip->i_mount, xs_inodes_meta);
275 }
276 return 0;
277
278 out_destroy_data_fork:
279 xfs_idestroy_fork(&ip->i_df);
280 return error;
281 }
282
283 /* Convert an incore timestamp to an ondisk timestamp. */
284 static inline xfs_timestamp_t
xfs_inode_to_disk_ts(struct xfs_inode * ip,const struct timespec64 tv)285 xfs_inode_to_disk_ts(
286 struct xfs_inode *ip,
287 const struct timespec64 tv)
288 {
289 struct xfs_legacy_timestamp *lts;
290 xfs_timestamp_t ts;
291
292 if (xfs_inode_has_bigtime(ip))
293 return cpu_to_be64(xfs_inode_encode_bigtime(tv));
294
295 lts = (struct xfs_legacy_timestamp *)&ts;
296 lts->t_sec = cpu_to_be32(tv.tv_sec);
297 lts->t_nsec = cpu_to_be32(tv.tv_nsec);
298
299 return ts;
300 }
301
302 static inline void
xfs_inode_to_disk_iext_counters(struct xfs_inode * ip,struct xfs_dinode * to)303 xfs_inode_to_disk_iext_counters(
304 struct xfs_inode *ip,
305 struct xfs_dinode *to)
306 {
307 if (xfs_inode_has_large_extent_counts(ip)) {
308 to->di_big_nextents = cpu_to_be64(xfs_ifork_nextents(&ip->i_df));
309 to->di_big_anextents = cpu_to_be32(xfs_ifork_nextents(&ip->i_af));
310 /*
311 * We might be upgrading the inode to use larger extent counters
312 * than was previously used. Hence zero the unused field.
313 */
314 to->di_nrext64_pad = cpu_to_be16(0);
315 } else {
316 to->di_nextents = cpu_to_be32(xfs_ifork_nextents(&ip->i_df));
317 to->di_anextents = cpu_to_be16(xfs_ifork_nextents(&ip->i_af));
318 }
319 }
320
321 void
xfs_inode_to_disk(struct xfs_inode * ip,struct xfs_dinode * to,xfs_lsn_t lsn)322 xfs_inode_to_disk(
323 struct xfs_inode *ip,
324 struct xfs_dinode *to,
325 xfs_lsn_t lsn)
326 {
327 struct inode *inode = VFS_I(ip);
328
329 to->di_magic = cpu_to_be16(XFS_DINODE_MAGIC);
330 if (xfs_is_metadir_inode(ip))
331 to->di_metatype = cpu_to_be16(ip->i_metatype);
332 else
333 to->di_metatype = 0;
334
335 to->di_format = xfs_ifork_format(&ip->i_df);
336 to->di_uid = cpu_to_be32(i_uid_read(inode));
337 to->di_gid = cpu_to_be32(i_gid_read(inode));
338 to->di_projid_lo = cpu_to_be16(ip->i_projid & 0xffff);
339 to->di_projid_hi = cpu_to_be16(ip->i_projid >> 16);
340
341 to->di_atime = xfs_inode_to_disk_ts(ip, inode_get_atime(inode));
342 to->di_mtime = xfs_inode_to_disk_ts(ip, inode_get_mtime(inode));
343 to->di_ctime = xfs_inode_to_disk_ts(ip, inode_get_ctime(inode));
344 to->di_nlink = cpu_to_be32(inode->i_nlink);
345 to->di_gen = cpu_to_be32(inode->i_generation);
346 to->di_mode = cpu_to_be16(inode->i_mode);
347
348 to->di_size = cpu_to_be64(ip->i_disk_size);
349 to->di_nblocks = cpu_to_be64(ip->i_nblocks);
350 to->di_extsize = cpu_to_be32(ip->i_extsize);
351 to->di_forkoff = ip->i_forkoff;
352 to->di_aformat = xfs_ifork_format(&ip->i_af);
353 to->di_flags = cpu_to_be16(ip->i_diflags);
354
355 if (xfs_has_v3inodes(ip->i_mount)) {
356 to->di_version = 3;
357 to->di_changecount = cpu_to_be64(inode_peek_iversion(inode));
358 to->di_crtime = xfs_inode_to_disk_ts(ip, ip->i_crtime);
359 to->di_flags2 = cpu_to_be64(ip->i_diflags2);
360 /* also covers the di_used_blocks union arm: */
361 to->di_cowextsize = cpu_to_be32(ip->i_cowextsize);
362 to->di_ino = cpu_to_be64(I_INO(ip));
363 to->di_lsn = cpu_to_be64(lsn);
364 memset(to->di_pad2, 0, sizeof(to->di_pad2));
365 uuid_copy(&to->di_uuid, &ip->i_mount->m_sb.sb_meta_uuid);
366 to->di_v3_pad = 0;
367 } else {
368 to->di_version = 2;
369 to->di_flushiter = cpu_to_be16(ip->i_flushiter);
370 memset(to->di_v2_pad, 0, sizeof(to->di_v2_pad));
371 }
372
373 xfs_inode_to_disk_iext_counters(ip, to);
374 }
375
376 static xfs_failaddr_t
xfs_dinode_verify_fork(struct xfs_dinode * dip,struct xfs_mount * mp,int whichfork)377 xfs_dinode_verify_fork(
378 struct xfs_dinode *dip,
379 struct xfs_mount *mp,
380 int whichfork)
381 {
382 xfs_extnum_t di_nextents;
383 xfs_extnum_t max_extents;
384 mode_t mode = be16_to_cpu(dip->di_mode);
385 uint32_t fork_size = XFS_DFORK_SIZE(dip, mp, whichfork);
386 uint32_t fork_format = XFS_DFORK_FORMAT(dip, whichfork);
387
388 di_nextents = xfs_dfork_nextents(dip, whichfork);
389
390 /*
391 * For fork types that can contain local data, check that the fork
392 * format matches the size of local data contained within the fork.
393 */
394 if (whichfork == XFS_DATA_FORK) {
395 /*
396 * A directory small enough to fit in the inode must be stored
397 * in local format. The directory sf <-> extents conversion
398 * code updates the directory size accordingly. Directories
399 * being truncated have zero size and are not subject to this
400 * check.
401 */
402 if (S_ISDIR(mode)) {
403 if (dip->di_size &&
404 be64_to_cpu(dip->di_size) <= fork_size &&
405 fork_format != XFS_DINODE_FMT_LOCAL)
406 return __this_address;
407 }
408
409 /*
410 * A symlink with a target small enough to fit in the inode can
411 * be stored in extents format if xattrs were added (thus
412 * converting the data fork from shortform to remote format)
413 * and then removed.
414 */
415 if (S_ISLNK(mode)) {
416 if (be64_to_cpu(dip->di_size) <= fork_size &&
417 fork_format != XFS_DINODE_FMT_EXTENTS &&
418 fork_format != XFS_DINODE_FMT_LOCAL)
419 return __this_address;
420 }
421
422 /*
423 * For all types, check that when the size says the fork should
424 * be in extent or btree format, the inode isn't claiming to be
425 * in local format.
426 */
427 if (be64_to_cpu(dip->di_size) > fork_size &&
428 fork_format == XFS_DINODE_FMT_LOCAL)
429 return __this_address;
430 }
431
432 switch (fork_format) {
433 case XFS_DINODE_FMT_LOCAL:
434 /*
435 * No local regular files yet.
436 */
437 if (S_ISREG(mode) && whichfork == XFS_DATA_FORK)
438 return __this_address;
439 if (di_nextents)
440 return __this_address;
441 break;
442 case XFS_DINODE_FMT_EXTENTS:
443 if (di_nextents > XFS_DFORK_MAXEXT(dip, mp, whichfork))
444 return __this_address;
445 break;
446 case XFS_DINODE_FMT_BTREE:
447 max_extents = xfs_iext_max_nextents(
448 xfs_dinode_has_large_extent_counts(dip),
449 whichfork);
450 if (di_nextents > max_extents)
451 return __this_address;
452 break;
453 case XFS_DINODE_FMT_META_BTREE:
454 if (!xfs_has_metadir(mp))
455 return __this_address;
456 if (!(dip->di_flags2 & cpu_to_be64(XFS_DIFLAG2_METADATA)))
457 return __this_address;
458 switch (be16_to_cpu(dip->di_metatype)) {
459 case XFS_METAFILE_RTRMAP:
460 /*
461 * growfs must create the rtrmap inodes before adding a
462 * realtime volume to the filesystem, so we cannot use
463 * the rtrmapbt predicate here.
464 */
465 if (!xfs_has_rmapbt(mp))
466 return __this_address;
467 break;
468 case XFS_METAFILE_RTREFCOUNT:
469 /* same comment about growfs and rmap inodes applies */
470 if (!xfs_has_reflink(mp))
471 return __this_address;
472 break;
473 default:
474 return __this_address;
475 }
476 break;
477 default:
478 return __this_address;
479 }
480 return NULL;
481 }
482
483 static xfs_failaddr_t
xfs_dinode_verify_forkoff(struct xfs_dinode * dip,struct xfs_mount * mp)484 xfs_dinode_verify_forkoff(
485 struct xfs_dinode *dip,
486 struct xfs_mount *mp)
487 {
488 if (!dip->di_forkoff)
489 return NULL;
490
491 switch (dip->di_format) {
492 case XFS_DINODE_FMT_DEV:
493 if (dip->di_forkoff != (roundup(sizeof(xfs_dev_t), 8) >> 3))
494 return __this_address;
495 break;
496 case XFS_DINODE_FMT_META_BTREE:
497 if (!xfs_has_metadir(mp) || !xfs_has_parent(mp))
498 return __this_address;
499 fallthrough;
500 case XFS_DINODE_FMT_LOCAL: /* fall through ... */
501 case XFS_DINODE_FMT_EXTENTS: /* fall through ... */
502 case XFS_DINODE_FMT_BTREE:
503 if (dip->di_forkoff >= (XFS_LITINO(mp) >> 3))
504 return __this_address;
505 break;
506 default:
507 return __this_address;
508 }
509 return NULL;
510 }
511
512 static xfs_failaddr_t
xfs_dinode_verify_nrext64(struct xfs_mount * mp,struct xfs_dinode * dip)513 xfs_dinode_verify_nrext64(
514 struct xfs_mount *mp,
515 struct xfs_dinode *dip)
516 {
517 if (xfs_dinode_has_large_extent_counts(dip)) {
518 if (!xfs_has_large_extent_counts(mp))
519 return __this_address;
520 if (dip->di_nrext64_pad != 0)
521 return __this_address;
522 } else if (dip->di_version >= 3) {
523 if (dip->di_v3_pad != 0)
524 return __this_address;
525 }
526
527 return NULL;
528 }
529
530 /*
531 * Validate all the picky requirements we have for a file that claims to be
532 * filesystem metadata.
533 */
534 xfs_failaddr_t
xfs_dinode_verify_metadir(struct xfs_mount * mp,struct xfs_dinode * dip,uint16_t mode,uint16_t flags,uint64_t flags2)535 xfs_dinode_verify_metadir(
536 struct xfs_mount *mp,
537 struct xfs_dinode *dip,
538 uint16_t mode,
539 uint16_t flags,
540 uint64_t flags2)
541 {
542 if (!xfs_has_metadir(mp))
543 return __this_address;
544
545 /* V5 filesystem only */
546 if (dip->di_version < 3)
547 return __this_address;
548
549 if (be16_to_cpu(dip->di_metatype) >= XFS_METAFILE_MAX)
550 return __this_address;
551
552 /* V3 inode fields that are always zero */
553 if ((flags2 & XFS_DIFLAG2_NREXT64) && dip->di_nrext64_pad)
554 return __this_address;
555 if (!(flags2 & XFS_DIFLAG2_NREXT64) && dip->di_flushiter)
556 return __this_address;
557
558 /* Metadata files can only be directories or regular files */
559 if (!S_ISDIR(mode) && !S_ISREG(mode))
560 return __this_address;
561
562 /* They must have zero access permissions */
563 if (mode & 0777)
564 return __this_address;
565
566 /* DMAPI event and state masks are zero */
567 if (dip->di_dmevmask || dip->di_dmstate)
568 return __this_address;
569
570 /*
571 * User and group IDs must be zero. The project ID is used for
572 * grouping inodes. Metadata inodes are never accounted to quotas.
573 */
574 if (dip->di_uid || dip->di_gid)
575 return __this_address;
576
577 /* Mandatory inode flags must be set */
578 if (S_ISDIR(mode)) {
579 if ((flags & XFS_METADIR_DIFLAGS) != XFS_METADIR_DIFLAGS)
580 return __this_address;
581 } else {
582 if ((flags & XFS_METAFILE_DIFLAGS) != XFS_METAFILE_DIFLAGS)
583 return __this_address;
584 }
585
586 /* dax flags2 must not be set */
587 if (flags2 & XFS_DIFLAG2_DAX)
588 return __this_address;
589
590 return NULL;
591 }
592
593 xfs_failaddr_t
xfs_dinode_verify(struct xfs_mount * mp,xfs_ino_t ino,struct xfs_dinode * dip)594 xfs_dinode_verify(
595 struct xfs_mount *mp,
596 xfs_ino_t ino,
597 struct xfs_dinode *dip)
598 {
599 xfs_failaddr_t fa;
600 uint16_t mode;
601 uint16_t flags;
602 uint64_t flags2;
603 uint64_t di_size;
604 xfs_extnum_t nextents;
605 xfs_extnum_t naextents;
606 xfs_filblks_t nblocks;
607
608 if (dip->di_magic != cpu_to_be16(XFS_DINODE_MAGIC))
609 return __this_address;
610
611 /* Verify v3 integrity information first */
612 if (dip->di_version >= 3) {
613 if (!xfs_has_v3inodes(mp))
614 return __this_address;
615 if (!xfs_verify_cksum((char *)dip, mp->m_sb.sb_inodesize,
616 XFS_DINODE_CRC_OFF))
617 return __this_address;
618 if (be64_to_cpu(dip->di_ino) != ino)
619 return __this_address;
620 if (!uuid_equal(&dip->di_uuid, &mp->m_sb.sb_meta_uuid))
621 return __this_address;
622 }
623
624 /*
625 * Historical note: xfsprogs in the 3.2 era set up its incore inodes to
626 * have di_nlink track the link count, even if the actual filesystem
627 * only supported V1 inodes (i.e. di_onlink). When writing out the
628 * ondisk inode, it would set both the ondisk di_nlink and di_onlink to
629 * the incore di_nlink value, which is why we cannot check for
630 * di_nlink==0 on a V1 inode. V2/3 inodes would get written out with
631 * di_onlink==0, so we can check that.
632 */
633 if (dip->di_version == 2) {
634 if (dip->di_metatype)
635 return __this_address;
636 } else if (dip->di_version >= 3) {
637 if (!xfs_dinode_is_metadir(dip) && dip->di_metatype)
638 return __this_address;
639 }
640
641 /* don't allow invalid i_size */
642 di_size = be64_to_cpu(dip->di_size);
643 if (di_size & (1ULL << 63))
644 return __this_address;
645
646 mode = be16_to_cpu(dip->di_mode);
647 if (mode && xfs_mode_to_ftype(mode) == XFS_DIR3_FT_UNKNOWN)
648 return __this_address;
649
650 /*
651 * No zero-length symlinks/dirs unless they're unlinked and hence being
652 * inactivated.
653 */
654 if ((S_ISLNK(mode) || S_ISDIR(mode)) && di_size == 0) {
655 if (dip->di_version > 1) {
656 if (dip->di_nlink)
657 return __this_address;
658 } else {
659 /* di_metatype used to be di_onlink */
660 if (dip->di_metatype)
661 return __this_address;
662 }
663 }
664
665 fa = xfs_dinode_verify_nrext64(mp, dip);
666 if (fa)
667 return fa;
668
669 nextents = xfs_dfork_data_extents(dip);
670 naextents = xfs_dfork_attr_extents(dip);
671 nblocks = be64_to_cpu(dip->di_nblocks);
672
673 /* Fork checks carried over from xfs_iformat_fork */
674 if (mode && nextents + naextents > nblocks)
675 return __this_address;
676
677 if (S_ISDIR(mode) && nextents > mp->m_dir_geo->max_extents)
678 return __this_address;
679
680 if (mode && XFS_DFORK_BOFF(dip) > mp->m_sb.sb_inodesize)
681 return __this_address;
682
683 flags = be16_to_cpu(dip->di_flags);
684
685 if (mode && (flags & XFS_DIFLAG_REALTIME) && !mp->m_rtdev_targp)
686 return __this_address;
687
688 /* check for illegal values of forkoff */
689 fa = xfs_dinode_verify_forkoff(dip, mp);
690 if (fa)
691 return fa;
692
693 /* Do we have appropriate data fork formats for the mode? */
694 switch (mode & S_IFMT) {
695 case S_IFIFO:
696 case S_IFCHR:
697 case S_IFBLK:
698 case S_IFSOCK:
699 if (dip->di_format != XFS_DINODE_FMT_DEV)
700 return __this_address;
701 break;
702 case S_IFREG:
703 case S_IFLNK:
704 case S_IFDIR:
705 fa = xfs_dinode_verify_fork(dip, mp, XFS_DATA_FORK);
706 if (fa)
707 return fa;
708 break;
709 case 0:
710 /* Uninitialized inode ok. */
711 break;
712 default:
713 return __this_address;
714 }
715
716 if (dip->di_forkoff) {
717 fa = xfs_dinode_verify_fork(dip, mp, XFS_ATTR_FORK);
718 if (fa)
719 return fa;
720 } else {
721 /*
722 * If there is no fork offset, this may be a freshly-made inode
723 * in a new disk cluster, in which case di_aformat is zeroed.
724 * Otherwise, such an inode must be in EXTENTS format; this goes
725 * for freed inodes as well.
726 */
727 switch (dip->di_aformat) {
728 case 0:
729 case XFS_DINODE_FMT_EXTENTS:
730 break;
731 default:
732 return __this_address;
733 }
734 if (naextents)
735 return __this_address;
736 }
737
738 /* extent size hint validation */
739 fa = xfs_inode_validate_extsize(mp, be32_to_cpu(dip->di_extsize),
740 mode, flags);
741 if (fa)
742 return fa;
743
744 /* only version 3 or greater inodes are extensively verified here */
745 if (dip->di_version < 3)
746 return NULL;
747
748 flags2 = be64_to_cpu(dip->di_flags2);
749
750 /* don't allow reflink/cowextsize if we don't have reflink */
751 if ((flags2 & (XFS_DIFLAG2_REFLINK | XFS_DIFLAG2_COWEXTSIZE)) &&
752 !xfs_has_reflink(mp))
753 return __this_address;
754
755 /* only regular files get reflink */
756 if ((flags2 & XFS_DIFLAG2_REFLINK) && (mode & S_IFMT) != S_IFREG)
757 return __this_address;
758
759 /* don't let reflink and realtime mix */
760 if ((flags2 & XFS_DIFLAG2_REFLINK) && (flags & XFS_DIFLAG_REALTIME) &&
761 !xfs_has_rtreflink(mp))
762 return __this_address;
763
764 if (xfs_has_zoned(mp) &&
765 dip->di_metatype == cpu_to_be16(XFS_METAFILE_RTRMAP)) {
766 if (be32_to_cpu(dip->di_used_blocks) > mp->m_sb.sb_rgextents)
767 return __this_address;
768 } else {
769 /* COW extent size hint validation */
770 fa = xfs_inode_validate_cowextsize(mp,
771 be32_to_cpu(dip->di_cowextsize),
772 mode, flags, flags2);
773 if (fa)
774 return fa;
775 }
776
777 /* bigtime iflag can only happen on bigtime filesystems */
778 if (xfs_dinode_has_bigtime(dip) &&
779 !xfs_has_bigtime(mp))
780 return __this_address;
781
782 if (flags2 & XFS_DIFLAG2_METADATA) {
783 fa = xfs_dinode_verify_metadir(mp, dip, mode, flags, flags2);
784 if (fa)
785 return fa;
786 }
787
788 /* metadata inodes containing btrees always have zero extent count */
789 if (XFS_DFORK_FORMAT(dip, XFS_DATA_FORK) != XFS_DINODE_FMT_META_BTREE) {
790 if (nextents + naextents == 0 && nblocks != 0)
791 return __this_address;
792 }
793
794 return NULL;
795 }
796
797 void
xfs_dinode_calc_crc(struct xfs_mount * mp,struct xfs_dinode * dip)798 xfs_dinode_calc_crc(
799 struct xfs_mount *mp,
800 struct xfs_dinode *dip)
801 {
802 uint32_t crc;
803
804 if (dip->di_version < 3)
805 return;
806
807 ASSERT(xfs_has_crc(mp));
808 crc = xfs_start_cksum_update((char *)dip, mp->m_sb.sb_inodesize,
809 XFS_DINODE_CRC_OFF);
810 dip->di_crc = xfs_end_cksum(crc);
811 }
812
813 /*
814 * Validate di_extsize hint.
815 *
816 * 1. Extent size hint is only valid for directories and regular files.
817 * 2. FS_XFLAG_EXTSIZE is only valid for regular files.
818 * 3. FS_XFLAG_EXTSZINHERIT is only valid for directories.
819 * 4. Hint cannot be larger than MAXTEXTLEN.
820 * 5. Can be changed on directories at any time.
821 * 6. Hint value of 0 turns off hints, clears inode flags.
822 * 7. Extent size must be a multiple of the appropriate block size.
823 * For realtime files, this is the rt extent size.
824 * 8. For non-realtime files, the extent size hint must be limited
825 * to half the AG size to avoid alignment extending the extent beyond the
826 * limits of the AG.
827 */
828 xfs_failaddr_t
xfs_inode_validate_extsize(struct xfs_mount * mp,uint32_t extsize,uint16_t mode,uint16_t flags)829 xfs_inode_validate_extsize(
830 struct xfs_mount *mp,
831 uint32_t extsize,
832 uint16_t mode,
833 uint16_t flags)
834 {
835 bool rt_flag;
836 bool hint_flag;
837 bool inherit_flag;
838 uint32_t extsize_bytes;
839 uint32_t blocksize_bytes;
840
841 rt_flag = (flags & XFS_DIFLAG_REALTIME);
842 hint_flag = (flags & XFS_DIFLAG_EXTSIZE);
843 inherit_flag = (flags & XFS_DIFLAG_EXTSZINHERIT);
844 extsize_bytes = XFS_FSB_TO_B(mp, extsize);
845
846 /*
847 * This comment describes a historic gap in this verifier function.
848 *
849 * For a directory with both RTINHERIT and EXTSZINHERIT flags set, this
850 * function has never checked that the extent size hint is an integer
851 * multiple of the realtime extent size. Since we allow users to set
852 * this combination on non-rt filesystems /and/ to change the rt
853 * extent size when adding a rt device to a filesystem, the net effect
854 * is that users can configure a filesystem anticipating one rt
855 * geometry and change their minds later. Directories do not use the
856 * extent size hint, so this is harmless for them.
857 *
858 * If a directory with a misaligned extent size hint is allowed to
859 * propagate that hint into a new regular realtime file, the result
860 * is that the inode cluster buffer verifier will trigger a corruption
861 * shutdown the next time it is run, because the verifier has always
862 * enforced the alignment rule for regular files.
863 *
864 * Because we allow administrators to set a new rt extent size when
865 * adding a rt section, we cannot add a check to this verifier because
866 * that will result a new source of directory corruption errors when
867 * reading an existing filesystem. Instead, we rely on callers to
868 * decide when alignment checks are appropriate, and fix things up as
869 * needed.
870 */
871
872 if (rt_flag)
873 blocksize_bytes = XFS_FSB_TO_B(mp, mp->m_sb.sb_rextsize);
874 else
875 blocksize_bytes = mp->m_sb.sb_blocksize;
876
877 if ((hint_flag || inherit_flag) && !(S_ISDIR(mode) || S_ISREG(mode)))
878 return __this_address;
879
880 if (hint_flag && !S_ISREG(mode))
881 return __this_address;
882
883 if (inherit_flag && !S_ISDIR(mode))
884 return __this_address;
885
886 if ((hint_flag || inherit_flag) && extsize == 0)
887 return __this_address;
888
889 /* free inodes get flags set to zero but extsize remains */
890 if (mode && !(hint_flag || inherit_flag) && extsize != 0)
891 return __this_address;
892
893 if (extsize_bytes % blocksize_bytes)
894 return __this_address;
895
896 if (extsize > XFS_MAX_BMBT_EXTLEN)
897 return __this_address;
898
899 if (!rt_flag && extsize > mp->m_sb.sb_agblocks / 2)
900 return __this_address;
901
902 return NULL;
903 }
904
905 /*
906 * Validate di_cowextsize hint.
907 *
908 * 1. CoW extent size hint can only be set if reflink is enabled on the fs.
909 * The inode does not have to have any shared blocks, but it must be a v3.
910 * 2. FS_XFLAG_COWEXTSIZE is only valid for directories and regular files;
911 * for a directory, the hint is propagated to new files.
912 * 3. Can be changed on files & directories at any time.
913 * 4. Hint value of 0 turns off hints, clears inode flags.
914 * 5. Extent size must be a multiple of the appropriate block size.
915 * 6. The extent size hint must be limited to half the AG size to avoid
916 * alignment extending the extent beyond the limits of the AG.
917 */
918 xfs_failaddr_t
xfs_inode_validate_cowextsize(struct xfs_mount * mp,uint32_t cowextsize,uint16_t mode,uint16_t flags,uint64_t flags2)919 xfs_inode_validate_cowextsize(
920 struct xfs_mount *mp,
921 uint32_t cowextsize,
922 uint16_t mode,
923 uint16_t flags,
924 uint64_t flags2)
925 {
926 bool rt_flag;
927 bool hint_flag;
928 uint32_t cowextsize_bytes;
929 uint32_t blocksize_bytes;
930
931 rt_flag = (flags & XFS_DIFLAG_REALTIME);
932 hint_flag = (flags2 & XFS_DIFLAG2_COWEXTSIZE);
933 cowextsize_bytes = XFS_FSB_TO_B(mp, cowextsize);
934
935 /*
936 * Similar to extent size hints, a directory can be configured to
937 * propagate realtime status and a CoW extent size hint to newly
938 * created files even if there is no realtime device, and the hints on
939 * disk can become misaligned if the sysadmin changes the rt extent
940 * size while adding the realtime device.
941 *
942 * Therefore, we can only enforce the rextsize alignment check against
943 * regular realtime files, and rely on callers to decide when alignment
944 * checks are appropriate, and fix things up as needed.
945 */
946
947 if (rt_flag)
948 blocksize_bytes = XFS_FSB_TO_B(mp, mp->m_sb.sb_rextsize);
949 else
950 blocksize_bytes = mp->m_sb.sb_blocksize;
951
952 if (hint_flag && !xfs_has_reflink(mp))
953 return __this_address;
954
955 if (hint_flag && !(S_ISDIR(mode) || S_ISREG(mode)))
956 return __this_address;
957
958 if (hint_flag && cowextsize == 0)
959 return __this_address;
960
961 /* free inodes get flags set to zero but cowextsize remains */
962 if (mode && !hint_flag && cowextsize != 0)
963 return __this_address;
964
965 if (cowextsize_bytes % blocksize_bytes)
966 return __this_address;
967
968 if (cowextsize > XFS_MAX_BMBT_EXTLEN)
969 return __this_address;
970
971 if (!rt_flag && cowextsize > mp->m_sb.sb_agblocks / 2)
972 return __this_address;
973
974 return NULL;
975 }
976