1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (C) 2017-2023 Oracle. All Rights Reserved.
4 * Author: Darrick J. Wong <djwong@kernel.org>
5 */
6 #include "xfs_platform.h"
7 #include "xfs_fs.h"
8 #include "xfs_shared.h"
9 #include "xfs_format.h"
10 #include "xfs_trans_resv.h"
11 #include "xfs_mount.h"
12 #include "xfs_btree.h"
13 #include "xfs_sb.h"
14 #include "xfs_alloc.h"
15 #include "xfs_ialloc.h"
16 #include "xfs_rmap.h"
17 #include "xfs_ag.h"
18 #include "xfs_inode.h"
19 #include "scrub/scrub.h"
20 #include "scrub/common.h"
21 #include "scrub/bitmap.h"
22 #include "scrub/agino_bitmap.h"
23
24 int
xchk_setup_agheader(struct xfs_scrub * sc)25 xchk_setup_agheader(
26 struct xfs_scrub *sc)
27 {
28 if (xchk_need_intent_drain(sc))
29 xchk_fsgates_enable(sc, XCHK_FSGATES_DRAIN);
30 return xchk_setup_fs(sc);
31 }
32
33 /* Superblock */
34
35 /* Cross-reference with the other btrees. */
36 STATIC void
xchk_superblock_xref(struct xfs_scrub * sc,struct xfs_buf * bp)37 xchk_superblock_xref(
38 struct xfs_scrub *sc,
39 struct xfs_buf *bp)
40 {
41 struct xfs_mount *mp = sc->mp;
42 xfs_agnumber_t agno = sc->sm->sm_agno;
43 xfs_agblock_t agbno;
44 int error;
45
46 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
47 return;
48
49 agbno = XFS_SB_BLOCK(mp);
50
51 error = xchk_ag_init_existing(sc, agno, &sc->sa);
52 if (!xchk_xref_process_error(sc, agno, agbno, &error))
53 return;
54
55 xchk_xref_is_used_space(sc, agbno, 1);
56 xchk_xref_is_not_inode_chunk(sc, agbno, 1);
57 xchk_xref_is_only_owned_by(sc, agbno, 1, &XFS_RMAP_OINFO_FS);
58 xchk_xref_is_not_shared(sc, agbno, 1);
59 xchk_xref_is_not_cow_staging(sc, agbno, 1);
60
61 /* scrub teardown will take care of sc->sa for us */
62 }
63
64 /*
65 * Calculate the ondisk superblock size in bytes given the feature set of the
66 * mounted filesystem (aka the primary sb). This is subtlely different from
67 * the logic in xfs_repair, which computes the size of a secondary sb given the
68 * featureset listed in the secondary sb.
69 */
70 STATIC size_t
xchk_superblock_ondisk_size(struct xfs_mount * mp)71 xchk_superblock_ondisk_size(
72 struct xfs_mount *mp)
73 {
74 if (xfs_has_zoned(mp))
75 return offsetofend(struct xfs_dsb, sb_rtreserved);
76 if (xfs_has_metadir(mp))
77 return offsetofend(struct xfs_dsb, sb_pad);
78 if (xfs_has_metauuid(mp))
79 return offsetofend(struct xfs_dsb, sb_meta_uuid);
80 if (xfs_has_crc(mp))
81 return offsetofend(struct xfs_dsb, sb_lsn);
82 if (xfs_sb_version_hasmorebits(&mp->m_sb))
83 return offsetofend(struct xfs_dsb, sb_bad_features2);
84 if (xfs_has_logv2(mp))
85 return offsetofend(struct xfs_dsb, sb_logsunit);
86 if (xfs_has_sector(mp))
87 return offsetofend(struct xfs_dsb, sb_logsectsize);
88 /* only support dirv2 or more recent */
89 return offsetofend(struct xfs_dsb, sb_dirblklog);
90 }
91
92 /*
93 * Scrub the filesystem superblock.
94 *
95 * Note: We do /not/ attempt to check AG 0's superblock. Mount is
96 * responsible for validating all the geometry information in sb 0, so
97 * if the filesystem is capable of initiating online scrub, then clearly
98 * sb 0 is ok and we can use its information to check everything else.
99 */
100 int
xchk_superblock(struct xfs_scrub * sc)101 xchk_superblock(
102 struct xfs_scrub *sc)
103 {
104 struct xfs_mount *mp = sc->mp;
105 struct xfs_buf *bp;
106 struct xfs_dsb *sb;
107 struct xfs_perag *pag;
108 size_t sblen;
109 xfs_agnumber_t agno;
110 uint32_t v2_ok;
111 __be32 features_mask;
112 int error;
113 __be16 vernum_mask;
114
115 agno = sc->sm->sm_agno;
116 if (agno == 0)
117 return 0;
118
119 /*
120 * Grab an active reference to the perag structure. If we can't get
121 * it, we're racing with something that's tearing down the AG, so
122 * signal that the AG no longer exists.
123 */
124 pag = xfs_perag_get(mp, agno);
125 if (!pag)
126 return -ENOENT;
127
128 error = xfs_sb_read_secondary(mp, sc->tp, agno, &bp);
129 /*
130 * The superblock verifier can return several different error codes
131 * if it thinks the superblock doesn't look right. For a mount these
132 * would all get bounced back to userspace, but if we're here then the
133 * fs mounted successfully, which means that this secondary superblock
134 * is simply incorrect. Treat all these codes the same way we treat
135 * any corruption.
136 */
137 switch (error) {
138 case -EINVAL: /* also -EWRONGFS */
139 case -ENOSYS:
140 case -EFBIG:
141 error = -EFSCORRUPTED;
142 fallthrough;
143 default:
144 break;
145 }
146 if (!xchk_process_error(sc, agno, XFS_SB_BLOCK(mp), &error))
147 goto out_pag;
148
149 sb = bp->b_addr;
150
151 /*
152 * Verify the geometries match. Fields that are permanently
153 * set by mkfs are checked; fields that can be updated later
154 * (and are not propagated to backup superblocks) are preen
155 * checked.
156 */
157 if (sb->sb_blocksize != cpu_to_be32(mp->m_sb.sb_blocksize))
158 xchk_block_set_corrupt(sc, bp);
159
160 if (sb->sb_dblocks != cpu_to_be64(mp->m_sb.sb_dblocks))
161 xchk_block_set_corrupt(sc, bp);
162
163 if (sb->sb_rblocks != cpu_to_be64(mp->m_sb.sb_rblocks))
164 xchk_block_set_corrupt(sc, bp);
165
166 if (sb->sb_rextents != cpu_to_be64(mp->m_sb.sb_rextents))
167 xchk_block_set_corrupt(sc, bp);
168
169 if (!uuid_equal(&sb->sb_uuid, &mp->m_sb.sb_uuid))
170 xchk_block_set_preen(sc, bp);
171
172 if (sb->sb_logstart != cpu_to_be64(mp->m_sb.sb_logstart))
173 xchk_block_set_corrupt(sc, bp);
174
175 if (sb->sb_rootino != cpu_to_be64(mp->m_sb.sb_rootino))
176 xchk_block_set_preen(sc, bp);
177
178 if (xfs_has_metadir(sc->mp)) {
179 if (sb->sb_rbmino != cpu_to_be64(0))
180 xchk_block_set_corrupt(sc, bp);
181
182 if (sb->sb_rsumino != cpu_to_be64(0))
183 xchk_block_set_corrupt(sc, bp);
184 } else {
185 if (sb->sb_rbmino != cpu_to_be64(mp->m_sb.sb_rbmino))
186 xchk_block_set_preen(sc, bp);
187
188 if (sb->sb_rsumino != cpu_to_be64(mp->m_sb.sb_rsumino))
189 xchk_block_set_preen(sc, bp);
190 }
191
192 if (sb->sb_rextsize != cpu_to_be32(mp->m_sb.sb_rextsize))
193 xchk_block_set_corrupt(sc, bp);
194
195 if (sb->sb_agblocks != cpu_to_be32(mp->m_sb.sb_agblocks))
196 xchk_block_set_corrupt(sc, bp);
197
198 if (sb->sb_agcount != cpu_to_be32(mp->m_sb.sb_agcount))
199 xchk_block_set_corrupt(sc, bp);
200
201 if (sb->sb_rbmblocks != cpu_to_be32(mp->m_sb.sb_rbmblocks))
202 xchk_block_set_corrupt(sc, bp);
203
204 if (sb->sb_logblocks != cpu_to_be32(mp->m_sb.sb_logblocks))
205 xchk_block_set_corrupt(sc, bp);
206
207 /* Check sb_versionnum bits that are set at mkfs time. */
208 vernum_mask = cpu_to_be16(XFS_SB_VERSION_NUMBITS |
209 XFS_SB_VERSION_ALIGNBIT |
210 XFS_SB_VERSION_DALIGNBIT |
211 XFS_SB_VERSION_SHAREDBIT |
212 XFS_SB_VERSION_LOGV2BIT |
213 XFS_SB_VERSION_SECTORBIT |
214 XFS_SB_VERSION_EXTFLGBIT |
215 XFS_SB_VERSION_DIRV2BIT);
216 if ((sb->sb_versionnum & vernum_mask) !=
217 (cpu_to_be16(mp->m_sb.sb_versionnum) & vernum_mask))
218 xchk_block_set_corrupt(sc, bp);
219
220 /* Check sb_versionnum bits that can be set after mkfs time. */
221 vernum_mask = cpu_to_be16(XFS_SB_VERSION_ATTRBIT |
222 XFS_SB_VERSION_NLINKBIT |
223 XFS_SB_VERSION_QUOTABIT);
224 if ((sb->sb_versionnum & vernum_mask) !=
225 (cpu_to_be16(mp->m_sb.sb_versionnum) & vernum_mask))
226 xchk_block_set_preen(sc, bp);
227
228 if (sb->sb_sectsize != cpu_to_be16(mp->m_sb.sb_sectsize))
229 xchk_block_set_corrupt(sc, bp);
230
231 if (sb->sb_inodesize != cpu_to_be16(mp->m_sb.sb_inodesize))
232 xchk_block_set_corrupt(sc, bp);
233
234 if (sb->sb_inopblock != cpu_to_be16(mp->m_sb.sb_inopblock))
235 xchk_block_set_corrupt(sc, bp);
236
237 if (memcmp(sb->sb_fname, mp->m_sb.sb_fname, sizeof(sb->sb_fname)))
238 xchk_block_set_preen(sc, bp);
239
240 if (sb->sb_blocklog != mp->m_sb.sb_blocklog)
241 xchk_block_set_corrupt(sc, bp);
242
243 if (sb->sb_sectlog != mp->m_sb.sb_sectlog)
244 xchk_block_set_corrupt(sc, bp);
245
246 if (sb->sb_inodelog != mp->m_sb.sb_inodelog)
247 xchk_block_set_corrupt(sc, bp);
248
249 if (sb->sb_inopblog != mp->m_sb.sb_inopblog)
250 xchk_block_set_corrupt(sc, bp);
251
252 if (sb->sb_agblklog != mp->m_sb.sb_agblklog)
253 xchk_block_set_corrupt(sc, bp);
254
255 if (sb->sb_rextslog != mp->m_sb.sb_rextslog)
256 xchk_block_set_corrupt(sc, bp);
257
258 if (sb->sb_imax_pct != mp->m_sb.sb_imax_pct)
259 xchk_block_set_preen(sc, bp);
260
261 /*
262 * Skip the summary counters since we track them in memory anyway.
263 * sb_icount, sb_ifree, sb_fdblocks, sb_frexents
264 */
265
266 if (xfs_has_metadir(mp)) {
267 if (sb->sb_uquotino != cpu_to_be64(0))
268 xchk_block_set_corrupt(sc, bp);
269
270 if (sb->sb_gquotino != cpu_to_be64(0))
271 xchk_block_set_corrupt(sc, bp);
272 } else {
273 if (sb->sb_uquotino != cpu_to_be64(mp->m_sb.sb_uquotino))
274 xchk_block_set_preen(sc, bp);
275
276 if (sb->sb_gquotino != cpu_to_be64(mp->m_sb.sb_gquotino))
277 xchk_block_set_preen(sc, bp);
278 }
279
280 /*
281 * Skip the quota flags since repair will force quotacheck.
282 * sb_qflags
283 */
284
285 if (sb->sb_flags != mp->m_sb.sb_flags)
286 xchk_block_set_corrupt(sc, bp);
287
288 if (sb->sb_shared_vn != mp->m_sb.sb_shared_vn)
289 xchk_block_set_corrupt(sc, bp);
290
291 if (sb->sb_inoalignmt != cpu_to_be32(mp->m_sb.sb_inoalignmt))
292 xchk_block_set_corrupt(sc, bp);
293
294 if (sb->sb_unit != cpu_to_be32(mp->m_sb.sb_unit))
295 xchk_block_set_preen(sc, bp);
296
297 if (sb->sb_width != cpu_to_be32(mp->m_sb.sb_width))
298 xchk_block_set_preen(sc, bp);
299
300 if (sb->sb_dirblklog != mp->m_sb.sb_dirblklog)
301 xchk_block_set_corrupt(sc, bp);
302
303 if (sb->sb_logsectlog != mp->m_sb.sb_logsectlog)
304 xchk_block_set_corrupt(sc, bp);
305
306 if (sb->sb_logsectsize != cpu_to_be16(mp->m_sb.sb_logsectsize))
307 xchk_block_set_corrupt(sc, bp);
308
309 if (sb->sb_logsunit != cpu_to_be32(mp->m_sb.sb_logsunit))
310 xchk_block_set_corrupt(sc, bp);
311
312 /* Do we see any invalid bits in sb_features2? */
313 if (!xfs_sb_version_hasmorebits(&mp->m_sb)) {
314 if (sb->sb_features2 != 0)
315 xchk_block_set_corrupt(sc, bp);
316 } else {
317 v2_ok = XFS_SB_VERSION2_OKBITS;
318 if (xfs_sb_is_v5(&mp->m_sb))
319 v2_ok |= XFS_SB_VERSION2_CRCBIT;
320
321 if (!!(sb->sb_features2 & cpu_to_be32(~v2_ok)))
322 xchk_block_set_corrupt(sc, bp);
323
324 if (sb->sb_features2 != sb->sb_bad_features2)
325 xchk_block_set_preen(sc, bp);
326 }
327
328 /* Check sb_features2 flags that are set at mkfs time. */
329 features_mask = cpu_to_be32(XFS_SB_VERSION2_LAZYSBCOUNTBIT |
330 XFS_SB_VERSION2_PROJID32BIT |
331 XFS_SB_VERSION2_CRCBIT |
332 XFS_SB_VERSION2_FTYPE);
333 if ((sb->sb_features2 & features_mask) !=
334 (cpu_to_be32(mp->m_sb.sb_features2) & features_mask))
335 xchk_block_set_corrupt(sc, bp);
336
337 /* Check sb_features2 flags that can be set after mkfs time. */
338 features_mask = cpu_to_be32(XFS_SB_VERSION2_ATTR2BIT);
339 if ((sb->sb_features2 & features_mask) !=
340 (cpu_to_be32(mp->m_sb.sb_features2) & features_mask))
341 xchk_block_set_preen(sc, bp);
342
343 if (!xfs_has_crc(mp)) {
344 /* all v5 fields must be zero */
345 if (memchr_inv(&sb->sb_features_compat, 0,
346 sizeof(struct xfs_dsb) -
347 offsetof(struct xfs_dsb, sb_features_compat)))
348 xchk_block_set_corrupt(sc, bp);
349 } else {
350 /* compat features must match */
351 if (sb->sb_features_compat !=
352 cpu_to_be32(mp->m_sb.sb_features_compat))
353 xchk_block_set_corrupt(sc, bp);
354
355 /* ro compat features must match */
356 if (sb->sb_features_ro_compat !=
357 cpu_to_be32(mp->m_sb.sb_features_ro_compat))
358 xchk_block_set_corrupt(sc, bp);
359
360 /*
361 * NEEDSREPAIR is ignored on a secondary super, so we should
362 * clear it when we find it, though it's not a corruption.
363 */
364 features_mask = cpu_to_be32(XFS_SB_FEAT_INCOMPAT_NEEDSREPAIR);
365 if ((cpu_to_be32(mp->m_sb.sb_features_incompat) ^
366 sb->sb_features_incompat) & features_mask)
367 xchk_block_set_preen(sc, bp);
368
369 /* all other incompat features must match */
370 if ((cpu_to_be32(mp->m_sb.sb_features_incompat) ^
371 sb->sb_features_incompat) & ~features_mask)
372 xchk_block_set_corrupt(sc, bp);
373
374 /*
375 * log incompat features protect newer log record types from
376 * older log recovery code. Log recovery doesn't check the
377 * secondary supers, so we can clear these if needed.
378 */
379 if (sb->sb_features_log_incompat)
380 xchk_block_set_preen(sc, bp);
381
382 /* Don't care about sb_crc */
383
384 if (sb->sb_spino_align != cpu_to_be32(mp->m_sb.sb_spino_align))
385 xchk_block_set_corrupt(sc, bp);
386
387 if (xfs_has_metadir(mp)) {
388 if (sb->sb_pquotino != cpu_to_be64(0))
389 xchk_block_set_corrupt(sc, bp);
390 } else {
391 if (sb->sb_pquotino != cpu_to_be64(mp->m_sb.sb_pquotino))
392 xchk_block_set_preen(sc, bp);
393 }
394
395 /* Don't care about sb_lsn */
396 }
397
398 if (xfs_has_metauuid(mp)) {
399 /* The metadata UUID must be the same for all supers */
400 if (!uuid_equal(&sb->sb_meta_uuid, &mp->m_sb.sb_meta_uuid))
401 xchk_block_set_corrupt(sc, bp);
402 }
403
404 if (xfs_has_metadir(mp)) {
405 if (sb->sb_metadirino != cpu_to_be64(mp->m_sb.sb_metadirino))
406 xchk_block_set_preen(sc, bp);
407
408 if (sb->sb_rgcount != cpu_to_be32(mp->m_sb.sb_rgcount))
409 xchk_block_set_corrupt(sc, bp);
410
411 if (sb->sb_rgextents != cpu_to_be32(mp->m_sb.sb_rgextents))
412 xchk_block_set_corrupt(sc, bp);
413
414 if (sb->sb_rgblklog != mp->m_sb.sb_rgblklog)
415 xchk_block_set_corrupt(sc, bp);
416
417 if (memchr_inv(sb->sb_pad, 0, sizeof(sb->sb_pad)))
418 xchk_block_set_corrupt(sc, bp);
419 }
420
421 /* Everything else must be zero. */
422 sblen = xchk_superblock_ondisk_size(mp);
423 if (memchr_inv((char *)sb + sblen, 0, BBTOB(bp->b_length) - sblen))
424 xchk_block_set_corrupt(sc, bp);
425
426 xchk_superblock_xref(sc, bp);
427 out_pag:
428 xfs_perag_put(pag);
429 return error;
430 }
431
432 /* AGF */
433
434 /* Tally freespace record lengths. */
435 STATIC int
xchk_agf_record_bno_lengths(struct xfs_btree_cur * cur,const struct xfs_alloc_rec_incore * rec,void * priv)436 xchk_agf_record_bno_lengths(
437 struct xfs_btree_cur *cur,
438 const struct xfs_alloc_rec_incore *rec,
439 void *priv)
440 {
441 xfs_extlen_t *blocks = priv;
442
443 (*blocks) += rec->ar_blockcount;
444 return 0;
445 }
446
447 /* Check agf_freeblks */
448 static inline void
xchk_agf_xref_freeblks(struct xfs_scrub * sc)449 xchk_agf_xref_freeblks(
450 struct xfs_scrub *sc)
451 {
452 struct xfs_agf *agf = sc->sa.agf_bp->b_addr;
453 xfs_extlen_t blocks = 0;
454 int error;
455
456 if (!sc->sa.bno_cur)
457 return;
458
459 error = xfs_alloc_query_all(sc->sa.bno_cur,
460 xchk_agf_record_bno_lengths, &blocks);
461 if (!xchk_should_check_xref(sc, &error, &sc->sa.bno_cur))
462 return;
463 if (blocks != be32_to_cpu(agf->agf_freeblks))
464 xchk_block_xref_set_corrupt(sc, sc->sa.agf_bp);
465 }
466
467 /* Cross reference the AGF with the cntbt (freespace by length btree) */
468 static inline void
xchk_agf_xref_cntbt(struct xfs_scrub * sc)469 xchk_agf_xref_cntbt(
470 struct xfs_scrub *sc)
471 {
472 struct xfs_agf *agf = sc->sa.agf_bp->b_addr;
473 xfs_agblock_t agbno;
474 xfs_extlen_t blocks;
475 int have;
476 int error;
477
478 if (!sc->sa.cnt_cur)
479 return;
480
481 /* Any freespace at all? */
482 error = xfs_alloc_lookup_le(sc->sa.cnt_cur, 0, -1U, &have);
483 if (!xchk_should_check_xref(sc, &error, &sc->sa.cnt_cur))
484 return;
485 if (!have) {
486 if (agf->agf_freeblks != cpu_to_be32(0))
487 xchk_block_xref_set_corrupt(sc, sc->sa.agf_bp);
488 return;
489 }
490
491 /* Check agf_longest */
492 error = xfs_alloc_get_rec(sc->sa.cnt_cur, &agbno, &blocks, &have);
493 if (!xchk_should_check_xref(sc, &error, &sc->sa.cnt_cur))
494 return;
495 if (!have || blocks != be32_to_cpu(agf->agf_longest))
496 xchk_block_xref_set_corrupt(sc, sc->sa.agf_bp);
497 }
498
499 /* Check the btree block counts in the AGF against the btrees. */
500 STATIC void
xchk_agf_xref_btreeblks(struct xfs_scrub * sc)501 xchk_agf_xref_btreeblks(
502 struct xfs_scrub *sc)
503 {
504 struct xfs_agf *agf = sc->sa.agf_bp->b_addr;
505 struct xfs_mount *mp = sc->mp;
506 xfs_filblks_t blocks;
507 xfs_agblock_t btreeblks;
508 int error;
509
510 /* agf_btreeblks didn't exist before lazysbcount */
511 if (!xfs_has_lazysbcount(sc->mp))
512 return;
513
514 /* Check agf_rmap_blocks; set up for agf_btreeblks check */
515 if (sc->sa.rmap_cur) {
516 error = xfs_btree_count_blocks(sc->sa.rmap_cur, &blocks);
517 if (!xchk_should_check_xref(sc, &error, &sc->sa.rmap_cur))
518 return;
519 btreeblks = blocks - 1;
520 if (blocks != be32_to_cpu(agf->agf_rmap_blocks))
521 xchk_block_xref_set_corrupt(sc, sc->sa.agf_bp);
522 } else {
523 btreeblks = 0;
524 }
525
526 /*
527 * No rmap cursor; we can't xref if we have the rmapbt feature.
528 * We also can't do it if we're missing the free space btree cursors.
529 */
530 if ((xfs_has_rmapbt(mp) && !sc->sa.rmap_cur) ||
531 !sc->sa.bno_cur || !sc->sa.cnt_cur)
532 return;
533
534 /* Check agf_btreeblks */
535 error = xfs_btree_count_blocks(sc->sa.bno_cur, &blocks);
536 if (!xchk_should_check_xref(sc, &error, &sc->sa.bno_cur))
537 return;
538 btreeblks += blocks - 1;
539
540 error = xfs_btree_count_blocks(sc->sa.cnt_cur, &blocks);
541 if (!xchk_should_check_xref(sc, &error, &sc->sa.cnt_cur))
542 return;
543 btreeblks += blocks - 1;
544
545 if (btreeblks != be32_to_cpu(agf->agf_btreeblks))
546 xchk_block_xref_set_corrupt(sc, sc->sa.agf_bp);
547 }
548
549 /* Check agf_refcount_blocks against tree size */
550 static inline void
xchk_agf_xref_refcblks(struct xfs_scrub * sc)551 xchk_agf_xref_refcblks(
552 struct xfs_scrub *sc)
553 {
554 struct xfs_agf *agf = sc->sa.agf_bp->b_addr;
555 xfs_filblks_t blocks;
556 int error;
557
558 if (!sc->sa.refc_cur)
559 return;
560
561 error = xfs_btree_count_blocks(sc->sa.refc_cur, &blocks);
562 if (!xchk_should_check_xref(sc, &error, &sc->sa.refc_cur))
563 return;
564 if (blocks != be32_to_cpu(agf->agf_refcount_blocks))
565 xchk_block_xref_set_corrupt(sc, sc->sa.agf_bp);
566 }
567
568 /* Cross-reference with the other btrees. */
569 STATIC void
xchk_agf_xref(struct xfs_scrub * sc)570 xchk_agf_xref(
571 struct xfs_scrub *sc)
572 {
573 struct xfs_mount *mp = sc->mp;
574 xfs_agblock_t agbno;
575
576 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
577 return;
578
579 agbno = XFS_AGF_BLOCK(mp);
580
581 xchk_ag_btcur_init(sc, &sc->sa);
582
583 xchk_xref_is_used_space(sc, agbno, 1);
584 xchk_agf_xref_freeblks(sc);
585 xchk_agf_xref_cntbt(sc);
586 xchk_xref_is_not_inode_chunk(sc, agbno, 1);
587 xchk_xref_is_only_owned_by(sc, agbno, 1, &XFS_RMAP_OINFO_FS);
588 xchk_agf_xref_btreeblks(sc);
589 xchk_xref_is_not_shared(sc, agbno, 1);
590 xchk_xref_is_not_cow_staging(sc, agbno, 1);
591 xchk_agf_xref_refcblks(sc);
592
593 /* scrub teardown will take care of sc->sa for us */
594 }
595
596 /* Scrub the AGF. */
597 int
xchk_agf(struct xfs_scrub * sc)598 xchk_agf(
599 struct xfs_scrub *sc)
600 {
601 struct xfs_mount *mp = sc->mp;
602 struct xfs_agf *agf;
603 struct xfs_perag *pag;
604 xfs_agnumber_t agno = sc->sm->sm_agno;
605 xfs_agblock_t agbno;
606 xfs_agblock_t eoag;
607 xfs_agblock_t agfl_first;
608 xfs_agblock_t agfl_last;
609 xfs_agblock_t agfl_count;
610 xfs_agblock_t fl_count;
611 int level;
612 int error = 0;
613
614 error = xchk_ag_read_headers(sc, agno, &sc->sa);
615 if (!xchk_process_error(sc, agno, XFS_AGF_BLOCK(sc->mp), &error))
616 goto out;
617 xchk_buffer_recheck(sc, sc->sa.agf_bp);
618
619 agf = sc->sa.agf_bp->b_addr;
620 pag = sc->sa.pag;
621
622 /* Check the AG length */
623 eoag = be32_to_cpu(agf->agf_length);
624 if (eoag != pag_group(pag)->xg_block_count)
625 xchk_block_set_corrupt(sc, sc->sa.agf_bp);
626
627 /* Check the AGF btree roots and levels */
628 agbno = be32_to_cpu(agf->agf_bno_root);
629 if (!xfs_verify_agbno(pag, agbno))
630 xchk_block_set_corrupt(sc, sc->sa.agf_bp);
631
632 agbno = be32_to_cpu(agf->agf_cnt_root);
633 if (!xfs_verify_agbno(pag, agbno))
634 xchk_block_set_corrupt(sc, sc->sa.agf_bp);
635
636 level = be32_to_cpu(agf->agf_bno_level);
637 if (level <= 0 || level > mp->m_alloc_maxlevels)
638 xchk_block_set_corrupt(sc, sc->sa.agf_bp);
639
640 level = be32_to_cpu(agf->agf_cnt_level);
641 if (level <= 0 || level > mp->m_alloc_maxlevels)
642 xchk_block_set_corrupt(sc, sc->sa.agf_bp);
643
644 if (xfs_has_rmapbt(mp)) {
645 agbno = be32_to_cpu(agf->agf_rmap_root);
646 if (!xfs_verify_agbno(pag, agbno))
647 xchk_block_set_corrupt(sc, sc->sa.agf_bp);
648
649 level = be32_to_cpu(agf->agf_rmap_level);
650 if (level <= 0 || level > mp->m_rmap_maxlevels)
651 xchk_block_set_corrupt(sc, sc->sa.agf_bp);
652 }
653
654 if (xfs_has_reflink(mp)) {
655 agbno = be32_to_cpu(agf->agf_refcount_root);
656 if (!xfs_verify_agbno(pag, agbno))
657 xchk_block_set_corrupt(sc, sc->sa.agf_bp);
658
659 level = be32_to_cpu(agf->agf_refcount_level);
660 if (level <= 0 || level > mp->m_refc_maxlevels)
661 xchk_block_set_corrupt(sc, sc->sa.agf_bp);
662 }
663
664 /* Check the AGFL counters */
665 agfl_first = be32_to_cpu(agf->agf_flfirst);
666 agfl_last = be32_to_cpu(agf->agf_fllast);
667 agfl_count = be32_to_cpu(agf->agf_flcount);
668 if (agfl_last > agfl_first)
669 fl_count = agfl_last - agfl_first + 1;
670 else
671 fl_count = xfs_agfl_size(mp) - agfl_first + agfl_last + 1;
672 if (agfl_count != 0 && fl_count != agfl_count)
673 xchk_block_set_corrupt(sc, sc->sa.agf_bp);
674
675 /* Do the incore counters match? */
676 if (pag->pagf_freeblks != be32_to_cpu(agf->agf_freeblks))
677 xchk_block_set_corrupt(sc, sc->sa.agf_bp);
678 if (pag->pagf_flcount != be32_to_cpu(agf->agf_flcount))
679 xchk_block_set_corrupt(sc, sc->sa.agf_bp);
680 if (xfs_has_lazysbcount(sc->mp) &&
681 pag->pagf_btreeblks != be32_to_cpu(agf->agf_btreeblks))
682 xchk_block_set_corrupt(sc, sc->sa.agf_bp);
683
684 xchk_agf_xref(sc);
685 out:
686 return error;
687 }
688
689 /* AGFL */
690
691 struct xchk_agfl_info {
692 /* Number of AGFL entries that the AGF claims are in use. */
693 unsigned int agflcount;
694
695 /* Number of AGFL entries that we found. */
696 unsigned int nr_entries;
697
698 /* Buffer to hold AGFL entries for extent checking. */
699 xfs_agblock_t *entries;
700
701 struct xfs_buf *agfl_bp;
702 struct xfs_scrub *sc;
703 };
704
705 /* Cross-reference with the other btrees. */
706 STATIC void
xchk_agfl_block_xref(struct xfs_scrub * sc,xfs_agblock_t agbno)707 xchk_agfl_block_xref(
708 struct xfs_scrub *sc,
709 xfs_agblock_t agbno)
710 {
711 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
712 return;
713
714 xchk_xref_is_used_space(sc, agbno, 1);
715 xchk_xref_is_not_inode_chunk(sc, agbno, 1);
716 xchk_xref_is_only_owned_by(sc, agbno, 1, &XFS_RMAP_OINFO_AG);
717 xchk_xref_is_not_shared(sc, agbno, 1);
718 xchk_xref_is_not_cow_staging(sc, agbno, 1);
719 }
720
721 /* Scrub an AGFL block. */
722 STATIC int
xchk_agfl_block(struct xfs_mount * mp,xfs_agblock_t agbno,void * priv)723 xchk_agfl_block(
724 struct xfs_mount *mp,
725 xfs_agblock_t agbno,
726 void *priv)
727 {
728 struct xchk_agfl_info *sai = priv;
729 struct xfs_scrub *sc = sai->sc;
730
731 if (xfs_verify_agbno(sc->sa.pag, agbno) &&
732 sai->nr_entries < sai->agflcount)
733 sai->entries[sai->nr_entries++] = agbno;
734 else
735 xchk_block_set_corrupt(sc, sai->agfl_bp);
736
737 xchk_agfl_block_xref(sc, agbno);
738
739 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
740 return -ECANCELED;
741
742 return 0;
743 }
744
745 static int
xchk_agblock_cmp(const void * pa,const void * pb)746 xchk_agblock_cmp(
747 const void *pa,
748 const void *pb)
749 {
750 const xfs_agblock_t *a = pa;
751 const xfs_agblock_t *b = pb;
752
753 return (int)*a - (int)*b;
754 }
755
756 /* Cross-reference with the other btrees. */
757 STATIC void
xchk_agfl_xref(struct xfs_scrub * sc)758 xchk_agfl_xref(
759 struct xfs_scrub *sc)
760 {
761 struct xfs_mount *mp = sc->mp;
762 xfs_agblock_t agbno;
763
764 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
765 return;
766
767 agbno = XFS_AGFL_BLOCK(mp);
768
769 xchk_ag_btcur_init(sc, &sc->sa);
770
771 xchk_xref_is_used_space(sc, agbno, 1);
772 xchk_xref_is_not_inode_chunk(sc, agbno, 1);
773 xchk_xref_is_only_owned_by(sc, agbno, 1, &XFS_RMAP_OINFO_FS);
774 xchk_xref_is_not_shared(sc, agbno, 1);
775 xchk_xref_is_not_cow_staging(sc, agbno, 1);
776
777 /*
778 * Scrub teardown will take care of sc->sa for us. Leave sc->sa
779 * active so that the agfl block xref can use it too.
780 */
781 }
782
783 /* Scrub the AGFL. */
784 int
xchk_agfl(struct xfs_scrub * sc)785 xchk_agfl(
786 struct xfs_scrub *sc)
787 {
788 struct xchk_agfl_info sai = {
789 .sc = sc,
790 };
791 struct xfs_agf *agf;
792 xfs_agnumber_t agno = sc->sm->sm_agno;
793 unsigned int i;
794 int error;
795
796 /* Lock the AGF and AGI so that nobody can touch this AG. */
797 error = xchk_ag_read_headers(sc, agno, &sc->sa);
798 if (!xchk_process_error(sc, agno, XFS_AGFL_BLOCK(sc->mp), &error))
799 return error;
800 if (!sc->sa.agf_bp)
801 return -EFSCORRUPTED;
802
803 /* Try to read the AGFL, and verify its structure if we get it. */
804 error = xfs_alloc_read_agfl(sc->sa.pag, sc->tp, &sai.agfl_bp);
805 if (!xchk_process_error(sc, agno, XFS_AGFL_BLOCK(sc->mp), &error))
806 return error;
807 xchk_buffer_recheck(sc, sai.agfl_bp);
808
809 xchk_agfl_xref(sc);
810
811 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
812 goto out;
813
814 /* Allocate buffer to ensure uniqueness of AGFL entries. */
815 agf = sc->sa.agf_bp->b_addr;
816 sai.agflcount = be32_to_cpu(agf->agf_flcount);
817 if (sai.agflcount > xfs_agfl_size(sc->mp)) {
818 xchk_block_set_corrupt(sc, sc->sa.agf_bp);
819 goto out;
820 }
821 sai.entries = kvzalloc_objs(xfs_agblock_t, sai.agflcount,
822 XCHK_GFP_FLAGS);
823 if (!sai.entries) {
824 error = -ENOMEM;
825 goto out;
826 }
827
828 /* Check the blocks in the AGFL. */
829 error = xfs_agfl_walk(sc->mp, sc->sa.agf_bp->b_addr, sai.agfl_bp,
830 xchk_agfl_block, &sai);
831 if (error == -ECANCELED) {
832 error = 0;
833 goto out_free;
834 }
835 if (error)
836 goto out_free;
837
838 if (sai.agflcount != sai.nr_entries) {
839 xchk_block_set_corrupt(sc, sc->sa.agf_bp);
840 goto out_free;
841 }
842
843 /* Sort entries, check for duplicates. */
844 sort(sai.entries, sai.nr_entries, sizeof(sai.entries[0]),
845 xchk_agblock_cmp, NULL);
846 for (i = 1; i < sai.nr_entries; i++) {
847 if (sai.entries[i] == sai.entries[i - 1]) {
848 xchk_block_set_corrupt(sc, sc->sa.agf_bp);
849 break;
850 }
851 }
852
853 out_free:
854 kvfree(sai.entries);
855 out:
856 return error;
857 }
858
859 /* AGI */
860
861 /* Check agi_count/agi_freecount */
862 static inline void
xchk_agi_xref_icounts(struct xfs_scrub * sc)863 xchk_agi_xref_icounts(
864 struct xfs_scrub *sc)
865 {
866 struct xfs_agi *agi = sc->sa.agi_bp->b_addr;
867 xfs_agino_t icount;
868 xfs_agino_t freecount;
869 int error;
870
871 if (!sc->sa.ino_cur)
872 return;
873
874 error = xfs_ialloc_count_inodes(sc->sa.ino_cur, &icount, &freecount);
875 if (!xchk_should_check_xref(sc, &error, &sc->sa.ino_cur))
876 return;
877 if (be32_to_cpu(agi->agi_count) != icount ||
878 be32_to_cpu(agi->agi_freecount) != freecount)
879 xchk_block_xref_set_corrupt(sc, sc->sa.agi_bp);
880 }
881
882 /* Check agi_[fi]blocks against tree size */
883 static inline void
xchk_agi_xref_fiblocks(struct xfs_scrub * sc)884 xchk_agi_xref_fiblocks(
885 struct xfs_scrub *sc)
886 {
887 struct xfs_agi *agi = sc->sa.agi_bp->b_addr;
888 xfs_filblks_t blocks;
889 int error = 0;
890
891 if (!xfs_has_inobtcounts(sc->mp))
892 return;
893
894 if (sc->sa.ino_cur) {
895 error = xfs_btree_count_blocks(sc->sa.ino_cur, &blocks);
896 if (!xchk_should_check_xref(sc, &error, &sc->sa.ino_cur))
897 return;
898 if (blocks != be32_to_cpu(agi->agi_iblocks))
899 xchk_block_xref_set_corrupt(sc, sc->sa.agi_bp);
900 }
901
902 if (sc->sa.fino_cur) {
903 error = xfs_btree_count_blocks(sc->sa.fino_cur, &blocks);
904 if (!xchk_should_check_xref(sc, &error, &sc->sa.fino_cur))
905 return;
906 if (blocks != be32_to_cpu(agi->agi_fblocks))
907 xchk_block_xref_set_corrupt(sc, sc->sa.agi_bp);
908 }
909 }
910
911 /* Cross-reference with the other btrees. */
912 STATIC void
xchk_agi_xref(struct xfs_scrub * sc)913 xchk_agi_xref(
914 struct xfs_scrub *sc)
915 {
916 struct xfs_mount *mp = sc->mp;
917 xfs_agblock_t agbno;
918
919 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
920 return;
921
922 agbno = XFS_AGI_BLOCK(mp);
923
924 xchk_ag_btcur_init(sc, &sc->sa);
925
926 xchk_xref_is_used_space(sc, agbno, 1);
927 xchk_xref_is_not_inode_chunk(sc, agbno, 1);
928 xchk_agi_xref_icounts(sc);
929 xchk_xref_is_only_owned_by(sc, agbno, 1, &XFS_RMAP_OINFO_FS);
930 xchk_xref_is_not_shared(sc, agbno, 1);
931 xchk_xref_is_not_cow_staging(sc, agbno, 1);
932 xchk_agi_xref_fiblocks(sc);
933
934 /* scrub teardown will take care of sc->sa for us */
935 }
936
937 /*
938 * Walk the incore unlinked list for a particular AGI bucket to construct
939 * the unlinked inode bitmap for later reconstruction of the unlinked list.
940 * Returns 1 if we should keep checking, 0 to stop checking, or a negative
941 * errno.
942 */
943 static int
xchk_iunlink_bucket(struct xfs_scrub * sc,unsigned int bucket,xfs_agino_t agino)944 xchk_iunlink_bucket(
945 struct xfs_scrub *sc,
946 unsigned int bucket,
947 xfs_agino_t agino)
948 {
949 struct xagino_bitmap seen;
950 int ret;
951
952 xagino_bitmap_init(&seen);
953
954 while (agino != NULLAGINO) {
955 struct xfs_inode *ip;
956 unsigned int len = 1;
957
958 if (agino % XFS_AGI_UNLINKED_BUCKETS != bucket) {
959 xchk_block_set_corrupt(sc, sc->sa.agi_bp);
960 goto bad;
961 }
962
963 if (xagino_bitmap_test(&seen, agino, &len)) {
964 xchk_block_set_corrupt(sc, sc->sa.agi_bp);
965 goto bad;
966 }
967
968 ip = xfs_iunlink_lookup(sc->sa.pag, agino);
969 if (!ip) {
970 xchk_block_set_corrupt(sc, sc->sa.agi_bp);
971 goto bad;
972 }
973
974 if (!xfs_inode_on_unlinked_list(ip)) {
975 xchk_block_set_corrupt(sc, sc->sa.agi_bp);
976 goto bad;
977 }
978
979 ret = xagino_bitmap_set(&seen, agino, 1);
980 if (ret)
981 goto out_bitmap;
982
983 agino = ip->i_next_unlinked;
984 }
985 ret = 1;
986
987 out_bitmap:
988 xagino_bitmap_destroy(&seen);
989 return ret;
990 bad:
991 ret = 0;
992 goto out_bitmap;
993 }
994
995 /*
996 * Check the unlinked buckets for links to bad inodes. We hold the AGI, so
997 * there cannot be any threads updating unlinked list pointers in this AG.
998 */
999 STATIC int
xchk_iunlink(struct xfs_scrub * sc,struct xfs_agi * agi)1000 xchk_iunlink(
1001 struct xfs_scrub *sc,
1002 struct xfs_agi *agi)
1003 {
1004 unsigned int i;
1005
1006 for (i = 0; i < XFS_AGI_UNLINKED_BUCKETS; i++) {
1007 int ret;
1008
1009 ret = xchk_iunlink_bucket(sc, i,
1010 be32_to_cpu(agi->agi_unlinked[i]));
1011 if (ret < 1)
1012 return ret;
1013 }
1014
1015 return 0;
1016 }
1017
1018 /* Scrub the AGI. */
1019 int
xchk_agi(struct xfs_scrub * sc)1020 xchk_agi(
1021 struct xfs_scrub *sc)
1022 {
1023 struct xfs_mount *mp = sc->mp;
1024 struct xfs_agi *agi;
1025 struct xfs_perag *pag;
1026 struct xfs_ino_geometry *igeo = M_IGEO(sc->mp);
1027 xfs_agnumber_t agno = sc->sm->sm_agno;
1028 xfs_agblock_t agbno;
1029 xfs_agblock_t eoag;
1030 xfs_agino_t agino;
1031 xfs_agino_t first_agino;
1032 xfs_agino_t last_agino;
1033 xfs_agino_t icount;
1034 int i;
1035 int level;
1036 int error = 0;
1037
1038 error = xchk_ag_read_headers(sc, agno, &sc->sa);
1039 if (!xchk_process_error(sc, agno, XFS_AGI_BLOCK(sc->mp), &error))
1040 goto out;
1041 xchk_buffer_recheck(sc, sc->sa.agi_bp);
1042
1043 agi = sc->sa.agi_bp->b_addr;
1044 pag = sc->sa.pag;
1045
1046 /* Check the AG length */
1047 eoag = be32_to_cpu(agi->agi_length);
1048 if (eoag != pag_group(pag)->xg_block_count)
1049 xchk_block_set_corrupt(sc, sc->sa.agi_bp);
1050
1051 /* Check btree roots and levels */
1052 agbno = be32_to_cpu(agi->agi_root);
1053 if (!xfs_verify_agbno(pag, agbno))
1054 xchk_block_set_corrupt(sc, sc->sa.agi_bp);
1055
1056 level = be32_to_cpu(agi->agi_level);
1057 if (level <= 0 || level > igeo->inobt_maxlevels)
1058 xchk_block_set_corrupt(sc, sc->sa.agi_bp);
1059
1060 if (xfs_has_finobt(mp)) {
1061 agbno = be32_to_cpu(agi->agi_free_root);
1062 if (!xfs_verify_agbno(pag, agbno))
1063 xchk_block_set_corrupt(sc, sc->sa.agi_bp);
1064
1065 level = be32_to_cpu(agi->agi_free_level);
1066 if (level <= 0 || level > igeo->inobt_maxlevels)
1067 xchk_block_set_corrupt(sc, sc->sa.agi_bp);
1068 }
1069
1070 /* Check inode counters */
1071 xfs_agino_range(mp, agno, &first_agino, &last_agino);
1072 icount = be32_to_cpu(agi->agi_count);
1073 if (icount > last_agino - first_agino + 1 ||
1074 icount < be32_to_cpu(agi->agi_freecount))
1075 xchk_block_set_corrupt(sc, sc->sa.agi_bp);
1076
1077 /* Check inode pointers */
1078 agino = be32_to_cpu(agi->agi_newino);
1079 if (!xfs_verify_agino_or_null(pag, agino))
1080 xchk_block_set_corrupt(sc, sc->sa.agi_bp);
1081
1082 agino = be32_to_cpu(agi->agi_dirino);
1083 if (!xfs_verify_agino_or_null(pag, agino))
1084 xchk_block_set_corrupt(sc, sc->sa.agi_bp);
1085
1086 /* Check unlinked inode buckets */
1087 for (i = 0; i < XFS_AGI_UNLINKED_BUCKETS; i++) {
1088 agino = be32_to_cpu(agi->agi_unlinked[i]);
1089 if (!xfs_verify_agino_or_null(pag, agino))
1090 xchk_block_set_corrupt(sc, sc->sa.agi_bp);
1091 }
1092
1093 if (agi->agi_pad32 != cpu_to_be32(0))
1094 xchk_block_set_corrupt(sc, sc->sa.agi_bp);
1095
1096 /* Do the incore counters match? */
1097 if (pag->pagi_count != be32_to_cpu(agi->agi_count))
1098 xchk_block_set_corrupt(sc, sc->sa.agi_bp);
1099 if (pag->pagi_freecount != be32_to_cpu(agi->agi_freecount))
1100 xchk_block_set_corrupt(sc, sc->sa.agi_bp);
1101
1102 error = xchk_iunlink(sc, agi);
1103 if (error)
1104 goto out;
1105
1106 xchk_agi_xref(sc);
1107 out:
1108 return error;
1109 }
1110