1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Copyright (C) 2017-2023 Oracle. All Rights Reserved. 4 * Author: Darrick J. Wong <djwong@kernel.org> 5 */ 6 #include "xfs_platform.h" 7 #include "xfs_fs.h" 8 #include "xfs_shared.h" 9 #include "xfs_format.h" 10 #include "xfs_trans_resv.h" 11 #include "xfs_mount.h" 12 #include "xfs_btree.h" 13 #include "xfs_sb.h" 14 #include "xfs_alloc.h" 15 #include "xfs_ialloc.h" 16 #include "xfs_rmap.h" 17 #include "xfs_ag.h" 18 #include "xfs_inode.h" 19 #include "scrub/scrub.h" 20 #include "scrub/common.h" 21 #include "scrub/bitmap.h" 22 #include "scrub/agino_bitmap.h" 23 24 int 25 xchk_setup_agheader( 26 struct xfs_scrub *sc) 27 { 28 if (xchk_need_intent_drain(sc)) 29 xchk_fsgates_enable(sc, XCHK_FSGATES_DRAIN); 30 return xchk_setup_fs(sc); 31 } 32 33 /* Superblock */ 34 35 /* Cross-reference with the other btrees. */ 36 STATIC void 37 xchk_superblock_xref( 38 struct xfs_scrub *sc, 39 struct xfs_buf *bp) 40 { 41 struct xfs_mount *mp = sc->mp; 42 xfs_agnumber_t agno = sc->sm->sm_agno; 43 xfs_agblock_t agbno; 44 int error; 45 46 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT) 47 return; 48 49 agbno = XFS_SB_BLOCK(mp); 50 51 error = xchk_ag_init_existing(sc, agno, &sc->sa); 52 if (!xchk_xref_process_error(sc, agno, agbno, &error)) 53 return; 54 55 xchk_xref_is_used_space(sc, agbno, 1); 56 xchk_xref_is_not_inode_chunk(sc, agbno, 1); 57 xchk_xref_is_only_owned_by(sc, agbno, 1, &XFS_RMAP_OINFO_FS); 58 xchk_xref_is_not_shared(sc, agbno, 1); 59 xchk_xref_is_not_cow_staging(sc, agbno, 1); 60 61 /* scrub teardown will take care of sc->sa for us */ 62 } 63 64 /* 65 * Calculate the ondisk superblock size in bytes given the feature set of the 66 * mounted filesystem (aka the primary sb). This is subtlely different from 67 * the logic in xfs_repair, which computes the size of a secondary sb given the 68 * featureset listed in the secondary sb. 69 */ 70 STATIC size_t 71 xchk_superblock_ondisk_size( 72 struct xfs_mount *mp) 73 { 74 if (xfs_has_zoned(mp)) 75 return offsetofend(struct xfs_dsb, sb_rtreserved); 76 if (xfs_has_metadir(mp)) 77 return offsetofend(struct xfs_dsb, sb_pad); 78 if (xfs_has_metauuid(mp)) 79 return offsetofend(struct xfs_dsb, sb_meta_uuid); 80 if (xfs_has_crc(mp)) 81 return offsetofend(struct xfs_dsb, sb_lsn); 82 if (xfs_sb_version_hasmorebits(&mp->m_sb)) 83 return offsetofend(struct xfs_dsb, sb_bad_features2); 84 if (xfs_has_logv2(mp)) 85 return offsetofend(struct xfs_dsb, sb_logsunit); 86 if (xfs_has_sector(mp)) 87 return offsetofend(struct xfs_dsb, sb_logsectsize); 88 /* only support dirv2 or more recent */ 89 return offsetofend(struct xfs_dsb, sb_dirblklog); 90 } 91 92 /* 93 * Scrub the filesystem superblock. 94 * 95 * Note: We do /not/ attempt to check AG 0's superblock. Mount is 96 * responsible for validating all the geometry information in sb 0, so 97 * if the filesystem is capable of initiating online scrub, then clearly 98 * sb 0 is ok and we can use its information to check everything else. 99 */ 100 int 101 xchk_superblock( 102 struct xfs_scrub *sc) 103 { 104 struct xfs_mount *mp = sc->mp; 105 struct xfs_buf *bp; 106 struct xfs_dsb *sb; 107 struct xfs_perag *pag; 108 size_t sblen; 109 xfs_agnumber_t agno; 110 uint32_t v2_ok; 111 __be32 features_mask; 112 int error; 113 __be16 vernum_mask; 114 115 agno = sc->sm->sm_agno; 116 if (agno == 0) 117 return 0; 118 119 /* 120 * Grab an active reference to the perag structure. If we can't get 121 * it, we're racing with something that's tearing down the AG, so 122 * signal that the AG no longer exists. 123 */ 124 pag = xfs_perag_get(mp, agno); 125 if (!pag) 126 return -ENOENT; 127 128 error = xfs_sb_read_secondary(mp, sc->tp, agno, &bp); 129 /* 130 * The superblock verifier can return several different error codes 131 * if it thinks the superblock doesn't look right. For a mount these 132 * would all get bounced back to userspace, but if we're here then the 133 * fs mounted successfully, which means that this secondary superblock 134 * is simply incorrect. Treat all these codes the same way we treat 135 * any corruption. 136 */ 137 switch (error) { 138 case -EINVAL: /* also -EWRONGFS */ 139 case -ENOSYS: 140 case -EFBIG: 141 error = -EFSCORRUPTED; 142 fallthrough; 143 default: 144 break; 145 } 146 if (!xchk_process_error(sc, agno, XFS_SB_BLOCK(mp), &error)) 147 goto out_pag; 148 149 sb = bp->b_addr; 150 151 /* 152 * Verify the geometries match. Fields that are permanently 153 * set by mkfs are checked; fields that can be updated later 154 * (and are not propagated to backup superblocks) are preen 155 * checked. 156 */ 157 if (sb->sb_blocksize != cpu_to_be32(mp->m_sb.sb_blocksize)) 158 xchk_block_set_corrupt(sc, bp); 159 160 if (sb->sb_dblocks != cpu_to_be64(mp->m_sb.sb_dblocks)) 161 xchk_block_set_corrupt(sc, bp); 162 163 if (sb->sb_rblocks != cpu_to_be64(mp->m_sb.sb_rblocks)) 164 xchk_block_set_corrupt(sc, bp); 165 166 if (sb->sb_rextents != cpu_to_be64(mp->m_sb.sb_rextents)) 167 xchk_block_set_corrupt(sc, bp); 168 169 if (!uuid_equal(&sb->sb_uuid, &mp->m_sb.sb_uuid)) 170 xchk_block_set_preen(sc, bp); 171 172 if (sb->sb_logstart != cpu_to_be64(mp->m_sb.sb_logstart)) 173 xchk_block_set_corrupt(sc, bp); 174 175 if (sb->sb_rootino != cpu_to_be64(mp->m_sb.sb_rootino)) 176 xchk_block_set_preen(sc, bp); 177 178 if (xfs_has_metadir(sc->mp)) { 179 if (sb->sb_rbmino != cpu_to_be64(0)) 180 xchk_block_set_corrupt(sc, bp); 181 182 if (sb->sb_rsumino != cpu_to_be64(0)) 183 xchk_block_set_corrupt(sc, bp); 184 } else { 185 if (sb->sb_rbmino != cpu_to_be64(mp->m_sb.sb_rbmino)) 186 xchk_block_set_preen(sc, bp); 187 188 if (sb->sb_rsumino != cpu_to_be64(mp->m_sb.sb_rsumino)) 189 xchk_block_set_preen(sc, bp); 190 } 191 192 if (sb->sb_rextsize != cpu_to_be32(mp->m_sb.sb_rextsize)) 193 xchk_block_set_corrupt(sc, bp); 194 195 if (sb->sb_agblocks != cpu_to_be32(mp->m_sb.sb_agblocks)) 196 xchk_block_set_corrupt(sc, bp); 197 198 if (sb->sb_agcount != cpu_to_be32(mp->m_sb.sb_agcount)) 199 xchk_block_set_corrupt(sc, bp); 200 201 if (sb->sb_rbmblocks != cpu_to_be32(mp->m_sb.sb_rbmblocks)) 202 xchk_block_set_corrupt(sc, bp); 203 204 if (sb->sb_logblocks != cpu_to_be32(mp->m_sb.sb_logblocks)) 205 xchk_block_set_corrupt(sc, bp); 206 207 /* Check sb_versionnum bits that are set at mkfs time. */ 208 vernum_mask = cpu_to_be16(XFS_SB_VERSION_NUMBITS | 209 XFS_SB_VERSION_ALIGNBIT | 210 XFS_SB_VERSION_DALIGNBIT | 211 XFS_SB_VERSION_SHAREDBIT | 212 XFS_SB_VERSION_LOGV2BIT | 213 XFS_SB_VERSION_SECTORBIT | 214 XFS_SB_VERSION_EXTFLGBIT | 215 XFS_SB_VERSION_DIRV2BIT); 216 if ((sb->sb_versionnum & vernum_mask) != 217 (cpu_to_be16(mp->m_sb.sb_versionnum) & vernum_mask)) 218 xchk_block_set_corrupt(sc, bp); 219 220 /* Check sb_versionnum bits that can be set after mkfs time. */ 221 vernum_mask = cpu_to_be16(XFS_SB_VERSION_ATTRBIT | 222 XFS_SB_VERSION_NLINKBIT | 223 XFS_SB_VERSION_QUOTABIT); 224 if ((sb->sb_versionnum & vernum_mask) != 225 (cpu_to_be16(mp->m_sb.sb_versionnum) & vernum_mask)) 226 xchk_block_set_preen(sc, bp); 227 228 if (sb->sb_sectsize != cpu_to_be16(mp->m_sb.sb_sectsize)) 229 xchk_block_set_corrupt(sc, bp); 230 231 if (sb->sb_inodesize != cpu_to_be16(mp->m_sb.sb_inodesize)) 232 xchk_block_set_corrupt(sc, bp); 233 234 if (sb->sb_inopblock != cpu_to_be16(mp->m_sb.sb_inopblock)) 235 xchk_block_set_corrupt(sc, bp); 236 237 if (memcmp(sb->sb_fname, mp->m_sb.sb_fname, sizeof(sb->sb_fname))) 238 xchk_block_set_preen(sc, bp); 239 240 if (sb->sb_blocklog != mp->m_sb.sb_blocklog) 241 xchk_block_set_corrupt(sc, bp); 242 243 if (sb->sb_sectlog != mp->m_sb.sb_sectlog) 244 xchk_block_set_corrupt(sc, bp); 245 246 if (sb->sb_inodelog != mp->m_sb.sb_inodelog) 247 xchk_block_set_corrupt(sc, bp); 248 249 if (sb->sb_inopblog != mp->m_sb.sb_inopblog) 250 xchk_block_set_corrupt(sc, bp); 251 252 if (sb->sb_agblklog != mp->m_sb.sb_agblklog) 253 xchk_block_set_corrupt(sc, bp); 254 255 if (sb->sb_rextslog != mp->m_sb.sb_rextslog) 256 xchk_block_set_corrupt(sc, bp); 257 258 if (sb->sb_imax_pct != mp->m_sb.sb_imax_pct) 259 xchk_block_set_preen(sc, bp); 260 261 /* 262 * Skip the summary counters since we track them in memory anyway. 263 * sb_icount, sb_ifree, sb_fdblocks, sb_frexents 264 */ 265 266 if (xfs_has_metadir(mp)) { 267 if (sb->sb_uquotino != cpu_to_be64(0)) 268 xchk_block_set_corrupt(sc, bp); 269 270 if (sb->sb_gquotino != cpu_to_be64(0)) 271 xchk_block_set_corrupt(sc, bp); 272 } else { 273 if (sb->sb_uquotino != cpu_to_be64(mp->m_sb.sb_uquotino)) 274 xchk_block_set_preen(sc, bp); 275 276 if (sb->sb_gquotino != cpu_to_be64(mp->m_sb.sb_gquotino)) 277 xchk_block_set_preen(sc, bp); 278 } 279 280 /* 281 * Skip the quota flags since repair will force quotacheck. 282 * sb_qflags 283 */ 284 285 if (sb->sb_flags != mp->m_sb.sb_flags) 286 xchk_block_set_corrupt(sc, bp); 287 288 if (sb->sb_shared_vn != mp->m_sb.sb_shared_vn) 289 xchk_block_set_corrupt(sc, bp); 290 291 if (sb->sb_inoalignmt != cpu_to_be32(mp->m_sb.sb_inoalignmt)) 292 xchk_block_set_corrupt(sc, bp); 293 294 if (sb->sb_unit != cpu_to_be32(mp->m_sb.sb_unit)) 295 xchk_block_set_preen(sc, bp); 296 297 if (sb->sb_width != cpu_to_be32(mp->m_sb.sb_width)) 298 xchk_block_set_preen(sc, bp); 299 300 if (sb->sb_dirblklog != mp->m_sb.sb_dirblklog) 301 xchk_block_set_corrupt(sc, bp); 302 303 if (sb->sb_logsectlog != mp->m_sb.sb_logsectlog) 304 xchk_block_set_corrupt(sc, bp); 305 306 if (sb->sb_logsectsize != cpu_to_be16(mp->m_sb.sb_logsectsize)) 307 xchk_block_set_corrupt(sc, bp); 308 309 if (sb->sb_logsunit != cpu_to_be32(mp->m_sb.sb_logsunit)) 310 xchk_block_set_corrupt(sc, bp); 311 312 /* Do we see any invalid bits in sb_features2? */ 313 if (!xfs_sb_version_hasmorebits(&mp->m_sb)) { 314 if (sb->sb_features2 != 0) 315 xchk_block_set_corrupt(sc, bp); 316 } else { 317 v2_ok = XFS_SB_VERSION2_OKBITS; 318 if (xfs_sb_is_v5(&mp->m_sb)) 319 v2_ok |= XFS_SB_VERSION2_CRCBIT; 320 321 if (!!(sb->sb_features2 & cpu_to_be32(~v2_ok))) 322 xchk_block_set_corrupt(sc, bp); 323 324 if (sb->sb_features2 != sb->sb_bad_features2) 325 xchk_block_set_preen(sc, bp); 326 } 327 328 /* Check sb_features2 flags that are set at mkfs time. */ 329 features_mask = cpu_to_be32(XFS_SB_VERSION2_LAZYSBCOUNTBIT | 330 XFS_SB_VERSION2_PROJID32BIT | 331 XFS_SB_VERSION2_CRCBIT | 332 XFS_SB_VERSION2_FTYPE); 333 if ((sb->sb_features2 & features_mask) != 334 (cpu_to_be32(mp->m_sb.sb_features2) & features_mask)) 335 xchk_block_set_corrupt(sc, bp); 336 337 /* Check sb_features2 flags that can be set after mkfs time. */ 338 features_mask = cpu_to_be32(XFS_SB_VERSION2_ATTR2BIT); 339 if ((sb->sb_features2 & features_mask) != 340 (cpu_to_be32(mp->m_sb.sb_features2) & features_mask)) 341 xchk_block_set_preen(sc, bp); 342 343 if (!xfs_has_crc(mp)) { 344 /* all v5 fields must be zero */ 345 if (memchr_inv(&sb->sb_features_compat, 0, 346 sizeof(struct xfs_dsb) - 347 offsetof(struct xfs_dsb, sb_features_compat))) 348 xchk_block_set_corrupt(sc, bp); 349 } else { 350 /* compat features must match */ 351 if (sb->sb_features_compat != 352 cpu_to_be32(mp->m_sb.sb_features_compat)) 353 xchk_block_set_corrupt(sc, bp); 354 355 /* ro compat features must match */ 356 if (sb->sb_features_ro_compat != 357 cpu_to_be32(mp->m_sb.sb_features_ro_compat)) 358 xchk_block_set_corrupt(sc, bp); 359 360 /* 361 * NEEDSREPAIR is ignored on a secondary super, so we should 362 * clear it when we find it, though it's not a corruption. 363 */ 364 features_mask = cpu_to_be32(XFS_SB_FEAT_INCOMPAT_NEEDSREPAIR); 365 if ((cpu_to_be32(mp->m_sb.sb_features_incompat) ^ 366 sb->sb_features_incompat) & features_mask) 367 xchk_block_set_preen(sc, bp); 368 369 /* all other incompat features must match */ 370 if ((cpu_to_be32(mp->m_sb.sb_features_incompat) ^ 371 sb->sb_features_incompat) & ~features_mask) 372 xchk_block_set_corrupt(sc, bp); 373 374 /* 375 * log incompat features protect newer log record types from 376 * older log recovery code. Log recovery doesn't check the 377 * secondary supers, so we can clear these if needed. 378 */ 379 if (sb->sb_features_log_incompat) 380 xchk_block_set_preen(sc, bp); 381 382 /* Don't care about sb_crc */ 383 384 if (sb->sb_spino_align != cpu_to_be32(mp->m_sb.sb_spino_align)) 385 xchk_block_set_corrupt(sc, bp); 386 387 if (xfs_has_metadir(mp)) { 388 if (sb->sb_pquotino != cpu_to_be64(0)) 389 xchk_block_set_corrupt(sc, bp); 390 } else { 391 if (sb->sb_pquotino != cpu_to_be64(mp->m_sb.sb_pquotino)) 392 xchk_block_set_preen(sc, bp); 393 } 394 395 /* Don't care about sb_lsn */ 396 } 397 398 if (xfs_has_metauuid(mp)) { 399 /* The metadata UUID must be the same for all supers */ 400 if (!uuid_equal(&sb->sb_meta_uuid, &mp->m_sb.sb_meta_uuid)) 401 xchk_block_set_corrupt(sc, bp); 402 } 403 404 if (xfs_has_metadir(mp)) { 405 if (sb->sb_metadirino != cpu_to_be64(mp->m_sb.sb_metadirino)) 406 xchk_block_set_preen(sc, bp); 407 408 if (sb->sb_rgcount != cpu_to_be32(mp->m_sb.sb_rgcount)) 409 xchk_block_set_corrupt(sc, bp); 410 411 if (sb->sb_rgextents != cpu_to_be32(mp->m_sb.sb_rgextents)) 412 xchk_block_set_corrupt(sc, bp); 413 414 if (sb->sb_rgblklog != mp->m_sb.sb_rgblklog) 415 xchk_block_set_corrupt(sc, bp); 416 417 if (memchr_inv(sb->sb_pad, 0, sizeof(sb->sb_pad))) 418 xchk_block_set_corrupt(sc, bp); 419 } 420 421 if (xfs_has_zoned(mp)) { 422 if (sb->sb_rtstart != cpu_to_be64(mp->m_sb.sb_rtstart)) 423 xchk_block_set_corrupt(sc, bp); 424 if (sb->sb_rtreserved != cpu_to_be64(mp->m_sb.sb_rtreserved)) 425 xchk_block_set_corrupt(sc, bp); 426 } 427 428 /* Everything else must be zero. */ 429 sblen = xchk_superblock_ondisk_size(mp); 430 if (memchr_inv((char *)sb + sblen, 0, BBTOB(bp->b_length) - sblen)) 431 xchk_block_set_corrupt(sc, bp); 432 433 xchk_superblock_xref(sc, bp); 434 out_pag: 435 xfs_perag_put(pag); 436 return error; 437 } 438 439 /* AGF */ 440 441 /* Tally freespace record lengths. */ 442 STATIC int 443 xchk_agf_record_bno_lengths( 444 struct xfs_btree_cur *cur, 445 const struct xfs_alloc_rec_incore *rec, 446 void *priv) 447 { 448 xfs_extlen_t *blocks = priv; 449 450 (*blocks) += rec->ar_blockcount; 451 return 0; 452 } 453 454 /* Check agf_freeblks */ 455 static inline void 456 xchk_agf_xref_freeblks( 457 struct xfs_scrub *sc) 458 { 459 struct xfs_agf *agf = sc->sa.agf_bp->b_addr; 460 xfs_extlen_t blocks = 0; 461 int error; 462 463 if (!sc->sa.bno_cur) 464 return; 465 466 error = xfs_alloc_query_all(sc->sa.bno_cur, 467 xchk_agf_record_bno_lengths, &blocks); 468 if (!xchk_should_check_xref(sc, &error, &sc->sa.bno_cur)) 469 return; 470 if (blocks != be32_to_cpu(agf->agf_freeblks)) 471 xchk_block_xref_set_corrupt(sc, sc->sa.agf_bp); 472 } 473 474 /* Cross reference the AGF with the cntbt (freespace by length btree) */ 475 static inline void 476 xchk_agf_xref_cntbt( 477 struct xfs_scrub *sc) 478 { 479 struct xfs_agf *agf = sc->sa.agf_bp->b_addr; 480 xfs_agblock_t agbno; 481 xfs_extlen_t blocks; 482 int have; 483 int error; 484 485 if (!sc->sa.cnt_cur) 486 return; 487 488 /* Any freespace at all? */ 489 error = xfs_alloc_lookup_le(sc->sa.cnt_cur, 0, -1U, &have); 490 if (!xchk_should_check_xref(sc, &error, &sc->sa.cnt_cur)) 491 return; 492 if (!have) { 493 if (agf->agf_freeblks != cpu_to_be32(0)) 494 xchk_block_xref_set_corrupt(sc, sc->sa.agf_bp); 495 return; 496 } 497 498 /* Check agf_longest */ 499 error = xfs_alloc_get_rec(sc->sa.cnt_cur, &agbno, &blocks, &have); 500 if (!xchk_should_check_xref(sc, &error, &sc->sa.cnt_cur)) 501 return; 502 if (!have || blocks != be32_to_cpu(agf->agf_longest)) 503 xchk_block_xref_set_corrupt(sc, sc->sa.agf_bp); 504 } 505 506 /* Check the btree block counts in the AGF against the btrees. */ 507 STATIC void 508 xchk_agf_xref_btreeblks( 509 struct xfs_scrub *sc) 510 { 511 struct xfs_agf *agf = sc->sa.agf_bp->b_addr; 512 struct xfs_mount *mp = sc->mp; 513 xfs_filblks_t blocks; 514 xfs_agblock_t btreeblks; 515 int error; 516 517 /* agf_btreeblks didn't exist before lazysbcount */ 518 if (!xfs_has_lazysbcount(sc->mp)) 519 return; 520 521 /* Check agf_rmap_blocks; set up for agf_btreeblks check */ 522 if (sc->sa.rmap_cur) { 523 error = xfs_btree_count_blocks(sc->sa.rmap_cur, &blocks); 524 if (!xchk_should_check_xref(sc, &error, &sc->sa.rmap_cur)) 525 return; 526 btreeblks = blocks - 1; 527 if (blocks != be32_to_cpu(agf->agf_rmap_blocks)) 528 xchk_block_xref_set_corrupt(sc, sc->sa.agf_bp); 529 } else { 530 btreeblks = 0; 531 } 532 533 /* 534 * No rmap cursor; we can't xref if we have the rmapbt feature. 535 * We also can't do it if we're missing the free space btree cursors. 536 */ 537 if ((xfs_has_rmapbt(mp) && !sc->sa.rmap_cur) || 538 !sc->sa.bno_cur || !sc->sa.cnt_cur) 539 return; 540 541 /* Check agf_btreeblks */ 542 error = xfs_btree_count_blocks(sc->sa.bno_cur, &blocks); 543 if (!xchk_should_check_xref(sc, &error, &sc->sa.bno_cur)) 544 return; 545 btreeblks += blocks - 1; 546 547 error = xfs_btree_count_blocks(sc->sa.cnt_cur, &blocks); 548 if (!xchk_should_check_xref(sc, &error, &sc->sa.cnt_cur)) 549 return; 550 btreeblks += blocks - 1; 551 552 if (btreeblks != be32_to_cpu(agf->agf_btreeblks)) 553 xchk_block_xref_set_corrupt(sc, sc->sa.agf_bp); 554 } 555 556 /* Check agf_refcount_blocks against tree size */ 557 static inline void 558 xchk_agf_xref_refcblks( 559 struct xfs_scrub *sc) 560 { 561 struct xfs_agf *agf = sc->sa.agf_bp->b_addr; 562 xfs_filblks_t blocks; 563 int error; 564 565 if (!sc->sa.refc_cur) 566 return; 567 568 error = xfs_btree_count_blocks(sc->sa.refc_cur, &blocks); 569 if (!xchk_should_check_xref(sc, &error, &sc->sa.refc_cur)) 570 return; 571 if (blocks != be32_to_cpu(agf->agf_refcount_blocks)) 572 xchk_block_xref_set_corrupt(sc, sc->sa.agf_bp); 573 } 574 575 /* Cross-reference with the other btrees. */ 576 STATIC void 577 xchk_agf_xref( 578 struct xfs_scrub *sc) 579 { 580 struct xfs_mount *mp = sc->mp; 581 xfs_agblock_t agbno; 582 583 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT) 584 return; 585 586 agbno = XFS_AGF_BLOCK(mp); 587 588 xchk_ag_btcur_init(sc, &sc->sa); 589 590 xchk_xref_is_used_space(sc, agbno, 1); 591 xchk_agf_xref_freeblks(sc); 592 xchk_agf_xref_cntbt(sc); 593 xchk_xref_is_not_inode_chunk(sc, agbno, 1); 594 xchk_xref_is_only_owned_by(sc, agbno, 1, &XFS_RMAP_OINFO_FS); 595 xchk_agf_xref_btreeblks(sc); 596 xchk_xref_is_not_shared(sc, agbno, 1); 597 xchk_xref_is_not_cow_staging(sc, agbno, 1); 598 xchk_agf_xref_refcblks(sc); 599 600 /* scrub teardown will take care of sc->sa for us */ 601 } 602 603 /* Scrub the AGF. */ 604 int 605 xchk_agf( 606 struct xfs_scrub *sc) 607 { 608 struct xfs_mount *mp = sc->mp; 609 struct xfs_agf *agf; 610 struct xfs_perag *pag; 611 xfs_agnumber_t agno = sc->sm->sm_agno; 612 xfs_agblock_t agbno; 613 xfs_agblock_t eoag; 614 xfs_agblock_t agfl_first; 615 xfs_agblock_t agfl_last; 616 xfs_agblock_t agfl_count; 617 xfs_agblock_t fl_count; 618 int level; 619 int error = 0; 620 621 error = xchk_ag_read_headers(sc, agno, &sc->sa); 622 if (!xchk_process_error(sc, agno, XFS_AGF_BLOCK(sc->mp), &error)) 623 goto out; 624 xchk_buffer_recheck(sc, sc->sa.agf_bp); 625 626 agf = sc->sa.agf_bp->b_addr; 627 pag = sc->sa.pag; 628 629 /* Check the AG length */ 630 eoag = be32_to_cpu(agf->agf_length); 631 if (eoag != pag_group(pag)->xg_block_count) 632 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 633 634 /* Check the AGF btree roots and levels */ 635 agbno = be32_to_cpu(agf->agf_bno_root); 636 if (!xfs_verify_agbno(pag, agbno)) 637 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 638 639 agbno = be32_to_cpu(agf->agf_cnt_root); 640 if (!xfs_verify_agbno(pag, agbno)) 641 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 642 643 level = be32_to_cpu(agf->agf_bno_level); 644 if (level <= 0 || level > mp->m_alloc_maxlevels) 645 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 646 647 level = be32_to_cpu(agf->agf_cnt_level); 648 if (level <= 0 || level > mp->m_alloc_maxlevels) 649 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 650 651 if (xfs_has_rmapbt(mp)) { 652 agbno = be32_to_cpu(agf->agf_rmap_root); 653 if (!xfs_verify_agbno(pag, agbno)) 654 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 655 656 level = be32_to_cpu(agf->agf_rmap_level); 657 if (level <= 0 || level > mp->m_rmap_maxlevels) 658 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 659 } 660 661 if (xfs_has_reflink(mp)) { 662 agbno = be32_to_cpu(agf->agf_refcount_root); 663 if (!xfs_verify_agbno(pag, agbno)) 664 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 665 666 level = be32_to_cpu(agf->agf_refcount_level); 667 if (level <= 0 || level > mp->m_refc_maxlevels) 668 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 669 } 670 671 /* Check the AGFL counters */ 672 agfl_first = be32_to_cpu(agf->agf_flfirst); 673 agfl_last = be32_to_cpu(agf->agf_fllast); 674 agfl_count = be32_to_cpu(agf->agf_flcount); 675 if (agfl_last > agfl_first) 676 fl_count = agfl_last - agfl_first + 1; 677 else 678 fl_count = xfs_agfl_size(mp) - agfl_first + agfl_last + 1; 679 if (agfl_count != 0 && fl_count != agfl_count) 680 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 681 682 /* Do the incore counters match? */ 683 if (pag->pagf_freeblks != be32_to_cpu(agf->agf_freeblks)) 684 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 685 if (pag->pagf_flcount != be32_to_cpu(agf->agf_flcount)) 686 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 687 if (xfs_has_lazysbcount(sc->mp) && 688 pag->pagf_btreeblks != be32_to_cpu(agf->agf_btreeblks)) 689 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 690 691 xchk_agf_xref(sc); 692 out: 693 return error; 694 } 695 696 /* AGFL */ 697 698 struct xchk_agfl_info { 699 /* Number of AGFL entries that the AGF claims are in use. */ 700 unsigned int agflcount; 701 702 /* Number of AGFL entries that we found. */ 703 unsigned int nr_entries; 704 705 /* Buffer to hold AGFL entries for extent checking. */ 706 xfs_agblock_t *entries; 707 708 struct xfs_buf *agfl_bp; 709 struct xfs_scrub *sc; 710 }; 711 712 /* Cross-reference with the other btrees. */ 713 STATIC void 714 xchk_agfl_block_xref( 715 struct xfs_scrub *sc, 716 xfs_agblock_t agbno) 717 { 718 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT) 719 return; 720 721 xchk_xref_is_used_space(sc, agbno, 1); 722 xchk_xref_is_not_inode_chunk(sc, agbno, 1); 723 xchk_xref_is_only_owned_by(sc, agbno, 1, &XFS_RMAP_OINFO_AG); 724 xchk_xref_is_not_shared(sc, agbno, 1); 725 xchk_xref_is_not_cow_staging(sc, agbno, 1); 726 } 727 728 /* Scrub an AGFL block. */ 729 STATIC int 730 xchk_agfl_block( 731 struct xfs_mount *mp, 732 xfs_agblock_t agbno, 733 void *priv) 734 { 735 struct xchk_agfl_info *sai = priv; 736 struct xfs_scrub *sc = sai->sc; 737 738 if (xfs_verify_agbno(sc->sa.pag, agbno) && 739 sai->nr_entries < sai->agflcount) 740 sai->entries[sai->nr_entries++] = agbno; 741 else 742 xchk_block_set_corrupt(sc, sai->agfl_bp); 743 744 xchk_agfl_block_xref(sc, agbno); 745 746 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT) 747 return -ECANCELED; 748 749 return 0; 750 } 751 752 static int 753 xchk_agblock_cmp( 754 const void *pa, 755 const void *pb) 756 { 757 const xfs_agblock_t *a = pa; 758 const xfs_agblock_t *b = pb; 759 760 return (int)*a - (int)*b; 761 } 762 763 /* Cross-reference with the other btrees. */ 764 STATIC void 765 xchk_agfl_xref( 766 struct xfs_scrub *sc) 767 { 768 struct xfs_mount *mp = sc->mp; 769 xfs_agblock_t agbno; 770 771 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT) 772 return; 773 774 agbno = XFS_AGFL_BLOCK(mp); 775 776 xchk_ag_btcur_init(sc, &sc->sa); 777 778 xchk_xref_is_used_space(sc, agbno, 1); 779 xchk_xref_is_not_inode_chunk(sc, agbno, 1); 780 xchk_xref_is_only_owned_by(sc, agbno, 1, &XFS_RMAP_OINFO_FS); 781 xchk_xref_is_not_shared(sc, agbno, 1); 782 xchk_xref_is_not_cow_staging(sc, agbno, 1); 783 784 /* 785 * Scrub teardown will take care of sc->sa for us. Leave sc->sa 786 * active so that the agfl block xref can use it too. 787 */ 788 } 789 790 /* Scrub the AGFL. */ 791 int 792 xchk_agfl( 793 struct xfs_scrub *sc) 794 { 795 struct xchk_agfl_info sai = { 796 .sc = sc, 797 }; 798 struct xfs_agf *agf; 799 xfs_agnumber_t agno = sc->sm->sm_agno; 800 unsigned int i; 801 int error; 802 803 /* Lock the AGF and AGI so that nobody can touch this AG. */ 804 error = xchk_ag_read_headers(sc, agno, &sc->sa); 805 if (!xchk_process_error(sc, agno, XFS_AGFL_BLOCK(sc->mp), &error)) 806 return error; 807 if (!sc->sa.agf_bp) 808 return -EFSCORRUPTED; 809 810 /* Try to read the AGFL, and verify its structure if we get it. */ 811 error = xfs_alloc_read_agfl(sc->sa.pag, sc->tp, &sai.agfl_bp); 812 if (!xchk_process_error(sc, agno, XFS_AGFL_BLOCK(sc->mp), &error)) 813 return error; 814 xchk_buffer_recheck(sc, sai.agfl_bp); 815 816 xchk_agfl_xref(sc); 817 818 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT) 819 goto out; 820 821 /* Allocate buffer to ensure uniqueness of AGFL entries. */ 822 agf = sc->sa.agf_bp->b_addr; 823 sai.agflcount = be32_to_cpu(agf->agf_flcount); 824 if (sai.agflcount > xfs_agfl_size(sc->mp)) { 825 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 826 goto out; 827 } 828 sai.entries = kvzalloc_objs(xfs_agblock_t, sai.agflcount, 829 XCHK_GFP_FLAGS); 830 if (!sai.entries) { 831 error = -ENOMEM; 832 goto out; 833 } 834 835 /* Check the blocks in the AGFL. */ 836 error = xfs_agfl_walk(sc->mp, sc->sa.agf_bp->b_addr, sai.agfl_bp, 837 xchk_agfl_block, &sai); 838 if (error == -ECANCELED) { 839 error = 0; 840 goto out_free; 841 } 842 if (error) 843 goto out_free; 844 845 if (sai.agflcount != sai.nr_entries) { 846 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 847 goto out_free; 848 } 849 850 /* Sort entries, check for duplicates. */ 851 sort(sai.entries, sai.nr_entries, sizeof(sai.entries[0]), 852 xchk_agblock_cmp, NULL); 853 for (i = 1; i < sai.nr_entries; i++) { 854 if (sai.entries[i] == sai.entries[i - 1]) { 855 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 856 break; 857 } 858 } 859 860 out_free: 861 kvfree(sai.entries); 862 out: 863 return error; 864 } 865 866 /* AGI */ 867 868 /* Check agi_count/agi_freecount */ 869 static inline void 870 xchk_agi_xref_icounts( 871 struct xfs_scrub *sc) 872 { 873 struct xfs_agi *agi = sc->sa.agi_bp->b_addr; 874 xfs_agino_t icount; 875 xfs_agino_t freecount; 876 int error; 877 878 if (!sc->sa.ino_cur) 879 return; 880 881 error = xfs_ialloc_count_inodes(sc->sa.ino_cur, &icount, &freecount); 882 if (!xchk_should_check_xref(sc, &error, &sc->sa.ino_cur)) 883 return; 884 if (be32_to_cpu(agi->agi_count) != icount || 885 be32_to_cpu(agi->agi_freecount) != freecount) 886 xchk_block_xref_set_corrupt(sc, sc->sa.agi_bp); 887 } 888 889 /* Check agi_[fi]blocks against tree size */ 890 static inline void 891 xchk_agi_xref_fiblocks( 892 struct xfs_scrub *sc) 893 { 894 struct xfs_agi *agi = sc->sa.agi_bp->b_addr; 895 xfs_filblks_t blocks; 896 int error = 0; 897 898 if (!xfs_has_inobtcounts(sc->mp)) 899 return; 900 901 if (sc->sa.ino_cur) { 902 error = xfs_btree_count_blocks(sc->sa.ino_cur, &blocks); 903 if (!xchk_should_check_xref(sc, &error, &sc->sa.ino_cur)) 904 return; 905 if (blocks != be32_to_cpu(agi->agi_iblocks)) 906 xchk_block_xref_set_corrupt(sc, sc->sa.agi_bp); 907 } 908 909 if (sc->sa.fino_cur) { 910 error = xfs_btree_count_blocks(sc->sa.fino_cur, &blocks); 911 if (!xchk_should_check_xref(sc, &error, &sc->sa.fino_cur)) 912 return; 913 if (blocks != be32_to_cpu(agi->agi_fblocks)) 914 xchk_block_xref_set_corrupt(sc, sc->sa.agi_bp); 915 } 916 } 917 918 /* Cross-reference with the other btrees. */ 919 STATIC void 920 xchk_agi_xref( 921 struct xfs_scrub *sc) 922 { 923 struct xfs_mount *mp = sc->mp; 924 xfs_agblock_t agbno; 925 926 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT) 927 return; 928 929 agbno = XFS_AGI_BLOCK(mp); 930 931 xchk_ag_btcur_init(sc, &sc->sa); 932 933 xchk_xref_is_used_space(sc, agbno, 1); 934 xchk_xref_is_not_inode_chunk(sc, agbno, 1); 935 xchk_agi_xref_icounts(sc); 936 xchk_xref_is_only_owned_by(sc, agbno, 1, &XFS_RMAP_OINFO_FS); 937 xchk_xref_is_not_shared(sc, agbno, 1); 938 xchk_xref_is_not_cow_staging(sc, agbno, 1); 939 xchk_agi_xref_fiblocks(sc); 940 941 /* scrub teardown will take care of sc->sa for us */ 942 } 943 944 /* 945 * Walk the incore unlinked list for a particular AGI bucket to construct 946 * the unlinked inode bitmap for later reconstruction of the unlinked list. 947 * Returns 1 if we should keep checking, 0 to stop checking, or a negative 948 * errno. 949 */ 950 static int 951 xchk_iunlink_bucket( 952 struct xfs_scrub *sc, 953 unsigned int bucket, 954 xfs_agino_t agino) 955 { 956 struct xagino_bitmap seen; 957 int ret; 958 959 xagino_bitmap_init(&seen); 960 961 while (agino != NULLAGINO) { 962 struct xfs_inode *ip; 963 unsigned int len = 1; 964 965 if (agino % XFS_AGI_UNLINKED_BUCKETS != bucket) { 966 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 967 goto bad; 968 } 969 970 if (xagino_bitmap_test(&seen, agino, &len)) { 971 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 972 goto bad; 973 } 974 975 ip = xfs_iunlink_lookup(sc->sa.pag, agino); 976 if (!ip) { 977 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 978 goto bad; 979 } 980 981 if (!xfs_inode_on_unlinked_list(ip)) { 982 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 983 goto bad; 984 } 985 986 ret = xagino_bitmap_set(&seen, agino, 1); 987 if (ret) 988 goto out_bitmap; 989 990 agino = ip->i_next_unlinked; 991 } 992 ret = 1; 993 994 out_bitmap: 995 xagino_bitmap_destroy(&seen); 996 return ret; 997 bad: 998 ret = 0; 999 goto out_bitmap; 1000 } 1001 1002 /* 1003 * Check the unlinked buckets for links to bad inodes. We hold the AGI, so 1004 * there cannot be any threads updating unlinked list pointers in this AG. 1005 */ 1006 STATIC int 1007 xchk_iunlink( 1008 struct xfs_scrub *sc, 1009 struct xfs_agi *agi) 1010 { 1011 unsigned int i; 1012 1013 for (i = 0; i < XFS_AGI_UNLINKED_BUCKETS; i++) { 1014 int ret; 1015 1016 ret = xchk_iunlink_bucket(sc, i, 1017 be32_to_cpu(agi->agi_unlinked[i])); 1018 if (ret < 1) 1019 return ret; 1020 } 1021 1022 return 0; 1023 } 1024 1025 /* Scrub the AGI. */ 1026 int 1027 xchk_agi( 1028 struct xfs_scrub *sc) 1029 { 1030 struct xfs_mount *mp = sc->mp; 1031 struct xfs_agi *agi; 1032 struct xfs_perag *pag; 1033 struct xfs_ino_geometry *igeo = M_IGEO(sc->mp); 1034 xfs_agnumber_t agno = sc->sm->sm_agno; 1035 xfs_agblock_t agbno; 1036 xfs_agblock_t eoag; 1037 xfs_agino_t agino; 1038 xfs_agino_t first_agino; 1039 xfs_agino_t last_agino; 1040 xfs_agino_t icount; 1041 int i; 1042 int level; 1043 int error = 0; 1044 1045 error = xchk_ag_read_headers(sc, agno, &sc->sa); 1046 if (!xchk_process_error(sc, agno, XFS_AGI_BLOCK(sc->mp), &error)) 1047 goto out; 1048 xchk_buffer_recheck(sc, sc->sa.agi_bp); 1049 1050 agi = sc->sa.agi_bp->b_addr; 1051 pag = sc->sa.pag; 1052 1053 /* Check the AG length */ 1054 eoag = be32_to_cpu(agi->agi_length); 1055 if (eoag != pag_group(pag)->xg_block_count) 1056 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 1057 1058 /* Check btree roots and levels */ 1059 agbno = be32_to_cpu(agi->agi_root); 1060 if (!xfs_verify_agbno(pag, agbno)) 1061 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 1062 1063 level = be32_to_cpu(agi->agi_level); 1064 if (level <= 0 || level > igeo->inobt_maxlevels) 1065 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 1066 1067 if (xfs_has_finobt(mp)) { 1068 agbno = be32_to_cpu(agi->agi_free_root); 1069 if (!xfs_verify_agbno(pag, agbno)) 1070 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 1071 1072 level = be32_to_cpu(agi->agi_free_level); 1073 if (level <= 0 || level > igeo->inobt_maxlevels) 1074 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 1075 } 1076 1077 /* Check inode counters */ 1078 xfs_agino_range(mp, agno, &first_agino, &last_agino); 1079 icount = be32_to_cpu(agi->agi_count); 1080 if (icount > last_agino - first_agino + 1 || 1081 icount < be32_to_cpu(agi->agi_freecount)) 1082 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 1083 1084 /* Check inode pointers */ 1085 agino = be32_to_cpu(agi->agi_newino); 1086 if (!xfs_verify_agino_or_null(pag, agino)) 1087 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 1088 1089 agino = be32_to_cpu(agi->agi_dirino); 1090 if (!xfs_verify_agino_or_null(pag, agino)) 1091 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 1092 1093 /* Check unlinked inode buckets */ 1094 for (i = 0; i < XFS_AGI_UNLINKED_BUCKETS; i++) { 1095 agino = be32_to_cpu(agi->agi_unlinked[i]); 1096 if (!xfs_verify_agino_or_null(pag, agino)) 1097 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 1098 } 1099 1100 if (agi->agi_pad32 != cpu_to_be32(0)) 1101 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 1102 1103 /* Do the incore counters match? */ 1104 if (pag->pagi_count != be32_to_cpu(agi->agi_count)) 1105 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 1106 if (pag->pagi_freecount != be32_to_cpu(agi->agi_freecount)) 1107 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 1108 1109 error = xchk_iunlink(sc, agi); 1110 if (error) 1111 goto out; 1112 1113 xchk_agi_xref(sc); 1114 out: 1115 return error; 1116 } 1117