1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Copyright (C) 2017-2023 Oracle. All Rights Reserved. 4 * Author: Darrick J. Wong <djwong@kernel.org> 5 */ 6 #include "xfs_platform.h" 7 #include "xfs_fs.h" 8 #include "xfs_shared.h" 9 #include "xfs_format.h" 10 #include "xfs_trans_resv.h" 11 #include "xfs_mount.h" 12 #include "xfs_btree.h" 13 #include "xfs_sb.h" 14 #include "xfs_alloc.h" 15 #include "xfs_ialloc.h" 16 #include "xfs_rmap.h" 17 #include "xfs_ag.h" 18 #include "xfs_inode.h" 19 #include "scrub/scrub.h" 20 #include "scrub/common.h" 21 #include "scrub/bitmap.h" 22 #include "scrub/agino_bitmap.h" 23 24 int 25 xchk_setup_agheader( 26 struct xfs_scrub *sc) 27 { 28 if (xchk_need_intent_drain(sc)) 29 xchk_fsgates_enable(sc, XCHK_FSGATES_DRAIN); 30 return xchk_setup_fs(sc); 31 } 32 33 /* Superblock */ 34 35 /* Cross-reference with the other btrees. */ 36 STATIC void 37 xchk_superblock_xref( 38 struct xfs_scrub *sc) 39 { 40 struct xfs_mount *mp = sc->mp; 41 xfs_agnumber_t agno = sc->sm->sm_agno; 42 xfs_agblock_t agbno; 43 int error; 44 45 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT) 46 return; 47 48 agbno = XFS_SB_BLOCK(mp); 49 50 error = xchk_ag_init_existing(sc, agno); 51 if (!xchk_xref_process_error(sc, agno, agbno, &error)) 52 return; 53 54 xchk_xref_is_used_space(sc, agbno, 1); 55 xchk_xref_is_not_inode_chunk(sc, agbno, 1); 56 xchk_xref_is_only_owned_by(sc, agbno, 1, &XFS_RMAP_OINFO_FS); 57 xchk_xref_is_not_shared(sc, agbno, 1); 58 xchk_xref_is_not_cow_staging(sc, agbno, 1); 59 xchk_ag_free(sc); 60 } 61 62 /* 63 * Calculate the ondisk superblock size in bytes given the feature set of the 64 * mounted filesystem (aka the primary sb). This is subtlely different from 65 * the logic in xfs_repair, which computes the size of a secondary sb given the 66 * featureset listed in the secondary sb. 67 */ 68 STATIC size_t 69 xchk_superblock_ondisk_size( 70 struct xfs_mount *mp) 71 { 72 if (xfs_has_zoned(mp)) 73 return offsetofend(struct xfs_dsb, sb_rtreserved); 74 if (xfs_has_metadir(mp)) 75 return offsetofend(struct xfs_dsb, sb_pad); 76 if (xfs_has_metauuid(mp)) 77 return offsetofend(struct xfs_dsb, sb_meta_uuid); 78 if (xfs_has_crc(mp)) 79 return offsetofend(struct xfs_dsb, sb_lsn); 80 if (xfs_sb_version_hasmorebits(&mp->m_sb)) 81 return offsetofend(struct xfs_dsb, sb_bad_features2); 82 if (xfs_has_logv2(mp)) 83 return offsetofend(struct xfs_dsb, sb_logsunit); 84 if (xfs_has_sector(mp)) 85 return offsetofend(struct xfs_dsb, sb_logsectsize); 86 /* only support dirv2 or more recent */ 87 return offsetofend(struct xfs_dsb, sb_dirblklog); 88 } 89 90 /* 91 * Scrub the filesystem superblock. 92 * 93 * Note: We do /not/ attempt to check AG 0's superblock. Mount is 94 * responsible for validating all the geometry information in sb 0, so 95 * if the filesystem is capable of initiating online scrub, then clearly 96 * sb 0 is ok and we can use its information to check everything else. 97 */ 98 int 99 xchk_superblock( 100 struct xfs_scrub *sc) 101 { 102 struct xfs_mount *mp = sc->mp; 103 struct xfs_buf *bp; 104 struct xfs_dsb *sb; 105 struct xfs_perag *pag; 106 size_t sblen; 107 xfs_agnumber_t agno = sc->sm->sm_agno; 108 uint32_t v2_ok; 109 __be32 features_mask; 110 int error; 111 __be16 vernum_mask; 112 113 /* 114 * Grab an active reference to the perag structure. If we can't get 115 * it, we're racing with something that's tearing down the AG, so 116 * signal that the AG no longer exists. 117 */ 118 pag = xfs_perag_get(mp, agno); 119 if (!pag) 120 return -ENOENT; 121 122 if (agno == 0) { 123 /* 124 * Reread the primary super from disk in case it's become 125 * corrupted enough since mount time to fail the verifier. 126 * Crashing now with a bad primary super will prevent remount 127 * (which might recover the primary super from the log) so we 128 * want to trigger a repair to write the incore primary 129 * superblock out to disk ASAP. 130 * 131 * Note that we don't check the geometry (like we do for a 132 * secondary super) because the incore copy is the source of 133 * truth while the filesystem is mounted. 134 * 135 * If the read races with a write, we end up writing the 136 * primary super unnecessarily, but that's not a big deal. 137 */ 138 error = xfs_buf_read_uncached(sc->mp->m_ddev_targp, 139 XFS_SB_DADDR, BTOBB(mp->m_sb.sb_sectsize), &bp, 140 &xfs_sb_buf_ops); 141 switch (error) { 142 case -EINVAL: /* also -EWRONGFS */ 143 case -ENOSYS: 144 case -EFBIG: 145 error = -EFSCORRUPTED; 146 fallthrough; 147 default: 148 break; 149 } 150 if (!xchk_process_error(sc, agno, XFS_SB_BLOCK(mp), &error)) 151 goto out_pag; 152 153 xfs_buf_relse(bp); 154 goto out_xref; 155 } 156 157 error = xfs_sb_read_secondary(mp, sc->tp, agno, &bp); 158 /* 159 * The superblock verifier can return several different error codes 160 * if it thinks the superblock doesn't look right. For a mount these 161 * would all get bounced back to userspace, but if we're here then the 162 * fs mounted successfully, which means that this secondary superblock 163 * is simply incorrect. Treat all these codes the same way we treat 164 * any corruption. 165 */ 166 switch (error) { 167 case -EINVAL: /* also -EWRONGFS */ 168 case -ENOSYS: 169 case -EFBIG: 170 error = -EFSCORRUPTED; 171 fallthrough; 172 default: 173 break; 174 } 175 if (!xchk_process_error(sc, agno, XFS_SB_BLOCK(mp), &error)) 176 goto out_pag; 177 178 sb = bp->b_addr; 179 180 /* 181 * Verify the geometries match. Fields that are permanently 182 * set by mkfs are checked; fields that can be updated later 183 * (and are not propagated to backup superblocks) are preen 184 * checked. 185 */ 186 if (sb->sb_blocksize != cpu_to_be32(mp->m_sb.sb_blocksize)) 187 xchk_block_set_corrupt(sc, bp); 188 189 if (sb->sb_dblocks != cpu_to_be64(mp->m_sb.sb_dblocks)) 190 xchk_block_set_corrupt(sc, bp); 191 192 if (sb->sb_rblocks != cpu_to_be64(mp->m_sb.sb_rblocks)) 193 xchk_block_set_corrupt(sc, bp); 194 195 if (sb->sb_rextents != cpu_to_be64(mp->m_sb.sb_rextents)) 196 xchk_block_set_corrupt(sc, bp); 197 198 if (!uuid_equal(&sb->sb_uuid, &mp->m_sb.sb_uuid)) 199 xchk_block_set_preen(sc, bp); 200 201 if (sb->sb_logstart != cpu_to_be64(mp->m_sb.sb_logstart)) 202 xchk_block_set_corrupt(sc, bp); 203 204 if (sb->sb_rootino != cpu_to_be64(mp->m_sb.sb_rootino)) 205 xchk_block_set_preen(sc, bp); 206 207 if (xfs_has_metadir(sc->mp)) { 208 if (sb->sb_rbmino != cpu_to_be64(0)) 209 xchk_block_set_corrupt(sc, bp); 210 211 if (sb->sb_rsumino != cpu_to_be64(0)) 212 xchk_block_set_corrupt(sc, bp); 213 } else { 214 if (sb->sb_rbmino != cpu_to_be64(mp->m_sb.sb_rbmino)) 215 xchk_block_set_preen(sc, bp); 216 217 if (sb->sb_rsumino != cpu_to_be64(mp->m_sb.sb_rsumino)) 218 xchk_block_set_preen(sc, bp); 219 } 220 221 if (sb->sb_rextsize != cpu_to_be32(mp->m_sb.sb_rextsize)) 222 xchk_block_set_corrupt(sc, bp); 223 224 if (sb->sb_agblocks != cpu_to_be32(mp->m_sb.sb_agblocks)) 225 xchk_block_set_corrupt(sc, bp); 226 227 if (sb->sb_agcount != cpu_to_be32(mp->m_sb.sb_agcount)) 228 xchk_block_set_corrupt(sc, bp); 229 230 if (sb->sb_rbmblocks != cpu_to_be32(mp->m_sb.sb_rbmblocks)) 231 xchk_block_set_corrupt(sc, bp); 232 233 if (sb->sb_logblocks != cpu_to_be32(mp->m_sb.sb_logblocks)) 234 xchk_block_set_corrupt(sc, bp); 235 236 /* Check sb_versionnum bits that are set at mkfs time. */ 237 vernum_mask = cpu_to_be16(XFS_SB_VERSION_NUMBITS | 238 XFS_SB_VERSION_ALIGNBIT | 239 XFS_SB_VERSION_DALIGNBIT | 240 XFS_SB_VERSION_SHAREDBIT | 241 XFS_SB_VERSION_LOGV2BIT | 242 XFS_SB_VERSION_SECTORBIT | 243 XFS_SB_VERSION_EXTFLGBIT | 244 XFS_SB_VERSION_DIRV2BIT); 245 if ((sb->sb_versionnum & vernum_mask) != 246 (cpu_to_be16(mp->m_sb.sb_versionnum) & vernum_mask)) 247 xchk_block_set_corrupt(sc, bp); 248 249 /* Check sb_versionnum bits that can be set after mkfs time. */ 250 vernum_mask = cpu_to_be16(XFS_SB_VERSION_ATTRBIT | 251 XFS_SB_VERSION_NLINKBIT | 252 XFS_SB_VERSION_QUOTABIT); 253 if ((sb->sb_versionnum & vernum_mask) != 254 (cpu_to_be16(mp->m_sb.sb_versionnum) & vernum_mask)) 255 xchk_block_set_preen(sc, bp); 256 257 if (sb->sb_sectsize != cpu_to_be16(mp->m_sb.sb_sectsize)) 258 xchk_block_set_corrupt(sc, bp); 259 260 if (sb->sb_inodesize != cpu_to_be16(mp->m_sb.sb_inodesize)) 261 xchk_block_set_corrupt(sc, bp); 262 263 if (sb->sb_inopblock != cpu_to_be16(mp->m_sb.sb_inopblock)) 264 xchk_block_set_corrupt(sc, bp); 265 266 if (memcmp(sb->sb_fname, mp->m_sb.sb_fname, sizeof(sb->sb_fname))) 267 xchk_block_set_preen(sc, bp); 268 269 if (sb->sb_blocklog != mp->m_sb.sb_blocklog) 270 xchk_block_set_corrupt(sc, bp); 271 272 if (sb->sb_sectlog != mp->m_sb.sb_sectlog) 273 xchk_block_set_corrupt(sc, bp); 274 275 if (sb->sb_inodelog != mp->m_sb.sb_inodelog) 276 xchk_block_set_corrupt(sc, bp); 277 278 if (sb->sb_inopblog != mp->m_sb.sb_inopblog) 279 xchk_block_set_corrupt(sc, bp); 280 281 if (sb->sb_agblklog != mp->m_sb.sb_agblklog) 282 xchk_block_set_corrupt(sc, bp); 283 284 if (sb->sb_rextslog != mp->m_sb.sb_rextslog) 285 xchk_block_set_corrupt(sc, bp); 286 287 if (sb->sb_imax_pct != mp->m_sb.sb_imax_pct) 288 xchk_block_set_preen(sc, bp); 289 290 /* 291 * Skip the summary counters since we track them in memory anyway. 292 * sb_icount, sb_ifree, sb_fdblocks, sb_frexents 293 */ 294 295 if (xfs_has_metadir(mp)) { 296 if (sb->sb_uquotino != cpu_to_be64(0)) 297 xchk_block_set_corrupt(sc, bp); 298 299 if (sb->sb_gquotino != cpu_to_be64(0)) 300 xchk_block_set_corrupt(sc, bp); 301 } else { 302 if (sb->sb_uquotino != cpu_to_be64(mp->m_sb.sb_uquotino)) 303 xchk_block_set_preen(sc, bp); 304 305 if (sb->sb_gquotino != cpu_to_be64(mp->m_sb.sb_gquotino)) 306 xchk_block_set_preen(sc, bp); 307 } 308 309 /* 310 * Skip the quota flags since repair will force quotacheck. 311 * sb_qflags 312 */ 313 314 if (sb->sb_flags != mp->m_sb.sb_flags) 315 xchk_block_set_corrupt(sc, bp); 316 317 if (sb->sb_shared_vn != mp->m_sb.sb_shared_vn) 318 xchk_block_set_corrupt(sc, bp); 319 320 if (sb->sb_inoalignmt != cpu_to_be32(mp->m_sb.sb_inoalignmt)) 321 xchk_block_set_corrupt(sc, bp); 322 323 if (sb->sb_unit != cpu_to_be32(mp->m_sb.sb_unit)) 324 xchk_block_set_preen(sc, bp); 325 326 if (sb->sb_width != cpu_to_be32(mp->m_sb.sb_width)) 327 xchk_block_set_preen(sc, bp); 328 329 if (sb->sb_dirblklog != mp->m_sb.sb_dirblklog) 330 xchk_block_set_corrupt(sc, bp); 331 332 if (sb->sb_logsectlog != mp->m_sb.sb_logsectlog) 333 xchk_block_set_corrupt(sc, bp); 334 335 if (sb->sb_logsectsize != cpu_to_be16(mp->m_sb.sb_logsectsize)) 336 xchk_block_set_corrupt(sc, bp); 337 338 if (sb->sb_logsunit != cpu_to_be32(mp->m_sb.sb_logsunit)) 339 xchk_block_set_corrupt(sc, bp); 340 341 /* Do we see any invalid bits in sb_features2? */ 342 if (!xfs_sb_version_hasmorebits(&mp->m_sb)) { 343 if (sb->sb_features2 != 0) 344 xchk_block_set_corrupt(sc, bp); 345 } else { 346 v2_ok = XFS_SB_VERSION2_OKBITS; 347 if (xfs_sb_is_v5(&mp->m_sb)) 348 v2_ok |= XFS_SB_VERSION2_CRCBIT; 349 350 if (!!(sb->sb_features2 & cpu_to_be32(~v2_ok))) 351 xchk_block_set_corrupt(sc, bp); 352 353 if (sb->sb_features2 != sb->sb_bad_features2) 354 xchk_block_set_preen(sc, bp); 355 } 356 357 /* Check sb_features2 flags that are set at mkfs time. */ 358 features_mask = cpu_to_be32(XFS_SB_VERSION2_LAZYSBCOUNTBIT | 359 XFS_SB_VERSION2_PROJID32BIT | 360 XFS_SB_VERSION2_CRCBIT | 361 XFS_SB_VERSION2_FTYPE); 362 if ((sb->sb_features2 & features_mask) != 363 (cpu_to_be32(mp->m_sb.sb_features2) & features_mask)) 364 xchk_block_set_corrupt(sc, bp); 365 366 /* Check sb_features2 flags that can be set after mkfs time. */ 367 features_mask = cpu_to_be32(XFS_SB_VERSION2_ATTR2BIT); 368 if ((sb->sb_features2 & features_mask) != 369 (cpu_to_be32(mp->m_sb.sb_features2) & features_mask)) 370 xchk_block_set_preen(sc, bp); 371 372 if (!xfs_has_crc(mp)) { 373 /* all v5 fields must be zero */ 374 if (memchr_inv(&sb->sb_features_compat, 0, 375 sizeof(struct xfs_dsb) - 376 offsetof(struct xfs_dsb, sb_features_compat))) 377 xchk_block_set_corrupt(sc, bp); 378 } else { 379 /* compat features must match */ 380 if (sb->sb_features_compat != 381 cpu_to_be32(mp->m_sb.sb_features_compat)) 382 xchk_block_set_corrupt(sc, bp); 383 384 /* ro compat features must match */ 385 if (sb->sb_features_ro_compat != 386 cpu_to_be32(mp->m_sb.sb_features_ro_compat)) 387 xchk_block_set_corrupt(sc, bp); 388 389 /* 390 * NEEDSREPAIR is ignored on a secondary super, so we should 391 * clear it when we find it, though it's not a corruption. 392 */ 393 features_mask = cpu_to_be32(XFS_SB_FEAT_INCOMPAT_NEEDSREPAIR); 394 if ((cpu_to_be32(mp->m_sb.sb_features_incompat) ^ 395 sb->sb_features_incompat) & features_mask) 396 xchk_block_set_preen(sc, bp); 397 398 /* all other incompat features must match */ 399 if ((cpu_to_be32(mp->m_sb.sb_features_incompat) ^ 400 sb->sb_features_incompat) & ~features_mask) 401 xchk_block_set_corrupt(sc, bp); 402 403 /* 404 * log incompat features protect newer log record types from 405 * older log recovery code. Log recovery doesn't check the 406 * secondary supers, so we can clear these if needed. 407 */ 408 if (sb->sb_features_log_incompat) 409 xchk_block_set_preen(sc, bp); 410 411 /* Don't care about sb_crc */ 412 413 if (sb->sb_spino_align != cpu_to_be32(mp->m_sb.sb_spino_align)) 414 xchk_block_set_corrupt(sc, bp); 415 416 if (xfs_has_metadir(mp)) { 417 if (sb->sb_pquotino != cpu_to_be64(0)) 418 xchk_block_set_corrupt(sc, bp); 419 } else { 420 if (sb->sb_pquotino != cpu_to_be64(mp->m_sb.sb_pquotino)) 421 xchk_block_set_preen(sc, bp); 422 } 423 424 /* Don't care about sb_lsn */ 425 } 426 427 if (xfs_has_metauuid(mp)) { 428 /* The metadata UUID must be the same for all supers */ 429 if (!uuid_equal(&sb->sb_meta_uuid, &mp->m_sb.sb_meta_uuid)) 430 xchk_block_set_corrupt(sc, bp); 431 } 432 433 if (xfs_has_metadir(mp)) { 434 if (sb->sb_metadirino != cpu_to_be64(mp->m_sb.sb_metadirino)) 435 xchk_block_set_preen(sc, bp); 436 437 if (sb->sb_rgcount != cpu_to_be32(mp->m_sb.sb_rgcount)) 438 xchk_block_set_corrupt(sc, bp); 439 440 if (sb->sb_rgextents != cpu_to_be32(mp->m_sb.sb_rgextents)) 441 xchk_block_set_corrupt(sc, bp); 442 443 if (sb->sb_rgblklog != mp->m_sb.sb_rgblklog) 444 xchk_block_set_corrupt(sc, bp); 445 446 if (memchr_inv(sb->sb_pad, 0, sizeof(sb->sb_pad))) 447 xchk_block_set_corrupt(sc, bp); 448 } 449 450 if (xfs_has_zoned(mp)) { 451 if (sb->sb_rtstart != cpu_to_be64(mp->m_sb.sb_rtstart)) 452 xchk_block_set_corrupt(sc, bp); 453 if (sb->sb_rtreserved != cpu_to_be64(mp->m_sb.sb_rtreserved)) 454 xchk_block_set_corrupt(sc, bp); 455 } 456 457 /* Everything else must be zero. */ 458 sblen = xchk_superblock_ondisk_size(mp); 459 if (memchr_inv((char *)sb + sblen, 0, BBTOB(bp->b_length) - sblen)) 460 xchk_block_set_corrupt(sc, bp); 461 462 out_xref: 463 xchk_superblock_xref(sc); 464 out_pag: 465 xfs_perag_put(pag); 466 return error; 467 } 468 469 /* AGF */ 470 471 /* Tally freespace record lengths. */ 472 STATIC int 473 xchk_agf_record_bno_lengths( 474 struct xfs_btree_cur *cur, 475 const struct xfs_alloc_rec_incore *rec, 476 void *priv) 477 { 478 xfs_extlen_t *blocks = priv; 479 480 (*blocks) += rec->ar_blockcount; 481 return 0; 482 } 483 484 /* Check agf_freeblks */ 485 static inline void 486 xchk_agf_xref_freeblks( 487 struct xfs_scrub *sc) 488 { 489 struct xfs_agf *agf = sc->sa.agf_bp->b_addr; 490 xfs_extlen_t blocks = 0; 491 int error; 492 493 if (!sc->sa.bno_cur) 494 return; 495 496 error = xfs_alloc_query_all(sc->sa.bno_cur, 497 xchk_agf_record_bno_lengths, &blocks); 498 if (!xchk_should_check_xref(sc, &error, &sc->sa.bno_cur)) 499 return; 500 if (blocks != be32_to_cpu(agf->agf_freeblks)) 501 xchk_block_xref_set_corrupt(sc, sc->sa.agf_bp); 502 } 503 504 /* Cross reference the AGF with the cntbt (freespace by length btree) */ 505 static inline void 506 xchk_agf_xref_cntbt( 507 struct xfs_scrub *sc) 508 { 509 struct xfs_agf *agf = sc->sa.agf_bp->b_addr; 510 xfs_agblock_t agbno; 511 xfs_extlen_t blocks; 512 int have; 513 int error; 514 515 if (!sc->sa.cnt_cur) 516 return; 517 518 /* Any freespace at all? */ 519 error = xfs_alloc_lookup_le(sc->sa.cnt_cur, 0, -1U, &have); 520 if (!xchk_should_check_xref(sc, &error, &sc->sa.cnt_cur)) 521 return; 522 if (!have) { 523 if (agf->agf_freeblks != cpu_to_be32(0)) 524 xchk_block_xref_set_corrupt(sc, sc->sa.agf_bp); 525 return; 526 } 527 528 /* Check agf_longest */ 529 error = xfs_alloc_get_rec(sc->sa.cnt_cur, &agbno, &blocks, &have); 530 if (!xchk_should_check_xref(sc, &error, &sc->sa.cnt_cur)) 531 return; 532 if (!have || blocks != be32_to_cpu(agf->agf_longest)) 533 xchk_block_xref_set_corrupt(sc, sc->sa.agf_bp); 534 } 535 536 /* Check the btree block counts in the AGF against the btrees. */ 537 STATIC void 538 xchk_agf_xref_btreeblks( 539 struct xfs_scrub *sc) 540 { 541 struct xfs_agf *agf = sc->sa.agf_bp->b_addr; 542 struct xfs_mount *mp = sc->mp; 543 xfs_filblks_t blocks; 544 xfs_agblock_t btreeblks; 545 int error; 546 547 /* agf_btreeblks didn't exist before lazysbcount */ 548 if (!xfs_has_lazysbcount(sc->mp)) 549 return; 550 551 /* Check agf_rmap_blocks; set up for agf_btreeblks check */ 552 if (sc->sa.rmap_cur) { 553 error = xfs_btree_count_blocks(sc->sa.rmap_cur, &blocks); 554 if (!xchk_should_check_xref(sc, &error, &sc->sa.rmap_cur)) 555 return; 556 btreeblks = blocks - 1; 557 if (blocks != be32_to_cpu(agf->agf_rmap_blocks)) 558 xchk_block_xref_set_corrupt(sc, sc->sa.agf_bp); 559 } else { 560 btreeblks = 0; 561 } 562 563 /* 564 * No rmap cursor; we can't xref if we have the rmapbt feature. 565 * We also can't do it if we're missing the free space btree cursors. 566 */ 567 if ((xfs_has_rmapbt(mp) && !sc->sa.rmap_cur) || 568 !sc->sa.bno_cur || !sc->sa.cnt_cur) 569 return; 570 571 /* Check agf_btreeblks */ 572 error = xfs_btree_count_blocks(sc->sa.bno_cur, &blocks); 573 if (!xchk_should_check_xref(sc, &error, &sc->sa.bno_cur)) 574 return; 575 btreeblks += blocks - 1; 576 577 error = xfs_btree_count_blocks(sc->sa.cnt_cur, &blocks); 578 if (!xchk_should_check_xref(sc, &error, &sc->sa.cnt_cur)) 579 return; 580 btreeblks += blocks - 1; 581 582 if (btreeblks != be32_to_cpu(agf->agf_btreeblks)) 583 xchk_block_xref_set_corrupt(sc, sc->sa.agf_bp); 584 } 585 586 /* Check agf_refcount_blocks against tree size */ 587 static inline void 588 xchk_agf_xref_refcblks( 589 struct xfs_scrub *sc) 590 { 591 struct xfs_agf *agf = sc->sa.agf_bp->b_addr; 592 xfs_filblks_t blocks; 593 int error; 594 595 if (!sc->sa.refc_cur) 596 return; 597 598 error = xfs_btree_count_blocks(sc->sa.refc_cur, &blocks); 599 if (!xchk_should_check_xref(sc, &error, &sc->sa.refc_cur)) 600 return; 601 if (blocks != be32_to_cpu(agf->agf_refcount_blocks)) 602 xchk_block_xref_set_corrupt(sc, sc->sa.agf_bp); 603 } 604 605 /* Cross-reference with the other btrees. */ 606 STATIC void 607 xchk_agf_xref( 608 struct xfs_scrub *sc) 609 { 610 struct xfs_mount *mp = sc->mp; 611 xfs_agblock_t agbno; 612 613 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT) 614 return; 615 616 agbno = XFS_AGF_BLOCK(mp); 617 618 xchk_ag_btcur_init(sc); 619 620 xchk_xref_is_used_space(sc, agbno, 1); 621 xchk_agf_xref_freeblks(sc); 622 xchk_agf_xref_cntbt(sc); 623 xchk_xref_is_not_inode_chunk(sc, agbno, 1); 624 xchk_xref_is_only_owned_by(sc, agbno, 1, &XFS_RMAP_OINFO_FS); 625 xchk_agf_xref_btreeblks(sc); 626 xchk_xref_is_not_shared(sc, agbno, 1); 627 xchk_xref_is_not_cow_staging(sc, agbno, 1); 628 xchk_agf_xref_refcblks(sc); 629 630 /* scrub teardown will take care of sc->sa for us */ 631 } 632 633 /* Scrub the AGF. */ 634 int 635 xchk_agf( 636 struct xfs_scrub *sc) 637 { 638 struct xfs_mount *mp = sc->mp; 639 struct xfs_agf *agf; 640 struct xfs_perag *pag; 641 xfs_agnumber_t agno = sc->sm->sm_agno; 642 xfs_agblock_t agbno; 643 xfs_agblock_t eoag; 644 xfs_agblock_t agfl_first; 645 xfs_agblock_t agfl_last; 646 xfs_agblock_t agfl_count; 647 xfs_agblock_t fl_count; 648 int level; 649 int error = 0; 650 651 error = xchk_ag_read_headers(sc, agno); 652 if (!xchk_process_error(sc, agno, XFS_AGF_BLOCK(sc->mp), &error)) 653 goto out; 654 xchk_buffer_recheck(sc, sc->sa.agf_bp); 655 656 agf = sc->sa.agf_bp->b_addr; 657 pag = sc->sa.pag; 658 659 /* Check the AG length */ 660 eoag = be32_to_cpu(agf->agf_length); 661 if (eoag != pag_group(pag)->xg_block_count) 662 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 663 664 /* Check the AGF btree roots and levels */ 665 agbno = be32_to_cpu(agf->agf_bno_root); 666 if (!xfs_verify_agbno(pag, agbno)) 667 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 668 669 agbno = be32_to_cpu(agf->agf_cnt_root); 670 if (!xfs_verify_agbno(pag, agbno)) 671 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 672 673 level = be32_to_cpu(agf->agf_bno_level); 674 if (level <= 0 || level > mp->m_alloc_maxlevels) 675 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 676 677 level = be32_to_cpu(agf->agf_cnt_level); 678 if (level <= 0 || level > mp->m_alloc_maxlevels) 679 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 680 681 if (xfs_has_rmapbt(mp)) { 682 agbno = be32_to_cpu(agf->agf_rmap_root); 683 if (!xfs_verify_agbno(pag, agbno)) 684 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 685 686 level = be32_to_cpu(agf->agf_rmap_level); 687 if (level <= 0 || level > mp->m_rmap_maxlevels) 688 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 689 } 690 691 if (xfs_has_reflink(mp)) { 692 agbno = be32_to_cpu(agf->agf_refcount_root); 693 if (!xfs_verify_agbno(pag, agbno)) 694 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 695 696 level = be32_to_cpu(agf->agf_refcount_level); 697 if (level <= 0 || level > mp->m_refc_maxlevels) 698 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 699 } 700 701 /* Check the AGFL counters */ 702 agfl_first = be32_to_cpu(agf->agf_flfirst); 703 agfl_last = be32_to_cpu(agf->agf_fllast); 704 agfl_count = be32_to_cpu(agf->agf_flcount); 705 if (agfl_last > agfl_first) 706 fl_count = agfl_last - agfl_first + 1; 707 else 708 fl_count = xfs_agfl_size(mp) - agfl_first + agfl_last + 1; 709 if (agfl_count != 0 && fl_count != agfl_count) 710 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 711 712 /* Do the incore counters match? */ 713 if (pag->pagf_freeblks != be32_to_cpu(agf->agf_freeblks)) 714 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 715 if (pag->pagf_flcount != be32_to_cpu(agf->agf_flcount)) 716 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 717 if (xfs_has_lazysbcount(sc->mp) && 718 pag->pagf_btreeblks != be32_to_cpu(agf->agf_btreeblks)) 719 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 720 721 xchk_agf_xref(sc); 722 out: 723 return error; 724 } 725 726 /* AGFL */ 727 728 struct xchk_agfl_info { 729 /* Number of AGFL entries that the AGF claims are in use. */ 730 unsigned int agflcount; 731 732 /* Number of AGFL entries that we found. */ 733 unsigned int nr_entries; 734 735 /* Buffer to hold AGFL entries for extent checking. */ 736 xfs_agblock_t *entries; 737 738 struct xfs_buf *agfl_bp; 739 struct xfs_scrub *sc; 740 }; 741 742 /* Cross-reference with the other btrees. */ 743 STATIC void 744 xchk_agfl_block_xref( 745 struct xfs_scrub *sc, 746 xfs_agblock_t agbno) 747 { 748 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT) 749 return; 750 751 xchk_xref_is_used_space(sc, agbno, 1); 752 xchk_xref_is_not_inode_chunk(sc, agbno, 1); 753 xchk_xref_is_only_owned_by(sc, agbno, 1, &XFS_RMAP_OINFO_AG); 754 xchk_xref_is_not_shared(sc, agbno, 1); 755 xchk_xref_is_not_cow_staging(sc, agbno, 1); 756 } 757 758 /* Scrub an AGFL block. */ 759 STATIC int 760 xchk_agfl_block( 761 struct xfs_mount *mp, 762 xfs_agblock_t agbno, 763 void *priv) 764 { 765 struct xchk_agfl_info *sai = priv; 766 struct xfs_scrub *sc = sai->sc; 767 768 if (xfs_verify_agbno(sc->sa.pag, agbno) && 769 sai->nr_entries < sai->agflcount) 770 sai->entries[sai->nr_entries++] = agbno; 771 else 772 xchk_block_set_corrupt(sc, sai->agfl_bp); 773 774 xchk_agfl_block_xref(sc, agbno); 775 776 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT) 777 return -ECANCELED; 778 779 return 0; 780 } 781 782 static int 783 xchk_agblock_cmp( 784 const void *pa, 785 const void *pb) 786 { 787 const xfs_agblock_t *a = pa; 788 const xfs_agblock_t *b = pb; 789 790 return (int)*a - (int)*b; 791 } 792 793 /* Cross-reference with the other btrees. */ 794 STATIC void 795 xchk_agfl_xref( 796 struct xfs_scrub *sc) 797 { 798 struct xfs_mount *mp = sc->mp; 799 xfs_agblock_t agbno; 800 801 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT) 802 return; 803 804 agbno = XFS_AGFL_BLOCK(mp); 805 806 xchk_ag_btcur_init(sc); 807 808 xchk_xref_is_used_space(sc, agbno, 1); 809 xchk_xref_is_not_inode_chunk(sc, agbno, 1); 810 xchk_xref_is_only_owned_by(sc, agbno, 1, &XFS_RMAP_OINFO_FS); 811 xchk_xref_is_not_shared(sc, agbno, 1); 812 xchk_xref_is_not_cow_staging(sc, agbno, 1); 813 814 /* 815 * Scrub teardown will take care of sc->sa for us. Leave sc->sa 816 * active so that the agfl block xref can use it too. 817 */ 818 } 819 820 /* Scrub the AGFL. */ 821 int 822 xchk_agfl( 823 struct xfs_scrub *sc) 824 { 825 struct xchk_agfl_info sai = { 826 .sc = sc, 827 }; 828 struct xfs_agf *agf; 829 xfs_agnumber_t agno = sc->sm->sm_agno; 830 unsigned int i; 831 int error; 832 833 /* Lock the AGF and AGI so that nobody can touch this AG. */ 834 error = xchk_ag_read_headers(sc, agno); 835 if (!xchk_process_error(sc, agno, XFS_AGFL_BLOCK(sc->mp), &error)) 836 return error; 837 if (!sc->sa.agf_bp) 838 return -EFSCORRUPTED; 839 840 /* Try to read the AGFL, and verify its structure if we get it. */ 841 error = xfs_alloc_read_agfl(sc->sa.pag, sc->tp, &sai.agfl_bp); 842 if (!xchk_process_error(sc, agno, XFS_AGFL_BLOCK(sc->mp), &error)) 843 return error; 844 xchk_buffer_recheck(sc, sai.agfl_bp); 845 846 xchk_agfl_xref(sc); 847 848 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT) 849 goto out; 850 851 /* Allocate buffer to ensure uniqueness of AGFL entries. */ 852 agf = sc->sa.agf_bp->b_addr; 853 sai.agflcount = be32_to_cpu(agf->agf_flcount); 854 if (sai.agflcount > xfs_agfl_size(sc->mp)) { 855 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 856 goto out; 857 } 858 sai.entries = kvzalloc_objs(xfs_agblock_t, sai.agflcount, 859 XCHK_GFP_FLAGS); 860 if (!sai.entries) { 861 error = -ENOMEM; 862 goto out; 863 } 864 865 /* Check the blocks in the AGFL. */ 866 error = xfs_agfl_walk(sc->mp, sc->sa.agf_bp->b_addr, sai.agfl_bp, 867 xchk_agfl_block, &sai); 868 if (error == -ECANCELED) { 869 error = 0; 870 goto out_free; 871 } 872 if (error) 873 goto out_free; 874 875 if (sai.agflcount != sai.nr_entries) { 876 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 877 goto out_free; 878 } 879 880 /* Sort entries, check for duplicates. */ 881 sort(sai.entries, sai.nr_entries, sizeof(sai.entries[0]), 882 xchk_agblock_cmp, NULL); 883 for (i = 1; i < sai.nr_entries; i++) { 884 if (sai.entries[i] == sai.entries[i - 1]) { 885 xchk_block_set_corrupt(sc, sc->sa.agf_bp); 886 break; 887 } 888 } 889 890 out_free: 891 kvfree(sai.entries); 892 out: 893 return error; 894 } 895 896 /* AGI */ 897 898 /* Check agi_count/agi_freecount */ 899 static inline void 900 xchk_agi_xref_icounts( 901 struct xfs_scrub *sc) 902 { 903 struct xfs_agi *agi = sc->sa.agi_bp->b_addr; 904 xfs_agino_t icount; 905 xfs_agino_t freecount; 906 int error; 907 908 if (!sc->sa.ino_cur) 909 return; 910 911 error = xfs_ialloc_count_inodes(sc->sa.ino_cur, &icount, &freecount); 912 if (!xchk_should_check_xref(sc, &error, &sc->sa.ino_cur)) 913 return; 914 if (be32_to_cpu(agi->agi_count) != icount || 915 be32_to_cpu(agi->agi_freecount) != freecount) 916 xchk_block_xref_set_corrupt(sc, sc->sa.agi_bp); 917 } 918 919 /* Check agi_[fi]blocks against tree size */ 920 static inline void 921 xchk_agi_xref_fiblocks( 922 struct xfs_scrub *sc) 923 { 924 struct xfs_agi *agi = sc->sa.agi_bp->b_addr; 925 xfs_filblks_t blocks; 926 int error = 0; 927 928 if (!xfs_has_inobtcounts(sc->mp)) 929 return; 930 931 if (sc->sa.ino_cur) { 932 error = xfs_btree_count_blocks(sc->sa.ino_cur, &blocks); 933 if (!xchk_should_check_xref(sc, &error, &sc->sa.ino_cur)) 934 return; 935 if (blocks != be32_to_cpu(agi->agi_iblocks)) 936 xchk_block_xref_set_corrupt(sc, sc->sa.agi_bp); 937 } 938 939 if (sc->sa.fino_cur) { 940 error = xfs_btree_count_blocks(sc->sa.fino_cur, &blocks); 941 if (!xchk_should_check_xref(sc, &error, &sc->sa.fino_cur)) 942 return; 943 if (blocks != be32_to_cpu(agi->agi_fblocks)) 944 xchk_block_xref_set_corrupt(sc, sc->sa.agi_bp); 945 } 946 } 947 948 /* Cross-reference with the other btrees. */ 949 STATIC void 950 xchk_agi_xref( 951 struct xfs_scrub *sc) 952 { 953 struct xfs_mount *mp = sc->mp; 954 xfs_agblock_t agbno; 955 956 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT) 957 return; 958 959 agbno = XFS_AGI_BLOCK(mp); 960 961 xchk_ag_btcur_init(sc); 962 963 xchk_xref_is_used_space(sc, agbno, 1); 964 xchk_xref_is_not_inode_chunk(sc, agbno, 1); 965 xchk_agi_xref_icounts(sc); 966 xchk_xref_is_only_owned_by(sc, agbno, 1, &XFS_RMAP_OINFO_FS); 967 xchk_xref_is_not_shared(sc, agbno, 1); 968 xchk_xref_is_not_cow_staging(sc, agbno, 1); 969 xchk_agi_xref_fiblocks(sc); 970 971 /* scrub teardown will take care of sc->sa for us */ 972 } 973 974 /* 975 * Walk the incore unlinked list for a particular AGI bucket to construct 976 * the unlinked inode bitmap for later reconstruction of the unlinked list. 977 * Returns 1 if we should keep checking, 0 to stop checking, or a negative 978 * errno. 979 */ 980 static int 981 xchk_iunlink_bucket( 982 struct xfs_scrub *sc, 983 unsigned int bucket, 984 xfs_agino_t agino) 985 { 986 struct xagino_bitmap seen; 987 int ret; 988 989 xagino_bitmap_init(&seen); 990 991 while (agino != NULLAGINO) { 992 struct xfs_inode *ip; 993 unsigned int len = 1; 994 995 if (agino % XFS_AGI_UNLINKED_BUCKETS != bucket) { 996 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 997 goto bad; 998 } 999 1000 if (xagino_bitmap_test(&seen, agino, &len)) { 1001 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 1002 goto bad; 1003 } 1004 1005 ip = xfs_iunlink_lookup(sc->sa.pag, agino); 1006 if (!ip) { 1007 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 1008 goto bad; 1009 } 1010 1011 if (!xfs_inode_on_unlinked_list(ip)) { 1012 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 1013 goto bad; 1014 } 1015 1016 ret = xagino_bitmap_set(&seen, agino, 1); 1017 if (ret) 1018 goto out_bitmap; 1019 1020 agino = ip->i_next_unlinked; 1021 } 1022 ret = 1; 1023 1024 out_bitmap: 1025 xagino_bitmap_destroy(&seen); 1026 return ret; 1027 bad: 1028 ret = 0; 1029 goto out_bitmap; 1030 } 1031 1032 /* 1033 * Check the unlinked buckets for links to bad inodes. We hold the AGI, so 1034 * there cannot be any threads updating unlinked list pointers in this AG. 1035 */ 1036 STATIC int 1037 xchk_iunlink( 1038 struct xfs_scrub *sc, 1039 struct xfs_agi *agi) 1040 { 1041 unsigned int i; 1042 1043 for (i = 0; i < XFS_AGI_UNLINKED_BUCKETS; i++) { 1044 int ret; 1045 1046 ret = xchk_iunlink_bucket(sc, i, 1047 be32_to_cpu(agi->agi_unlinked[i])); 1048 if (ret < 1) 1049 return ret; 1050 } 1051 1052 return 0; 1053 } 1054 1055 /* Scrub the AGI. */ 1056 int 1057 xchk_agi( 1058 struct xfs_scrub *sc) 1059 { 1060 struct xfs_mount *mp = sc->mp; 1061 struct xfs_agi *agi; 1062 struct xfs_perag *pag; 1063 struct xfs_ino_geometry *igeo = M_IGEO(sc->mp); 1064 xfs_agnumber_t agno = sc->sm->sm_agno; 1065 xfs_agblock_t agbno; 1066 xfs_agblock_t eoag; 1067 xfs_agino_t agino; 1068 xfs_agino_t first_agino; 1069 xfs_agino_t last_agino; 1070 xfs_agino_t icount; 1071 int i; 1072 int level; 1073 int error = 0; 1074 1075 error = xchk_ag_read_headers(sc, agno); 1076 if (!xchk_process_error(sc, agno, XFS_AGI_BLOCK(sc->mp), &error)) 1077 goto out; 1078 xchk_buffer_recheck(sc, sc->sa.agi_bp); 1079 1080 agi = sc->sa.agi_bp->b_addr; 1081 pag = sc->sa.pag; 1082 1083 /* Check the AG length */ 1084 eoag = be32_to_cpu(agi->agi_length); 1085 if (eoag != pag_group(pag)->xg_block_count) 1086 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 1087 1088 /* Check btree roots and levels */ 1089 agbno = be32_to_cpu(agi->agi_root); 1090 if (!xfs_verify_agbno(pag, agbno)) 1091 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 1092 1093 level = be32_to_cpu(agi->agi_level); 1094 if (level <= 0 || level > igeo->inobt_maxlevels) 1095 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 1096 1097 if (xfs_has_finobt(mp)) { 1098 agbno = be32_to_cpu(agi->agi_free_root); 1099 if (!xfs_verify_agbno(pag, agbno)) 1100 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 1101 1102 level = be32_to_cpu(agi->agi_free_level); 1103 if (level <= 0 || level > igeo->inobt_maxlevels) 1104 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 1105 } 1106 1107 /* Check inode counters */ 1108 xfs_agino_range(mp, agno, &first_agino, &last_agino); 1109 icount = be32_to_cpu(agi->agi_count); 1110 if (icount > last_agino - first_agino + 1 || 1111 icount < be32_to_cpu(agi->agi_freecount)) 1112 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 1113 1114 /* Check inode pointers */ 1115 agino = be32_to_cpu(agi->agi_newino); 1116 if (!xfs_verify_agino_or_null(pag, agino)) 1117 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 1118 1119 agino = be32_to_cpu(agi->agi_dirino); 1120 if (!xfs_verify_agino_or_null(pag, agino)) 1121 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 1122 1123 /* Check unlinked inode buckets */ 1124 for (i = 0; i < XFS_AGI_UNLINKED_BUCKETS; i++) { 1125 agino = be32_to_cpu(agi->agi_unlinked[i]); 1126 if (!xfs_verify_agino_or_null(pag, agino)) 1127 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 1128 } 1129 1130 if (agi->agi_pad32 != cpu_to_be32(0)) 1131 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 1132 1133 /* Do the incore counters match? */ 1134 if (pag->pagi_count != be32_to_cpu(agi->agi_count)) 1135 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 1136 if (pag->pagi_freecount != be32_to_cpu(agi->agi_freecount)) 1137 xchk_block_set_corrupt(sc, sc->sa.agi_bp); 1138 1139 error = xchk_iunlink(sc, agi); 1140 if (error) 1141 goto out; 1142 1143 xchk_agi_xref(sc); 1144 out: 1145 return error; 1146 } 1147