1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Copyright (c) 2021-2024 Oracle. All Rights Reserved. 4 * Author: Darrick J. Wong <djwong@kernel.org> 5 */ 6 #include "xfs.h" 7 #include "xfs_fs.h" 8 #include "xfs_shared.h" 9 #include "xfs_format.h" 10 #include "xfs_trans_resv.h" 11 #include "xfs_mount.h" 12 #include "xfs_log_format.h" 13 #include "xfs_trans.h" 14 #include "xfs_inode.h" 15 #include "xfs_icache.h" 16 #include "xfs_bmap_util.h" 17 #include "xfs_iwalk.h" 18 #include "xfs_ialloc.h" 19 #include "xfs_sb.h" 20 #include "scrub/scrub.h" 21 #include "scrub/common.h" 22 #include "scrub/repair.h" 23 #include "scrub/xfile.h" 24 #include "scrub/xfarray.h" 25 #include "scrub/iscan.h" 26 #include "scrub/nlinks.h" 27 #include "scrub/trace.h" 28 29 /* 30 * Live Inode Link Count Repair 31 * ============================ 32 * 33 * Use the live inode link count information that we collected to replace the 34 * nlink values of the incore inodes. A scrub->repair cycle should have left 35 * the live data and hooks active, so this is safe so long as we make sure the 36 * inode is locked. 37 */ 38 39 /* 40 * Correct the link count of the given inode. Because we have to grab locks 41 * and resources in a certain order, it's possible that this will be a no-op. 42 */ 43 STATIC int 44 xrep_nlinks_repair_inode( 45 struct xchk_nlink_ctrs *xnc) 46 { 47 struct xchk_nlink obs; 48 struct xfs_scrub *sc = xnc->sc; 49 struct xfs_mount *mp = sc->mp; 50 struct xfs_inode *ip = sc->ip; 51 uint64_t total_links; 52 uint64_t actual_nlink; 53 bool dirty = false; 54 int error; 55 56 xchk_ilock(sc, XFS_IOLOCK_EXCL); 57 58 error = xfs_trans_alloc(mp, &M_RES(mp)->tr_link, 0, 0, 0, &sc->tp); 59 if (error) 60 return error; 61 62 xchk_ilock(sc, XFS_ILOCK_EXCL); 63 xfs_trans_ijoin(sc->tp, ip, 0); 64 65 mutex_lock(&xnc->lock); 66 67 if (xchk_iscan_aborted(&xnc->collect_iscan)) { 68 error = -ECANCELED; 69 goto out_scanlock; 70 } 71 72 error = xfarray_load_sparse(xnc->nlinks, ip->i_ino, &obs); 73 if (error) 74 goto out_scanlock; 75 76 /* 77 * We're done accessing the shared scan data, so we can drop the lock. 78 * We still hold @ip's ILOCK, so its link count cannot change. 79 */ 80 mutex_unlock(&xnc->lock); 81 82 total_links = xchk_nlink_total(ip, &obs); 83 actual_nlink = VFS_I(ip)->i_nlink; 84 85 /* 86 * Non-directories cannot have directories pointing up to them. 87 * 88 * We previously set error to zero, but set it again because one static 89 * checker author fears that programmers will fail to maintain this 90 * invariant and built their tool to flag this as a security risk. A 91 * different tool author made their bot complain about the redundant 92 * store. This is a never-ending and stupid battle; both tools missed 93 * *actual bugs* elsewhere; and I no longer care. 94 */ 95 if (!S_ISDIR(VFS_I(ip)->i_mode) && obs.children != 0) { 96 trace_xrep_nlinks_unfixable_inode(mp, ip, &obs); 97 error = 0; 98 goto out_trans; 99 } 100 101 /* 102 * We did not find any links to this inode. If the inode agrees, we 103 * have nothing further to do. If not, the inode has a nonzero link 104 * count and we don't have anywhere to graft the child onto. Dropping 105 * a live inode's link count to zero can cause unexpected shutdowns in 106 * inactivation, so leave it alone. 107 */ 108 if (total_links == 0) { 109 if (actual_nlink != 0) 110 trace_xrep_nlinks_unfixable_inode(mp, ip, &obs); 111 goto out_trans; 112 } 113 114 /* Commit the new link count if it changed. */ 115 if (total_links != actual_nlink) { 116 if (total_links > XFS_MAXLINK) { 117 trace_xrep_nlinks_unfixable_inode(mp, ip, &obs); 118 goto out_trans; 119 } 120 121 trace_xrep_nlinks_update_inode(mp, ip, &obs); 122 123 set_nlink(VFS_I(ip), total_links); 124 dirty = true; 125 } 126 127 if (!dirty) { 128 error = 0; 129 goto out_trans; 130 } 131 132 xfs_trans_log_inode(sc->tp, ip, XFS_ILOG_CORE); 133 134 error = xrep_trans_commit(sc); 135 xchk_iunlock(sc, XFS_ILOCK_EXCL | XFS_IOLOCK_EXCL); 136 return error; 137 138 out_scanlock: 139 mutex_unlock(&xnc->lock); 140 out_trans: 141 xchk_trans_cancel(sc); 142 xchk_iunlock(sc, XFS_ILOCK_EXCL | XFS_IOLOCK_EXCL); 143 return error; 144 } 145 146 /* 147 * Try to visit every inode in the filesystem for repairs. Move on if we can't 148 * grab an inode, since we're still making forward progress. 149 */ 150 static int 151 xrep_nlinks_iter( 152 struct xchk_nlink_ctrs *xnc, 153 struct xfs_inode **ipp) 154 { 155 int error; 156 157 do { 158 error = xchk_iscan_iter(&xnc->compare_iscan, ipp); 159 } while (error == -EBUSY); 160 161 return error; 162 } 163 164 /* Commit the new inode link counters. */ 165 int 166 xrep_nlinks( 167 struct xfs_scrub *sc) 168 { 169 struct xchk_nlink_ctrs *xnc = sc->buf; 170 int error; 171 172 /* 173 * We need ftype for an accurate count of the number of child 174 * subdirectory links. Child subdirectories with a back link (dotdot 175 * entry) but no forward link are unfixable, so we cannot repair the 176 * link count of the parent directory based on the back link count 177 * alone. Filesystems without ftype support are rare (old V4) so we 178 * just skip out here. 179 */ 180 if (!xfs_has_ftype(sc->mp)) 181 return -EOPNOTSUPP; 182 183 /* 184 * Use the inobt to walk all allocated inodes to compare and fix the 185 * link counts. Retry iget every tenth of a second for up to 30 186 * seconds -- even if repair misses a few inodes, we still try to fix 187 * as many of them as we can. 188 */ 189 xchk_iscan_start(sc, 30000, 100, &xnc->compare_iscan); 190 ASSERT(sc->ip == NULL); 191 192 while ((error = xrep_nlinks_iter(xnc, &sc->ip)) == 1) { 193 /* 194 * Commit the scrub transaction so that we can create repair 195 * transactions with the correct reservations. 196 */ 197 xchk_trans_cancel(sc); 198 199 error = xrep_nlinks_repair_inode(xnc); 200 xchk_iscan_mark_visited(&xnc->compare_iscan, sc->ip); 201 xchk_irele(sc, sc->ip); 202 sc->ip = NULL; 203 if (error) 204 break; 205 206 if (xchk_should_terminate(sc, &error)) 207 break; 208 209 /* 210 * Create a new empty transaction so that we can advance the 211 * iscan cursor without deadlocking if the inobt has a cycle. 212 * We can only push the inactivation workqueues with an empty 213 * transaction. 214 */ 215 error = xchk_trans_alloc_empty(sc); 216 if (error) 217 break; 218 } 219 xchk_iscan_iter_finish(&xnc->compare_iscan); 220 xchk_iscan_teardown(&xnc->compare_iscan); 221 222 return error; 223 } 224