1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Copyright (c) 2021-2024 Oracle. All Rights Reserved. 4 * Author: Darrick J. Wong <djwong@kernel.org> 5 */ 6 #include "xfs.h" 7 #include "xfs_fs.h" 8 #include "xfs_shared.h" 9 #include "xfs_format.h" 10 #include "xfs_trans_resv.h" 11 #include "xfs_mount.h" 12 #include "xfs_log_format.h" 13 #include "xfs_trans.h" 14 #include "xfs_inode.h" 15 #include "xfs_icache.h" 16 #include "xfs_bmap_util.h" 17 #include "xfs_iwalk.h" 18 #include "xfs_ialloc.h" 19 #include "xfs_sb.h" 20 #include "xfs_ag.h" 21 #include "xfs_dir2.h" 22 #include "xfs_parent.h" 23 #include "scrub/scrub.h" 24 #include "scrub/common.h" 25 #include "scrub/repair.h" 26 #include "scrub/xfile.h" 27 #include "scrub/xfarray.h" 28 #include "scrub/iscan.h" 29 #include "scrub/orphanage.h" 30 #include "scrub/nlinks.h" 31 #include "scrub/trace.h" 32 #include "scrub/tempfile.h" 33 34 /* 35 * Live Inode Link Count Repair 36 * ============================ 37 * 38 * Use the live inode link count information that we collected to replace the 39 * nlink values of the incore inodes. A scrub->repair cycle should have left 40 * the live data and hooks active, so this is safe so long as we make sure the 41 * inode is locked. 42 */ 43 44 /* Set up to repair inode link counts. */ 45 int 46 xrep_setup_nlinks( 47 struct xfs_scrub *sc) 48 { 49 return xrep_orphanage_try_create(sc); 50 } 51 52 /* 53 * Inodes that aren't the root directory or the orphanage, have a nonzero link 54 * count, and no observed parents should be moved to the orphanage. 55 */ 56 static inline bool 57 xrep_nlinks_is_orphaned( 58 struct xfs_scrub *sc, 59 struct xfs_inode *ip, 60 unsigned int actual_nlink, 61 const struct xchk_nlink *obs) 62 { 63 struct xfs_mount *mp = ip->i_mount; 64 65 if (obs->parents != 0) 66 return false; 67 if (ip == mp->m_rootip || ip == sc->orphanage) 68 return false; 69 return actual_nlink != 0; 70 } 71 72 /* Remove an inode from the unlinked list. */ 73 STATIC int 74 xrep_nlinks_iunlink_remove( 75 struct xfs_scrub *sc) 76 { 77 struct xfs_perag *pag; 78 int error; 79 80 pag = xfs_perag_get(sc->mp, XFS_INO_TO_AGNO(sc->mp, sc->ip->i_ino)); 81 error = xfs_iunlink_remove(sc->tp, pag, sc->ip); 82 xfs_perag_put(pag); 83 return error; 84 } 85 86 /* 87 * Correct the link count of the given inode. Because we have to grab locks 88 * and resources in a certain order, it's possible that this will be a no-op. 89 */ 90 STATIC int 91 xrep_nlinks_repair_inode( 92 struct xchk_nlink_ctrs *xnc) 93 { 94 struct xchk_nlink obs; 95 struct xfs_scrub *sc = xnc->sc; 96 struct xfs_mount *mp = sc->mp; 97 struct xfs_inode *ip = sc->ip; 98 uint64_t total_links; 99 uint64_t actual_nlink; 100 bool orphanage_available = false; 101 bool dirty = false; 102 int error; 103 104 /* 105 * Ignore temporary files being used to stage repairs, since we assume 106 * they're correct for non-directories, and the directory repair code 107 * doesn't bump the link counts for the children. 108 */ 109 if (xrep_is_tempfile(ip)) 110 return 0; 111 112 /* 113 * If the filesystem has an orphanage attached to the scrub context, 114 * prepare for a link count repair that could involve @ip being adopted 115 * by the lost+found. 116 */ 117 if (xrep_orphanage_can_adopt(sc)) { 118 error = xrep_orphanage_iolock_two(sc); 119 if (error) 120 return error; 121 122 error = xrep_adoption_trans_alloc(sc, &xnc->adoption); 123 if (error) { 124 xchk_iunlock(sc, XFS_IOLOCK_EXCL); 125 xrep_orphanage_iunlock(sc, XFS_IOLOCK_EXCL); 126 } else { 127 orphanage_available = true; 128 } 129 } 130 131 /* 132 * Either there is no orphanage or we couldn't allocate resources for 133 * that kind of update. Let's try again with only the resources we 134 * need for a simple link count update, since that's much more common. 135 */ 136 if (!orphanage_available) { 137 xchk_ilock(sc, XFS_IOLOCK_EXCL); 138 139 error = xfs_trans_alloc(mp, &M_RES(mp)->tr_link, 0, 0, 0, 140 &sc->tp); 141 if (error) { 142 xchk_iunlock(sc, XFS_IOLOCK_EXCL); 143 return error; 144 } 145 146 xchk_ilock(sc, XFS_ILOCK_EXCL); 147 xfs_trans_ijoin(sc->tp, ip, 0); 148 } 149 150 mutex_lock(&xnc->lock); 151 152 if (xchk_iscan_aborted(&xnc->collect_iscan)) { 153 error = -ECANCELED; 154 goto out_scanlock; 155 } 156 157 error = xfarray_load_sparse(xnc->nlinks, ip->i_ino, &obs); 158 if (error) 159 goto out_scanlock; 160 161 /* 162 * We're done accessing the shared scan data, so we can drop the lock. 163 * We still hold @ip's ILOCK, so its link count cannot change. 164 */ 165 mutex_unlock(&xnc->lock); 166 167 total_links = xchk_nlink_total(ip, &obs); 168 actual_nlink = VFS_I(ip)->i_nlink; 169 170 /* 171 * Non-directories cannot have directories pointing up to them. 172 * 173 * We previously set error to zero, but set it again because one static 174 * checker author fears that programmers will fail to maintain this 175 * invariant and built their tool to flag this as a security risk. A 176 * different tool author made their bot complain about the redundant 177 * store. This is a never-ending and stupid battle; both tools missed 178 * *actual bugs* elsewhere; and I no longer care. 179 */ 180 if (!S_ISDIR(VFS_I(ip)->i_mode) && obs.children != 0) { 181 trace_xrep_nlinks_unfixable_inode(mp, ip, &obs); 182 error = 0; 183 goto out_trans; 184 } 185 186 /* 187 * Decide if we're going to move this file to the orphanage, and fix 188 * up the incore link counts if we are. 189 */ 190 if (orphanage_available && 191 xrep_nlinks_is_orphaned(sc, ip, actual_nlink, &obs)) { 192 /* Figure out what name we're going to use here. */ 193 error = xrep_adoption_compute_name(&xnc->adoption, &xnc->xname); 194 if (error) 195 goto out_trans; 196 197 /* 198 * Reattach this file to the directory tree by moving it to 199 * the orphanage per the adoption parameters that we already 200 * computed. 201 */ 202 error = xrep_adoption_move(&xnc->adoption); 203 if (error) 204 goto out_trans; 205 206 /* 207 * Re-read the link counts since the reparenting will have 208 * updated our scan info. 209 */ 210 mutex_lock(&xnc->lock); 211 error = xfarray_load_sparse(xnc->nlinks, ip->i_ino, &obs); 212 mutex_unlock(&xnc->lock); 213 if (error) 214 goto out_trans; 215 216 total_links = xchk_nlink_total(ip, &obs); 217 actual_nlink = VFS_I(ip)->i_nlink; 218 dirty = true; 219 } 220 221 /* 222 * If this inode is linked from the directory tree and on the unlinked 223 * list, remove it from the unlinked list. 224 */ 225 if (total_links > 0 && xfs_inode_on_unlinked_list(ip)) { 226 error = xrep_nlinks_iunlink_remove(sc); 227 if (error) 228 goto out_trans; 229 dirty = true; 230 } 231 232 /* 233 * If this inode is not linked from the directory tree yet not on the 234 * unlinked list, put it on the unlinked list. 235 */ 236 if (total_links == 0 && !xfs_inode_on_unlinked_list(ip)) { 237 error = xfs_iunlink(sc->tp, ip); 238 if (error) 239 goto out_trans; 240 dirty = true; 241 } 242 243 /* Commit the new link count if it changed. */ 244 if (total_links != actual_nlink) { 245 trace_xrep_nlinks_update_inode(mp, ip, &obs); 246 247 set_nlink(VFS_I(ip), min_t(unsigned long long, total_links, 248 XFS_NLINK_PINNED)); 249 dirty = true; 250 } 251 252 if (!dirty) { 253 error = 0; 254 goto out_trans; 255 } 256 257 xfs_trans_log_inode(sc->tp, ip, XFS_ILOG_CORE); 258 259 error = xrep_trans_commit(sc); 260 goto out_unlock; 261 262 out_scanlock: 263 mutex_unlock(&xnc->lock); 264 out_trans: 265 xchk_trans_cancel(sc); 266 out_unlock: 267 xchk_iunlock(sc, XFS_ILOCK_EXCL); 268 if (orphanage_available) { 269 xrep_orphanage_iunlock(sc, XFS_ILOCK_EXCL); 270 xrep_orphanage_iunlock(sc, XFS_IOLOCK_EXCL); 271 } 272 xchk_iunlock(sc, XFS_IOLOCK_EXCL); 273 return error; 274 } 275 276 /* 277 * Try to visit every inode in the filesystem for repairs. Move on if we can't 278 * grab an inode, since we're still making forward progress. 279 */ 280 static int 281 xrep_nlinks_iter( 282 struct xchk_nlink_ctrs *xnc, 283 struct xfs_inode **ipp) 284 { 285 int error; 286 287 do { 288 error = xchk_iscan_iter(&xnc->compare_iscan, ipp); 289 } while (error == -EBUSY); 290 291 return error; 292 } 293 294 /* Commit the new inode link counters. */ 295 int 296 xrep_nlinks( 297 struct xfs_scrub *sc) 298 { 299 struct xchk_nlink_ctrs *xnc = sc->buf; 300 int error; 301 302 /* 303 * We need ftype for an accurate count of the number of child 304 * subdirectory links. Child subdirectories with a back link (dotdot 305 * entry) but no forward link are moved to the orphanage, so we cannot 306 * repair the link count of the parent directory based on the back link 307 * count alone. Filesystems without ftype support are rare (old V4) so 308 * we just skip out here. 309 */ 310 if (!xfs_has_ftype(sc->mp)) 311 return -EOPNOTSUPP; 312 313 /* 314 * Use the inobt to walk all allocated inodes to compare and fix the 315 * link counts. Retry iget every tenth of a second for up to 30 316 * seconds -- even if repair misses a few inodes, we still try to fix 317 * as many of them as we can. 318 */ 319 xchk_iscan_start(sc, 30000, 100, &xnc->compare_iscan); 320 ASSERT(sc->ip == NULL); 321 322 while ((error = xrep_nlinks_iter(xnc, &sc->ip)) == 1) { 323 /* 324 * Commit the scrub transaction so that we can create repair 325 * transactions with the correct reservations. 326 */ 327 xchk_trans_cancel(sc); 328 329 error = xrep_nlinks_repair_inode(xnc); 330 xchk_iscan_mark_visited(&xnc->compare_iscan, sc->ip); 331 xchk_irele(sc, sc->ip); 332 sc->ip = NULL; 333 if (error) 334 break; 335 336 if (xchk_should_terminate(sc, &error)) 337 break; 338 339 /* 340 * Create a new empty transaction so that we can advance the 341 * iscan cursor without deadlocking if the inobt has a cycle. 342 * We can only push the inactivation workqueues with an empty 343 * transaction. 344 */ 345 error = xchk_trans_alloc_empty(sc); 346 if (error) 347 break; 348 } 349 xchk_iscan_iter_finish(&xnc->compare_iscan); 350 xchk_iscan_teardown(&xnc->compare_iscan); 351 352 return error; 353 } 354