1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Copyright (c) 2021-2024 Oracle. All Rights Reserved. 4 * Author: Darrick J. Wong <djwong@kernel.org> 5 */ 6 #include "xfs.h" 7 #include "xfs_fs.h" 8 #include "xfs_shared.h" 9 #include "xfs_format.h" 10 #include "xfs_trans_resv.h" 11 #include "xfs_mount.h" 12 #include "xfs_log_format.h" 13 #include "xfs_trans.h" 14 #include "xfs_inode.h" 15 #include "xfs_icache.h" 16 #include "xfs_bmap_util.h" 17 #include "xfs_iwalk.h" 18 #include "xfs_ialloc.h" 19 #include "xfs_sb.h" 20 #include "xfs_ag.h" 21 #include "scrub/scrub.h" 22 #include "scrub/common.h" 23 #include "scrub/repair.h" 24 #include "scrub/xfile.h" 25 #include "scrub/xfarray.h" 26 #include "scrub/iscan.h" 27 #include "scrub/orphanage.h" 28 #include "scrub/nlinks.h" 29 #include "scrub/trace.h" 30 #include "scrub/tempfile.h" 31 32 /* 33 * Live Inode Link Count Repair 34 * ============================ 35 * 36 * Use the live inode link count information that we collected to replace the 37 * nlink values of the incore inodes. A scrub->repair cycle should have left 38 * the live data and hooks active, so this is safe so long as we make sure the 39 * inode is locked. 40 */ 41 42 /* Set up to repair inode link counts. */ 43 int 44 xrep_setup_nlinks( 45 struct xfs_scrub *sc) 46 { 47 return xrep_orphanage_try_create(sc); 48 } 49 50 /* 51 * Inodes that aren't the root directory or the orphanage, have a nonzero link 52 * count, and no observed parents should be moved to the orphanage. 53 */ 54 static inline bool 55 xrep_nlinks_is_orphaned( 56 struct xfs_scrub *sc, 57 struct xfs_inode *ip, 58 unsigned int actual_nlink, 59 const struct xchk_nlink *obs) 60 { 61 struct xfs_mount *mp = ip->i_mount; 62 63 if (obs->parents != 0) 64 return false; 65 if (ip == mp->m_rootip || ip == sc->orphanage) 66 return false; 67 return actual_nlink != 0; 68 } 69 70 /* Remove an inode from the unlinked list. */ 71 STATIC int 72 xrep_nlinks_iunlink_remove( 73 struct xfs_scrub *sc) 74 { 75 struct xfs_perag *pag; 76 int error; 77 78 pag = xfs_perag_get(sc->mp, XFS_INO_TO_AGNO(sc->mp, sc->ip->i_ino)); 79 error = xfs_iunlink_remove(sc->tp, pag, sc->ip); 80 xfs_perag_put(pag); 81 return error; 82 } 83 84 /* 85 * Correct the link count of the given inode. Because we have to grab locks 86 * and resources in a certain order, it's possible that this will be a no-op. 87 */ 88 STATIC int 89 xrep_nlinks_repair_inode( 90 struct xchk_nlink_ctrs *xnc) 91 { 92 struct xchk_nlink obs; 93 struct xfs_scrub *sc = xnc->sc; 94 struct xfs_mount *mp = sc->mp; 95 struct xfs_inode *ip = sc->ip; 96 uint64_t total_links; 97 uint64_t actual_nlink; 98 bool orphanage_available = false; 99 bool dirty = false; 100 int error; 101 102 /* 103 * Ignore temporary files being used to stage repairs, since we assume 104 * they're correct for non-directories, and the directory repair code 105 * doesn't bump the link counts for the children. 106 */ 107 if (xrep_is_tempfile(ip)) 108 return 0; 109 110 /* 111 * If the filesystem has an orphanage attached to the scrub context, 112 * prepare for a link count repair that could involve @ip being adopted 113 * by the lost+found. 114 */ 115 if (xrep_orphanage_can_adopt(sc)) { 116 error = xrep_orphanage_iolock_two(sc); 117 if (error) 118 return error; 119 120 error = xrep_adoption_trans_alloc(sc, &xnc->adoption); 121 if (error) { 122 xchk_iunlock(sc, XFS_IOLOCK_EXCL); 123 xrep_orphanage_iunlock(sc, XFS_IOLOCK_EXCL); 124 } else { 125 orphanage_available = true; 126 } 127 } 128 129 /* 130 * Either there is no orphanage or we couldn't allocate resources for 131 * that kind of update. Let's try again with only the resources we 132 * need for a simple link count update, since that's much more common. 133 */ 134 if (!orphanage_available) { 135 xchk_ilock(sc, XFS_IOLOCK_EXCL); 136 137 error = xfs_trans_alloc(mp, &M_RES(mp)->tr_link, 0, 0, 0, 138 &sc->tp); 139 if (error) 140 return error; 141 142 xchk_ilock(sc, XFS_ILOCK_EXCL); 143 xfs_trans_ijoin(sc->tp, ip, 0); 144 } 145 146 mutex_lock(&xnc->lock); 147 148 if (xchk_iscan_aborted(&xnc->collect_iscan)) { 149 error = -ECANCELED; 150 goto out_scanlock; 151 } 152 153 error = xfarray_load_sparse(xnc->nlinks, ip->i_ino, &obs); 154 if (error) 155 goto out_scanlock; 156 157 /* 158 * We're done accessing the shared scan data, so we can drop the lock. 159 * We still hold @ip's ILOCK, so its link count cannot change. 160 */ 161 mutex_unlock(&xnc->lock); 162 163 total_links = xchk_nlink_total(ip, &obs); 164 actual_nlink = VFS_I(ip)->i_nlink; 165 166 /* 167 * Non-directories cannot have directories pointing up to them. 168 * 169 * We previously set error to zero, but set it again because one static 170 * checker author fears that programmers will fail to maintain this 171 * invariant and built their tool to flag this as a security risk. A 172 * different tool author made their bot complain about the redundant 173 * store. This is a never-ending and stupid battle; both tools missed 174 * *actual bugs* elsewhere; and I no longer care. 175 */ 176 if (!S_ISDIR(VFS_I(ip)->i_mode) && obs.children != 0) { 177 trace_xrep_nlinks_unfixable_inode(mp, ip, &obs); 178 error = 0; 179 goto out_trans; 180 } 181 182 /* 183 * Decide if we're going to move this file to the orphanage, and fix 184 * up the incore link counts if we are. 185 */ 186 if (orphanage_available && 187 xrep_nlinks_is_orphaned(sc, ip, actual_nlink, &obs)) { 188 /* Figure out what name we're going to use here. */ 189 error = xrep_adoption_compute_name(&xnc->adoption, &xnc->xname); 190 if (error) 191 goto out_trans; 192 193 /* 194 * Reattach this file to the directory tree by moving it to 195 * the orphanage per the adoption parameters that we already 196 * computed. 197 */ 198 error = xrep_adoption_move(&xnc->adoption); 199 if (error) 200 goto out_trans; 201 202 /* 203 * Re-read the link counts since the reparenting will have 204 * updated our scan info. 205 */ 206 mutex_lock(&xnc->lock); 207 error = xfarray_load_sparse(xnc->nlinks, ip->i_ino, &obs); 208 mutex_unlock(&xnc->lock); 209 if (error) 210 goto out_trans; 211 212 total_links = xchk_nlink_total(ip, &obs); 213 actual_nlink = VFS_I(ip)->i_nlink; 214 dirty = true; 215 } 216 217 /* 218 * If this inode is linked from the directory tree and on the unlinked 219 * list, remove it from the unlinked list. 220 */ 221 if (total_links > 0 && xfs_inode_on_unlinked_list(ip)) { 222 error = xrep_nlinks_iunlink_remove(sc); 223 if (error) 224 goto out_trans; 225 dirty = true; 226 } 227 228 /* 229 * If this inode is not linked from the directory tree yet not on the 230 * unlinked list, put it on the unlinked list. 231 */ 232 if (total_links == 0 && !xfs_inode_on_unlinked_list(ip)) { 233 error = xfs_iunlink(sc->tp, ip); 234 if (error) 235 goto out_trans; 236 dirty = true; 237 } 238 239 /* Commit the new link count if it changed. */ 240 if (total_links != actual_nlink) { 241 trace_xrep_nlinks_update_inode(mp, ip, &obs); 242 243 set_nlink(VFS_I(ip), min_t(unsigned long long, total_links, 244 XFS_NLINK_PINNED)); 245 dirty = true; 246 } 247 248 if (!dirty) { 249 error = 0; 250 goto out_trans; 251 } 252 253 xfs_trans_log_inode(sc->tp, ip, XFS_ILOG_CORE); 254 255 error = xrep_trans_commit(sc); 256 goto out_unlock; 257 258 out_scanlock: 259 mutex_unlock(&xnc->lock); 260 out_trans: 261 xchk_trans_cancel(sc); 262 out_unlock: 263 xchk_iunlock(sc, XFS_ILOCK_EXCL); 264 if (orphanage_available) { 265 xrep_orphanage_iunlock(sc, XFS_ILOCK_EXCL); 266 xrep_orphanage_iunlock(sc, XFS_IOLOCK_EXCL); 267 } 268 xchk_iunlock(sc, XFS_IOLOCK_EXCL); 269 return error; 270 } 271 272 /* 273 * Try to visit every inode in the filesystem for repairs. Move on if we can't 274 * grab an inode, since we're still making forward progress. 275 */ 276 static int 277 xrep_nlinks_iter( 278 struct xchk_nlink_ctrs *xnc, 279 struct xfs_inode **ipp) 280 { 281 int error; 282 283 do { 284 error = xchk_iscan_iter(&xnc->compare_iscan, ipp); 285 } while (error == -EBUSY); 286 287 return error; 288 } 289 290 /* Commit the new inode link counters. */ 291 int 292 xrep_nlinks( 293 struct xfs_scrub *sc) 294 { 295 struct xchk_nlink_ctrs *xnc = sc->buf; 296 int error; 297 298 /* 299 * We need ftype for an accurate count of the number of child 300 * subdirectory links. Child subdirectories with a back link (dotdot 301 * entry) but no forward link are moved to the orphanage, so we cannot 302 * repair the link count of the parent directory based on the back link 303 * count alone. Filesystems without ftype support are rare (old V4) so 304 * we just skip out here. 305 */ 306 if (!xfs_has_ftype(sc->mp)) 307 return -EOPNOTSUPP; 308 309 /* 310 * Use the inobt to walk all allocated inodes to compare and fix the 311 * link counts. Retry iget every tenth of a second for up to 30 312 * seconds -- even if repair misses a few inodes, we still try to fix 313 * as many of them as we can. 314 */ 315 xchk_iscan_start(sc, 30000, 100, &xnc->compare_iscan); 316 ASSERT(sc->ip == NULL); 317 318 while ((error = xrep_nlinks_iter(xnc, &sc->ip)) == 1) { 319 /* 320 * Commit the scrub transaction so that we can create repair 321 * transactions with the correct reservations. 322 */ 323 xchk_trans_cancel(sc); 324 325 error = xrep_nlinks_repair_inode(xnc); 326 xchk_iscan_mark_visited(&xnc->compare_iscan, sc->ip); 327 xchk_irele(sc, sc->ip); 328 sc->ip = NULL; 329 if (error) 330 break; 331 332 if (xchk_should_terminate(sc, &error)) 333 break; 334 335 /* 336 * Create a new empty transaction so that we can advance the 337 * iscan cursor without deadlocking if the inobt has a cycle. 338 * We can only push the inactivation workqueues with an empty 339 * transaction. 340 */ 341 error = xchk_trans_alloc_empty(sc); 342 if (error) 343 break; 344 } 345 xchk_iscan_iter_finish(&xnc->compare_iscan); 346 xchk_iscan_teardown(&xnc->compare_iscan); 347 348 return error; 349 } 350