1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) 2021-2024 Oracle. All Rights Reserved.
4 * Author: Darrick J. Wong <djwong@kernel.org>
5 */
6 #include "xfs.h"
7 #include "xfs_fs.h"
8 #include "xfs_shared.h"
9 #include "xfs_format.h"
10 #include "xfs_trans_resv.h"
11 #include "xfs_mount.h"
12 #include "xfs_log_format.h"
13 #include "xfs_trans.h"
14 #include "xfs_inode.h"
15 #include "xfs_icache.h"
16 #include "xfs_bmap_util.h"
17 #include "xfs_iwalk.h"
18 #include "xfs_ialloc.h"
19 #include "xfs_sb.h"
20 #include "xfs_ag.h"
21 #include "xfs_dir2.h"
22 #include "xfs_parent.h"
23 #include "scrub/scrub.h"
24 #include "scrub/common.h"
25 #include "scrub/repair.h"
26 #include "scrub/xfile.h"
27 #include "scrub/xfarray.h"
28 #include "scrub/iscan.h"
29 #include "scrub/orphanage.h"
30 #include "scrub/nlinks.h"
31 #include "scrub/trace.h"
32 #include "scrub/tempfile.h"
33
34 /*
35 * Live Inode Link Count Repair
36 * ============================
37 *
38 * Use the live inode link count information that we collected to replace the
39 * nlink values of the incore inodes. A scrub->repair cycle should have left
40 * the live data and hooks active, so this is safe so long as we make sure the
41 * inode is locked.
42 */
43
44 /* Set up to repair inode link counts. */
45 int
46 xrep_setup_nlinks(
47 struct xfs_scrub *sc)
48 {
49 return xrep_orphanage_try_create(sc);
50 }
51
52 /*
53 * Inodes that aren't the root directory or the orphanage, have a nonzero link
54 * count, and no observed parents should be moved to the orphanage.
55 */
56 static inline bool
57 xrep_nlinks_is_orphaned(
58 struct xfs_scrub *sc,
59 struct xfs_inode *ip,
60 unsigned int actual_nlink,
61 const struct xchk_nlink *obs)
62 {
63 struct xfs_mount *mp = ip->i_mount;
64
65 if (obs->parents != 0)
66 return false;
67 if (ip == mp->m_rootip || ip == sc->orphanage)
68 return false;
69 return actual_nlink != 0;
70 }
71
72 /* Remove an inode from the unlinked list. */
73 STATIC int
74 xrep_nlinks_iunlink_remove(
75 struct xfs_scrub *sc)
76 {
77 struct xfs_perag *pag;
78 int error;
79
80 pag = xfs_perag_get(sc->mp, XFS_INO_TO_AGNO(sc->mp, sc->ip->i_ino));
81 error = xfs_iunlink_remove(sc->tp, pag, sc->ip);
82 xfs_perag_put(pag);
83 return error;
84 }
85
86 /*
87 * Correct the link count of the given inode. Because we have to grab locks
88 * and resources in a certain order, it's possible that this will be a no-op.
89 */
90 STATIC int
91 xrep_nlinks_repair_inode(
92 struct xchk_nlink_ctrs *xnc)
93 {
94 struct xchk_nlink obs;
95 struct xfs_scrub *sc = xnc->sc;
96 struct xfs_mount *mp = sc->mp;
97 struct xfs_inode *ip = sc->ip;
98 uint64_t total_links;
99 uint64_t actual_nlink;
100 bool orphanage_available = false;
101 bool dirty = false;
102 int error;
103
104 /*
105 * Ignore temporary files being used to stage repairs, since we assume
106 * they're correct for non-directories, and the directory repair code
107 * doesn't bump the link counts for the children.
108 */
109 if (xrep_is_tempfile(ip))
110 return 0;
111
112 /*
113 * If the filesystem has an orphanage attached to the scrub context,
114 * prepare for a link count repair that could involve @ip being adopted
115 * by the lost+found.
116 */
117 if (xrep_orphanage_can_adopt(sc)) {
118 error = xrep_orphanage_iolock_two(sc);
119 if (error)
120 return error;
121
122 error = xrep_adoption_trans_alloc(sc, &xnc->adoption);
123 if (error) {
124 xchk_iunlock(sc, XFS_IOLOCK_EXCL);
125 xrep_orphanage_iunlock(sc, XFS_IOLOCK_EXCL);
126 } else {
127 orphanage_available = true;
128 }
129 }
130
131 /*
132 * Either there is no orphanage or we couldn't allocate resources for
133 * that kind of update. Let's try again with only the resources we
134 * need for a simple link count update, since that's much more common.
135 */
136 if (!orphanage_available) {
137 xchk_ilock(sc, XFS_IOLOCK_EXCL);
138
139 error = xfs_trans_alloc(mp, &M_RES(mp)->tr_link, 0, 0, 0,
140 &sc->tp);
141 if (error) {
142 xchk_iunlock(sc, XFS_IOLOCK_EXCL);
143 return error;
144 }
145
146 xchk_ilock(sc, XFS_ILOCK_EXCL);
147 xfs_trans_ijoin(sc->tp, ip, 0);
148 }
149
150 mutex_lock(&xnc->lock);
151
152 if (xchk_iscan_aborted(&xnc->collect_iscan)) {
153 error = -ECANCELED;
154 goto out_scanlock;
155 }
156
157 error = xfarray_load_sparse(xnc->nlinks, ip->i_ino, &obs);
158 if (error)
159 goto out_scanlock;
160
161 /*
162 * We're done accessing the shared scan data, so we can drop the lock.
163 * We still hold @ip's ILOCK, so its link count cannot change.
164 */
165 mutex_unlock(&xnc->lock);
166
167 total_links = xchk_nlink_total(ip, &obs);
168 actual_nlink = VFS_I(ip)->i_nlink;
169
170 /*
171 * Non-directories cannot have directories pointing up to them.
172 *
173 * We previously set error to zero, but set it again because one static
174 * checker author fears that programmers will fail to maintain this
175 * invariant and built their tool to flag this as a security risk. A
176 * different tool author made their bot complain about the redundant
177 * store. This is a never-ending and stupid battle; both tools missed
178 * *actual bugs* elsewhere; and I no longer care.
179 */
180 if (!S_ISDIR(VFS_I(ip)->i_mode) && obs.children != 0) {
181 trace_xrep_nlinks_unfixable_inode(mp, ip, &obs);
182 error = 0;
183 goto out_trans;
184 }
185
186 /*
187 * Decide if we're going to move this file to the orphanage, and fix
188 * up the incore link counts if we are.
189 */
190 if (orphanage_available &&
191 xrep_nlinks_is_orphaned(sc, ip, actual_nlink, &obs)) {
192 /* Figure out what name we're going to use here. */
193 error = xrep_adoption_compute_name(&xnc->adoption, &xnc->xname);
194 if (error)
195 goto out_trans;
196
197 /*
198 * Reattach this file to the directory tree by moving it to
199 * the orphanage per the adoption parameters that we already
200 * computed.
201 */
202 error = xrep_adoption_move(&xnc->adoption);
203 if (error)
204 goto out_trans;
205
206 /*
207 * Re-read the link counts since the reparenting will have
208 * updated our scan info.
209 */
210 mutex_lock(&xnc->lock);
211 error = xfarray_load_sparse(xnc->nlinks, ip->i_ino, &obs);
212 mutex_unlock(&xnc->lock);
213 if (error)
214 goto out_trans;
215
216 total_links = xchk_nlink_total(ip, &obs);
217 actual_nlink = VFS_I(ip)->i_nlink;
218 dirty = true;
219 }
220
221 /*
222 * If this inode is linked from the directory tree and on the unlinked
223 * list, remove it from the unlinked list.
224 */
225 if (total_links > 0 && xfs_inode_on_unlinked_list(ip)) {
226 error = xrep_nlinks_iunlink_remove(sc);
227 if (error)
228 goto out_trans;
229 dirty = true;
230 }
231
232 /*
233 * If this inode is not linked from the directory tree yet not on the
234 * unlinked list, put it on the unlinked list.
235 */
236 if (total_links == 0 && !xfs_inode_on_unlinked_list(ip)) {
237 error = xfs_iunlink(sc->tp, ip);
238 if (error)
239 goto out_trans;
240 dirty = true;
241 }
242
243 /* Commit the new link count if it changed. */
244 if (total_links != actual_nlink) {
245 trace_xrep_nlinks_update_inode(mp, ip, &obs);
246
247 set_nlink(VFS_I(ip), min_t(unsigned long long, total_links,
248 XFS_NLINK_PINNED));
249 dirty = true;
250 }
251
252 if (!dirty) {
253 error = 0;
254 goto out_trans;
255 }
256
257 xfs_trans_log_inode(sc->tp, ip, XFS_ILOG_CORE);
258
259 error = xrep_trans_commit(sc);
260 goto out_unlock;
261
262 out_scanlock:
263 mutex_unlock(&xnc->lock);
264 out_trans:
265 xchk_trans_cancel(sc);
266 out_unlock:
267 xchk_iunlock(sc, XFS_ILOCK_EXCL);
268 if (orphanage_available) {
269 xrep_orphanage_iunlock(sc, XFS_ILOCK_EXCL);
270 xrep_orphanage_iunlock(sc, XFS_IOLOCK_EXCL);
271 }
272 xchk_iunlock(sc, XFS_IOLOCK_EXCL);
273 return error;
274 }
275
276 /*
277 * Try to visit every inode in the filesystem for repairs. Move on if we can't
278 * grab an inode, since we're still making forward progress.
279 */
280 static int
281 xrep_nlinks_iter(
282 struct xchk_nlink_ctrs *xnc,
283 struct xfs_inode **ipp)
284 {
285 int error;
286
287 do {
288 error = xchk_iscan_iter(&xnc->compare_iscan, ipp);
289 } while (error == -EBUSY);
290
291 return error;
292 }
293
294 /* Commit the new inode link counters. */
295 int
296 xrep_nlinks(
297 struct xfs_scrub *sc)
298 {
299 struct xchk_nlink_ctrs *xnc = sc->buf;
300 int error;
301
302 /*
303 * We need ftype for an accurate count of the number of child
304 * subdirectory links. Child subdirectories with a back link (dotdot
305 * entry) but no forward link are moved to the orphanage, so we cannot
306 * repair the link count of the parent directory based on the back link
307 * count alone. Filesystems without ftype support are rare (old V4) so
308 * we just skip out here.
309 */
310 if (!xfs_has_ftype(sc->mp))
311 return -EOPNOTSUPP;
312
313 /*
314 * Use the inobt to walk all allocated inodes to compare and fix the
315 * link counts. Retry iget every tenth of a second for up to 30
316 * seconds -- even if repair misses a few inodes, we still try to fix
317 * as many of them as we can.
318 */
319 xchk_iscan_start(sc, 30000, 100, &xnc->compare_iscan);
320 ASSERT(sc->ip == NULL);
321
322 while ((error = xrep_nlinks_iter(xnc, &sc->ip)) == 1) {
323 /*
324 * Commit the scrub transaction so that we can create repair
325 * transactions with the correct reservations.
326 */
327 xchk_trans_cancel(sc);
328
329 error = xrep_nlinks_repair_inode(xnc);
330 xchk_iscan_mark_visited(&xnc->compare_iscan, sc->ip);
331 xchk_irele(sc, sc->ip);
332 sc->ip = NULL;
333 if (error)
334 break;
335
336 if (xchk_should_terminate(sc, &error))
337 break;
338
339 /*
340 * Create a new empty transaction so that we can advance the
341 * iscan cursor without deadlocking if the inobt has a cycle.
342 * We can only push the inactivation workqueues with an empty
343 * transaction.
344 */
345 error = xchk_trans_alloc_empty(sc);
346 if (error)
347 break;
348 }
349 xchk_iscan_iter_finish(&xnc->compare_iscan);
350 xchk_iscan_teardown(&xnc->compare_iscan);
351
352 return error;
353 }
354
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.