1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3  * Copyright (C) 2017 Oracle.  All Rights Reserved.
4  * Author: Darrick J. Wong <darrick.wong@oracle.com>
5  */
6 #include "xfs.h"
7 #include "xfs_fs.h"
8 #include "xfs_shared.h"
9 #include "xfs_format.h"
10 #include "xfs_trans_resv.h"
11 #include "xfs_mount.h"
12 #include "xfs_defer.h"
13 #include "xfs_btree.h"
14 #include "xfs_bit.h"
15 #include "xfs_log_format.h"
16 #include "xfs_trans.h"
17 #include "xfs_sb.h"
18 #include "xfs_inode.h"
19 #include "xfs_icache.h"
20 #include "xfs_dir2.h"
21 #include "xfs_dir2_priv.h"
22 #include "xfs_ialloc.h"
23 #include "scrub/xfs_scrub.h"
24 #include "scrub/scrub.h"
25 #include "scrub/common.h"
26 #include "scrub/trace.h"
27 
28 /* Set us up to scrub parents. */
29 int
xchk_setup_parent(struct xfs_scrub * sc,struct xfs_inode * ip)30 xchk_setup_parent(
31 	struct xfs_scrub	*sc,
32 	struct xfs_inode	*ip)
33 {
34 	return xchk_setup_inode_contents(sc, ip, 0);
35 }
36 
37 /* Parent pointers */
38 
39 /* Look for an entry in a parent pointing to this inode. */
40 
41 struct xchk_parent_ctx {
42 	struct dir_context	dc;
43 	xfs_ino_t		ino;
44 	xfs_nlink_t		nlink;
45 };
46 
47 /* Look for a single entry in a directory pointing to an inode. */
48 STATIC int
xchk_parent_actor(struct dir_context * dc,const char * name,int namelen,loff_t pos,u64 ino,unsigned type)49 xchk_parent_actor(
50 	struct dir_context	*dc,
51 	const char		*name,
52 	int			namelen,
53 	loff_t			pos,
54 	u64			ino,
55 	unsigned		type)
56 {
57 	struct xchk_parent_ctx	*spc;
58 
59 	spc = container_of(dc, struct xchk_parent_ctx, dc);
60 	if (spc->ino == ino)
61 		spc->nlink++;
62 	return 0;
63 }
64 
65 /* Count the number of dentries in the parent dir that point to this inode. */
66 STATIC int
xchk_parent_count_parent_dentries(struct xfs_scrub * sc,struct xfs_inode * parent,xfs_nlink_t * nlink)67 xchk_parent_count_parent_dentries(
68 	struct xfs_scrub	*sc,
69 	struct xfs_inode	*parent,
70 	xfs_nlink_t		*nlink)
71 {
72 	struct xchk_parent_ctx	spc = {
73 		.dc.actor = xchk_parent_actor,
74 		.dc.pos = 0,
75 		.ino = sc->ip->i_ino,
76 		.nlink = 0,
77 	};
78 	size_t			bufsize;
79 	loff_t			oldpos;
80 	uint			lock_mode;
81 	int			error = 0;
82 
83 	/*
84 	 * If there are any blocks, read-ahead block 0 as we're almost
85 	 * certain to have the next operation be a read there.  This is
86 	 * how we guarantee that the parent's extent map has been loaded,
87 	 * if there is one.
88 	 */
89 	lock_mode = xfs_ilock_data_map_shared(parent);
90 	if (parent->i_d.di_nextents > 0)
91 		error = xfs_dir3_data_readahead(parent, 0, -1);
92 	xfs_iunlock(parent, lock_mode);
93 	if (error)
94 		return error;
95 
96 	/*
97 	 * Iterate the parent dir to confirm that there is
98 	 * exactly one entry pointing back to the inode being
99 	 * scanned.
100 	 */
101 	bufsize = (size_t)min_t(loff_t, XFS_READDIR_BUFSIZE,
102 			parent->i_d.di_size);
103 	oldpos = 0;
104 	while (true) {
105 		error = xfs_readdir(sc->tp, parent, &spc.dc, bufsize);
106 		if (error)
107 			goto out;
108 		if (oldpos == spc.dc.pos)
109 			break;
110 		oldpos = spc.dc.pos;
111 	}
112 	*nlink = spc.nlink;
113 out:
114 	return error;
115 }
116 
117 /*
118  * Given the inode number of the alleged parent of the inode being
119  * scrubbed, try to validate that the parent has exactly one directory
120  * entry pointing back to the inode being scrubbed.
121  */
122 STATIC int
xchk_parent_validate(struct xfs_scrub * sc,xfs_ino_t dnum,bool * try_again)123 xchk_parent_validate(
124 	struct xfs_scrub	*sc,
125 	xfs_ino_t		dnum,
126 	bool			*try_again)
127 {
128 	struct xfs_mount	*mp = sc->mp;
129 	struct xfs_inode	*dp = NULL;
130 	xfs_nlink_t		expected_nlink;
131 	xfs_nlink_t		nlink;
132 	int			error = 0;
133 
134 	*try_again = false;
135 
136 	if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
137 		goto out;
138 
139 	/* '..' must not point to ourselves. */
140 	if (sc->ip->i_ino == dnum) {
141 		xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
142 		goto out;
143 	}
144 
145 	/*
146 	 * If we're an unlinked directory, the parent /won't/ have a link
147 	 * to us.  Otherwise, it should have one link.
148 	 */
149 	expected_nlink = VFS_I(sc->ip)->i_nlink == 0 ? 0 : 1;
150 
151 	/*
152 	 * Grab this parent inode.  We release the inode before we
153 	 * cancel the scrub transaction.  Since we're don't know a
154 	 * priori that releasing the inode won't trigger eofblocks
155 	 * cleanup (which allocates what would be a nested transaction)
156 	 * if the parent pointer erroneously points to a file, we
157 	 * can't use DONTCACHE here because DONTCACHE inodes can trigger
158 	 * immediate inactive cleanup of the inode.
159 	 *
160 	 * If _iget returns -EINVAL then the parent inode number is garbage
161 	 * and the directory is corrupt.  If the _iget returns -EFSCORRUPTED
162 	 * or -EFSBADCRC then the parent is corrupt which is a cross
163 	 * referencing error.  Any other error is an operational error.
164 	 */
165 	error = xfs_iget(mp, sc->tp, dnum, XFS_IGET_UNTRUSTED, 0, &dp);
166 	if (error == -EINVAL) {
167 		error = -EFSCORRUPTED;
168 		xchk_fblock_process_error(sc, XFS_DATA_FORK, 0, &error);
169 		goto out;
170 	}
171 	if (!xchk_fblock_xref_process_error(sc, XFS_DATA_FORK, 0, &error))
172 		goto out;
173 	if (dp == sc->ip || !S_ISDIR(VFS_I(dp)->i_mode)) {
174 		xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
175 		goto out_rele;
176 	}
177 
178 	/*
179 	 * We prefer to keep the inode locked while we lock and search
180 	 * its alleged parent for a forward reference.  If we can grab
181 	 * the iolock, validate the pointers and we're done.  We must
182 	 * use nowait here to avoid an ABBA deadlock on the parent and
183 	 * the child inodes.
184 	 */
185 	if (xfs_ilock_nowait(dp, XFS_IOLOCK_SHARED)) {
186 		error = xchk_parent_count_parent_dentries(sc, dp, &nlink);
187 		if (!xchk_fblock_xref_process_error(sc, XFS_DATA_FORK, 0,
188 				&error))
189 			goto out_unlock;
190 		if (nlink != expected_nlink)
191 			xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
192 		goto out_unlock;
193 	}
194 
195 	/*
196 	 * The game changes if we get here.  We failed to lock the parent,
197 	 * so we're going to try to verify both pointers while only holding
198 	 * one lock so as to avoid deadlocking with something that's actually
199 	 * trying to traverse down the directory tree.
200 	 */
201 	xfs_iunlock(sc->ip, sc->ilock_flags);
202 	sc->ilock_flags = 0;
203 	error = xchk_ilock_inverted(dp, XFS_IOLOCK_SHARED);
204 	if (error)
205 		goto out_rele;
206 
207 	/* Go looking for our dentry. */
208 	error = xchk_parent_count_parent_dentries(sc, dp, &nlink);
209 	if (!xchk_fblock_xref_process_error(sc, XFS_DATA_FORK, 0, &error))
210 		goto out_unlock;
211 
212 	/* Drop the parent lock, relock this inode. */
213 	xfs_iunlock(dp, XFS_IOLOCK_SHARED);
214 	error = xchk_ilock_inverted(sc->ip, XFS_IOLOCK_EXCL);
215 	if (error)
216 		goto out_rele;
217 	sc->ilock_flags = XFS_IOLOCK_EXCL;
218 
219 	/*
220 	 * If we're an unlinked directory, the parent /won't/ have a link
221 	 * to us.  Otherwise, it should have one link.  We have to re-set
222 	 * it here because we dropped the lock on sc->ip.
223 	 */
224 	expected_nlink = VFS_I(sc->ip)->i_nlink == 0 ? 0 : 1;
225 
226 	/* Look up '..' to see if the inode changed. */
227 	error = xfs_dir_lookup(sc->tp, sc->ip, &xfs_name_dotdot, &dnum, NULL);
228 	if (!xchk_fblock_process_error(sc, XFS_DATA_FORK, 0, &error))
229 		goto out_rele;
230 
231 	/* Drat, parent changed.  Try again! */
232 	if (dnum != dp->i_ino) {
233 		xfs_irele(dp);
234 		*try_again = true;
235 		return 0;
236 	}
237 	xfs_irele(dp);
238 
239 	/*
240 	 * '..' didn't change, so check that there was only one entry
241 	 * for us in the parent.
242 	 */
243 	if (nlink != expected_nlink)
244 		xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
245 	return error;
246 
247 out_unlock:
248 	xfs_iunlock(dp, XFS_IOLOCK_SHARED);
249 out_rele:
250 	xfs_irele(dp);
251 out:
252 	return error;
253 }
254 
255 /* Scrub a parent pointer. */
256 int
xchk_parent(struct xfs_scrub * sc)257 xchk_parent(
258 	struct xfs_scrub	*sc)
259 {
260 	struct xfs_mount	*mp = sc->mp;
261 	xfs_ino_t		dnum;
262 	bool			try_again;
263 	int			tries = 0;
264 	int			error = 0;
265 
266 	/*
267 	 * If we're a directory, check that the '..' link points up to
268 	 * a directory that has one entry pointing to us.
269 	 */
270 	if (!S_ISDIR(VFS_I(sc->ip)->i_mode))
271 		return -ENOENT;
272 
273 	/* We're not a special inode, are we? */
274 	if (!xfs_verify_dir_ino(mp, sc->ip->i_ino)) {
275 		xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
276 		goto out;
277 	}
278 
279 	/*
280 	 * The VFS grabs a read or write lock via i_rwsem before it reads
281 	 * or writes to a directory.  If we've gotten this far we've
282 	 * already obtained IOLOCK_EXCL, which (since 4.10) is the same as
283 	 * getting a write lock on i_rwsem.  Therefore, it is safe for us
284 	 * to drop the ILOCK here in order to do directory lookups.
285 	 */
286 	sc->ilock_flags &= ~(XFS_ILOCK_EXCL | XFS_MMAPLOCK_EXCL);
287 	xfs_iunlock(sc->ip, XFS_ILOCK_EXCL | XFS_MMAPLOCK_EXCL);
288 
289 	/* Look up '..' */
290 	error = xfs_dir_lookup(sc->tp, sc->ip, &xfs_name_dotdot, &dnum, NULL);
291 	if (!xchk_fblock_process_error(sc, XFS_DATA_FORK, 0, &error))
292 		goto out;
293 	if (!xfs_verify_dir_ino(mp, dnum)) {
294 		xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
295 		goto out;
296 	}
297 
298 	/* Is this the root dir?  Then '..' must point to itself. */
299 	if (sc->ip == mp->m_rootip) {
300 		if (sc->ip->i_ino != mp->m_sb.sb_rootino ||
301 		    sc->ip->i_ino != dnum)
302 			xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
303 		goto out;
304 	}
305 
306 	do {
307 		error = xchk_parent_validate(sc, dnum, &try_again);
308 		if (error)
309 			goto out;
310 	} while (try_again && ++tries < 20);
311 
312 	/*
313 	 * We gave it our best shot but failed, so mark this scrub
314 	 * incomplete.  Userspace can decide if it wants to try again.
315 	 */
316 	if (try_again && tries == 20)
317 		xchk_set_incomplete(sc);
318 out:
319 	/*
320 	 * If we failed to lock the parent inode even after a retry, just mark
321 	 * this scrub incomplete and return.
322 	 */
323 	if (sc->try_harder && error == -EDEADLOCK) {
324 		error = 0;
325 		xchk_set_incomplete(sc);
326 	}
327 	return error;
328 }
329