1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * Copyright (c) 2021-2024 Oracle.  All Rights Reserved.
4 * Author: Darrick J. Wong <djwong@kernel.org>
5 */
6#include "xfs.h"
7#include "xfs_fs.h"
8#include "xfs_shared.h"
9#include "xfs_format.h"
10#include "xfs_trans_resv.h"
11#include "xfs_mount.h"
12#include "xfs_log_format.h"
13#include "xfs_trans.h"
14#include "xfs_inode.h"
15#include "xfs_icache.h"
16#include "xfs_bmap_util.h"
17#include "xfs_iwalk.h"
18#include "xfs_ialloc.h"
19#include "xfs_sb.h"
20#include "xfs_ag.h"
21#include "xfs_dir2.h"
22#include "xfs_parent.h"
23#include "scrub/scrub.h"
24#include "scrub/common.h"
25#include "scrub/repair.h"
26#include "scrub/xfile.h"
27#include "scrub/xfarray.h"
28#include "scrub/iscan.h"
29#include "scrub/orphanage.h"
30#include "scrub/nlinks.h"
31#include "scrub/trace.h"
32#include "scrub/tempfile.h"
33
34/*
35 * Live Inode Link Count Repair
36 * ============================
37 *
38 * Use the live inode link count information that we collected to replace the
39 * nlink values of the incore inodes.  A scrub->repair cycle should have left
40 * the live data and hooks active, so this is safe so long as we make sure the
41 * inode is locked.
42 */
43
44/* Set up to repair inode link counts. */
45int
46xrep_setup_nlinks(
47	struct xfs_scrub	*sc)
48{
49	return xrep_orphanage_try_create(sc);
50}
51
52/*
53 * Inodes that aren't the root directory or the orphanage, have a nonzero link
54 * count, and no observed parents should be moved to the orphanage.
55 */
56static inline bool
57xrep_nlinks_is_orphaned(
58	struct xfs_scrub	*sc,
59	struct xfs_inode	*ip,
60	unsigned int		actual_nlink,
61	const struct xchk_nlink	*obs)
62{
63	struct xfs_mount	*mp = ip->i_mount;
64
65	if (obs->parents != 0)
66		return false;
67	if (ip == mp->m_rootip || ip == sc->orphanage)
68		return false;
69	return actual_nlink != 0;
70}
71
72/* Remove an inode from the unlinked list. */
73STATIC int
74xrep_nlinks_iunlink_remove(
75	struct xfs_scrub	*sc)
76{
77	struct xfs_perag	*pag;
78	int			error;
79
80	pag = xfs_perag_get(sc->mp, XFS_INO_TO_AGNO(sc->mp, sc->ip->i_ino));
81	error = xfs_iunlink_remove(sc->tp, pag, sc->ip);
82	xfs_perag_put(pag);
83	return error;
84}
85
86/*
87 * Correct the link count of the given inode.  Because we have to grab locks
88 * and resources in a certain order, it's possible that this will be a no-op.
89 */
90STATIC int
91xrep_nlinks_repair_inode(
92	struct xchk_nlink_ctrs	*xnc)
93{
94	struct xchk_nlink	obs;
95	struct xfs_scrub	*sc = xnc->sc;
96	struct xfs_mount	*mp = sc->mp;
97	struct xfs_inode	*ip = sc->ip;
98	uint64_t		total_links;
99	uint64_t		actual_nlink;
100	bool			orphanage_available = false;
101	bool			dirty = false;
102	int			error;
103
104	/*
105	 * Ignore temporary files being used to stage repairs, since we assume
106	 * they're correct for non-directories, and the directory repair code
107	 * doesn't bump the link counts for the children.
108	 */
109	if (xrep_is_tempfile(ip))
110		return 0;
111
112	/*
113	 * If the filesystem has an orphanage attached to the scrub context,
114	 * prepare for a link count repair that could involve @ip being adopted
115	 * by the lost+found.
116	 */
117	if (xrep_orphanage_can_adopt(sc)) {
118		error = xrep_orphanage_iolock_two(sc);
119		if (error)
120			return error;
121
122		error = xrep_adoption_trans_alloc(sc, &xnc->adoption);
123		if (error) {
124			xchk_iunlock(sc, XFS_IOLOCK_EXCL);
125			xrep_orphanage_iunlock(sc, XFS_IOLOCK_EXCL);
126		} else {
127			orphanage_available = true;
128		}
129	}
130
131	/*
132	 * Either there is no orphanage or we couldn't allocate resources for
133	 * that kind of update.  Let's try again with only the resources we
134	 * need for a simple link count update, since that's much more common.
135	 */
136	if (!orphanage_available) {
137		xchk_ilock(sc, XFS_IOLOCK_EXCL);
138
139		error = xfs_trans_alloc(mp, &M_RES(mp)->tr_link, 0, 0, 0,
140				&sc->tp);
141		if (error) {
142			xchk_iunlock(sc, XFS_IOLOCK_EXCL);
143			return error;
144		}
145
146		xchk_ilock(sc, XFS_ILOCK_EXCL);
147		xfs_trans_ijoin(sc->tp, ip, 0);
148	}
149
150	mutex_lock(&xnc->lock);
151
152	if (xchk_iscan_aborted(&xnc->collect_iscan)) {
153		error = -ECANCELED;
154		goto out_scanlock;
155	}
156
157	error = xfarray_load_sparse(xnc->nlinks, ip->i_ino, &obs);
158	if (error)
159		goto out_scanlock;
160
161	/*
162	 * We're done accessing the shared scan data, so we can drop the lock.
163	 * We still hold @ip's ILOCK, so its link count cannot change.
164	 */
165	mutex_unlock(&xnc->lock);
166
167	total_links = xchk_nlink_total(ip, &obs);
168	actual_nlink = VFS_I(ip)->i_nlink;
169
170	/*
171	 * Non-directories cannot have directories pointing up to them.
172	 *
173	 * We previously set error to zero, but set it again because one static
174	 * checker author fears that programmers will fail to maintain this
175	 * invariant and built their tool to flag this as a security risk.  A
176	 * different tool author made their bot complain about the redundant
177	 * store.  This is a never-ending and stupid battle; both tools missed
178	 * *actual bugs* elsewhere; and I no longer care.
179	 */
180	if (!S_ISDIR(VFS_I(ip)->i_mode) && obs.children != 0) {
181		trace_xrep_nlinks_unfixable_inode(mp, ip, &obs);
182		error = 0;
183		goto out_trans;
184	}
185
186	/*
187	 * Decide if we're going to move this file to the orphanage, and fix
188	 * up the incore link counts if we are.
189	 */
190	if (orphanage_available &&
191	    xrep_nlinks_is_orphaned(sc, ip, actual_nlink, &obs)) {
192		/* Figure out what name we're going to use here. */
193		error = xrep_adoption_compute_name(&xnc->adoption, &xnc->xname);
194		if (error)
195			goto out_trans;
196
197		/*
198		 * Reattach this file to the directory tree by moving it to
199		 * the orphanage per the adoption parameters that we already
200		 * computed.
201		 */
202		error = xrep_adoption_move(&xnc->adoption);
203		if (error)
204			goto out_trans;
205
206		/*
207		 * Re-read the link counts since the reparenting will have
208		 * updated our scan info.
209		 */
210		mutex_lock(&xnc->lock);
211		error = xfarray_load_sparse(xnc->nlinks, ip->i_ino, &obs);
212		mutex_unlock(&xnc->lock);
213		if (error)
214			goto out_trans;
215
216		total_links = xchk_nlink_total(ip, &obs);
217		actual_nlink = VFS_I(ip)->i_nlink;
218		dirty = true;
219	}
220
221	/*
222	 * If this inode is linked from the directory tree and on the unlinked
223	 * list, remove it from the unlinked list.
224	 */
225	if (total_links > 0 && xfs_inode_on_unlinked_list(ip)) {
226		error = xrep_nlinks_iunlink_remove(sc);
227		if (error)
228			goto out_trans;
229		dirty = true;
230	}
231
232	/*
233	 * If this inode is not linked from the directory tree yet not on the
234	 * unlinked list, put it on the unlinked list.
235	 */
236	if (total_links == 0 && !xfs_inode_on_unlinked_list(ip)) {
237		error = xfs_iunlink(sc->tp, ip);
238		if (error)
239			goto out_trans;
240		dirty = true;
241	}
242
243	/* Commit the new link count if it changed. */
244	if (total_links != actual_nlink) {
245		trace_xrep_nlinks_update_inode(mp, ip, &obs);
246
247		set_nlink(VFS_I(ip), min_t(unsigned long long, total_links,
248					   XFS_NLINK_PINNED));
249		dirty = true;
250	}
251
252	if (!dirty) {
253		error = 0;
254		goto out_trans;
255	}
256
257	xfs_trans_log_inode(sc->tp, ip, XFS_ILOG_CORE);
258
259	error = xrep_trans_commit(sc);
260	goto out_unlock;
261
262out_scanlock:
263	mutex_unlock(&xnc->lock);
264out_trans:
265	xchk_trans_cancel(sc);
266out_unlock:
267	xchk_iunlock(sc, XFS_ILOCK_EXCL);
268	if (orphanage_available) {
269		xrep_orphanage_iunlock(sc, XFS_ILOCK_EXCL);
270		xrep_orphanage_iunlock(sc, XFS_IOLOCK_EXCL);
271	}
272	xchk_iunlock(sc, XFS_IOLOCK_EXCL);
273	return error;
274}
275
276/*
277 * Try to visit every inode in the filesystem for repairs.  Move on if we can't
278 * grab an inode, since we're still making forward progress.
279 */
280static int
281xrep_nlinks_iter(
282	struct xchk_nlink_ctrs	*xnc,
283	struct xfs_inode	**ipp)
284{
285	int			error;
286
287	do {
288		error = xchk_iscan_iter(&xnc->compare_iscan, ipp);
289	} while (error == -EBUSY);
290
291	return error;
292}
293
294/* Commit the new inode link counters. */
295int
296xrep_nlinks(
297	struct xfs_scrub	*sc)
298{
299	struct xchk_nlink_ctrs	*xnc = sc->buf;
300	int			error;
301
302	/*
303	 * We need ftype for an accurate count of the number of child
304	 * subdirectory links.  Child subdirectories with a back link (dotdot
305	 * entry) but no forward link are moved to the orphanage, so we cannot
306	 * repair the link count of the parent directory based on the back link
307	 * count alone.  Filesystems without ftype support are rare (old V4) so
308	 * we just skip out here.
309	 */
310	if (!xfs_has_ftype(sc->mp))
311		return -EOPNOTSUPP;
312
313	/*
314	 * Use the inobt to walk all allocated inodes to compare and fix the
315	 * link counts.  Retry iget every tenth of a second for up to 30
316	 * seconds -- even if repair misses a few inodes, we still try to fix
317	 * as many of them as we can.
318	 */
319	xchk_iscan_start(sc, 30000, 100, &xnc->compare_iscan);
320	ASSERT(sc->ip == NULL);
321
322	while ((error = xrep_nlinks_iter(xnc, &sc->ip)) == 1) {
323		/*
324		 * Commit the scrub transaction so that we can create repair
325		 * transactions with the correct reservations.
326		 */
327		xchk_trans_cancel(sc);
328
329		error = xrep_nlinks_repair_inode(xnc);
330		xchk_iscan_mark_visited(&xnc->compare_iscan, sc->ip);
331		xchk_irele(sc, sc->ip);
332		sc->ip = NULL;
333		if (error)
334			break;
335
336		if (xchk_should_terminate(sc, &error))
337			break;
338
339		/*
340		 * Create a new empty transaction so that we can advance the
341		 * iscan cursor without deadlocking if the inobt has a cycle.
342		 * We can only push the inactivation workqueues with an empty
343		 * transaction.
344		 */
345		error = xchk_trans_alloc_empty(sc);
346		if (error)
347			break;
348	}
349	xchk_iscan_iter_finish(&xnc->compare_iscan);
350	xchk_iscan_teardown(&xnc->compare_iscan);
351
352	return error;
353}
354