1 // SPDX-License-Identifier: GPL-2.0-or-later
3  * Copyright (C) 2017-2023 Oracle.  All Rights Reserved.
39  * repair on-disk data structures.  That task was left to the xfs_check
50  * also be cross-referenced against other btrees to look for potential
53  * It is expected that the checkers responsible for per-AG metadata
55  * metadata structure, and perform any relevant cross-referencing before
60  * Block maps and b-trees rooted in an inode present a special challenge
61  * because they can involve extents from any AG.  The general scrubber
62  * structure of lock -> check -> xref -> unlock still holds, but AG
67  * can signal a potential deadlock, in which case the scrubber can jump
72  * (directories and attributes) we follow the same btree-scrubbing
82  * re-grab the buffer in the context of the same transaction, we avoid
84  * scrubber, something will notice that something is amiss and report
85  * the corruption.  Therefore, each scrubber will allocate an empty
87  * end of the scrub run.  Cancelling a non-dirty transaction simply
99  * cross-referencing every record with all other available metadata.
106  * cross-reference with a defective btree.
110  * the metadata object by setting the REPAIR flag and re-calling the
112  * on-disk specification; operations cannot continue if the violation is
117  * done without rebuilding entire structures.
120  * Lock -> scrub -> repair -> commit -> re-lock -> re-scrub -> unlock.
127  * - "xfs_" are general XFS symbols.
128  * - "xchk_" are symbols related to metadata checking.
129  * - "xrep_" are symbols related to metadata repair.
130  * - "xfs_scrub_" are symbols that tie online fsck to the rest of XFS.
134  * Scrub probe -- userspace uses this to probe if we're willing to scrub
161 			return -EOPNOTSUPP;  in xchk_probe()
162 		sc->sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;  in xchk_probe()
173 	if (!(sc->flags & XCHK_FSGATES_ALL))  in xchk_fsgates_disable()
176 	trace_xchk_fsgates_disable(sc, sc->flags & XCHK_FSGATES_ALL);  in xchk_fsgates_disable()
178 	if (sc->flags & XCHK_FSGATES_DRAIN)  in xchk_fsgates_disable()
181 	if (sc->flags & XCHK_FSGATES_QUOTA)  in xchk_fsgates_disable()
184 	if (sc->flags & XCHK_FSGATES_DIRENTS)  in xchk_fsgates_disable()
187 	if (sc->flags & XCHK_FSGATES_RMAP)  in xchk_fsgates_disable()
190 	sc->flags &= ~XCHK_FSGATES_ALL;  in xchk_fsgates_disable()
198 	struct xfs_scrub	*sc = sub->parent_sc;  in xchk_scrub_free_subord()
200 	ASSERT(sc->ip == sub->sc.ip);  in xchk_scrub_free_subord()
201 	ASSERT(sc->orphanage == sub->sc.orphanage);  in xchk_scrub_free_subord()
202 	ASSERT(sc->tempip == sub->sc.tempip);  in xchk_scrub_free_subord()
204 	sc->sm->sm_type = sub->old_smtype;  in xchk_scrub_free_subord()
205 	sc->sm->sm_flags = sub->old_smflags |  in xchk_scrub_free_subord()
206 				(sc->sm->sm_flags & XFS_SCRUB_FLAGS_OUT);  in xchk_scrub_free_subord()
207 	sc->tp = sub->sc.tp;  in xchk_scrub_free_subord()
209 	if (sub->sc.buf) {  in xchk_scrub_free_subord()
210 		if (sub->sc.buf_cleanup)  in xchk_scrub_free_subord()
211 			sub->sc.buf_cleanup(sub->sc.buf);  in xchk_scrub_free_subord()
212 		kvfree(sub->sc.buf);  in xchk_scrub_free_subord()
214 	if (sub->sc.xmbtp)  in xchk_scrub_free_subord()
215 		xmbuf_free(sub->sc.xmbtp);  in xchk_scrub_free_subord()
216 	if (sub->sc.xfile)  in xchk_scrub_free_subord()
217 		xfile_destroy(sub->sc.xfile);  in xchk_scrub_free_subord()
219 	sc->ilock_flags = sub->sc.ilock_flags;  in xchk_scrub_free_subord()
220 	sc->orphanage_ilock_flags = sub->sc.orphanage_ilock_flags;  in xchk_scrub_free_subord()
221 	sc->temp_ilock_flags = sub->sc.temp_ilock_flags;  in xchk_scrub_free_subord()
232 	xchk_ag_free(sc, &sc->sa);  in xchk_teardown()
233 	xchk_rtgroup_btcur_free(&sc->sr);  in xchk_teardown()
235 	if (sc->tp) {  in xchk_teardown()
236 		if (error == 0 && (sc->sm->sm_flags & XFS_SCRUB_IFLAG_REPAIR))  in xchk_teardown()
237 			error = xfs_trans_commit(sc->tp);  in xchk_teardown()
239 			xfs_trans_cancel(sc->tp);  in xchk_teardown()
240 		sc->tp = NULL;  in xchk_teardown()
242 	if (sc->sr.rtg)  in xchk_teardown()
243 		xchk_rtgroup_free(sc, &sc->sr);  in xchk_teardown()
244 	if (sc->ip) {  in xchk_teardown()
245 		if (sc->ilock_flags)  in xchk_teardown()
246 			xchk_iunlock(sc, sc->ilock_flags);  in xchk_teardown()
247 		xchk_irele(sc, sc->ip);  in xchk_teardown()
248 		sc->ip = NULL;  in xchk_teardown()
250 	if (sc->flags & XCHK_HAVE_FREEZE_PROT) {  in xchk_teardown()
251 		sc->flags &= ~XCHK_HAVE_FREEZE_PROT;  in xchk_teardown()
252 		mnt_drop_write_file(sc->file);  in xchk_teardown()
254 	if (sc->xmbtp) {  in xchk_teardown()
255 		xmbuf_free(sc->xmbtp);  in xchk_teardown()
256 		sc->xmbtp = NULL;  in xchk_teardown()
258 	if (sc->xfile) {  in xchk_teardown()
259 		xfile_destroy(sc->xfile);  in xchk_teardown()
260 		sc->xfile = NULL;  in xchk_teardown()
262 	if (sc->buf) {  in xchk_teardown()
263 		if (sc->buf_cleanup)  in xchk_teardown()
264 			sc->buf_cleanup(sc->buf);  in xchk_teardown()
265 		kvfree(sc->buf);  in xchk_teardown()
266 		sc->buf_cleanup = NULL;  in xchk_teardown()
267 		sc->buf = NULL;  in xchk_teardown()
499 	error = -EINVAL;  in xchk_validate_inputs()
501 	sm->sm_flags &= ~XFS_SCRUB_FLAGS_OUT;  in xchk_validate_inputs()
502 	if (sm->sm_flags & ~XFS_SCRUB_FLAGS_IN)  in xchk_validate_inputs()
505 	if (memchr_inv(sm->sm_reserved, 0, sizeof(sm->sm_reserved)))  in xchk_validate_inputs()
508 	error = -ENOENT;  in xchk_validate_inputs()
510 	if (sm->sm_type >= XFS_SCRUB_TYPE_NR)  in xchk_validate_inputs()
512 	ops = &meta_scrub_ops[sm->sm_type];  in xchk_validate_inputs()
513 	if (ops->setup == NULL || ops->scrub == NULL)  in xchk_validate_inputs()
516 	if (ops->has && !ops->has(mp))  in xchk_validate_inputs()
519 	error = -EINVAL;  in xchk_validate_inputs()
521 	switch (ops->type) {  in xchk_validate_inputs()
524 		if (sm->sm_ino || sm->sm_gen || sm->sm_agno)  in xchk_validate_inputs()
528 		if (sm->sm_ino || sm->sm_gen ||  in xchk_validate_inputs()
529 		    sm->sm_agno >= mp->m_sb.sb_agcount)  in xchk_validate_inputs()
533 		if (sm->sm_agno || (sm->sm_gen && !sm->sm_ino))  in xchk_validate_inputs()
539 		if (sm->sm_ino || sm->sm_gen)  in xchk_validate_inputs()
550 			if (sm->sm_agno >= mp->m_sb.sb_rgcount) {  in xchk_validate_inputs()
551 				if (sm->sm_agno == 0)  in xchk_validate_inputs()
552 					error = -ENOENT;  in xchk_validate_inputs()
559 			 * scrubbing pre-rtgroups filesystems.  in xchk_validate_inputs()
561 			if (sm->sm_agno != 0)  in xchk_validate_inputs()
570 	if ((sm->sm_flags & XFS_SCRUB_IFLAG_FORCE_REBUILD) &&  in xchk_validate_inputs()
571 	    !(sm->sm_flags & XFS_SCRUB_IFLAG_REPAIR))  in xchk_validate_inputs()
572 		return -EINVAL;  in xchk_validate_inputs()
575 	 * We only want to repair read-write v5+ filesystems.  Defer the check  in xchk_validate_inputs()
576 	 * for ops->repair until after our scrub confirms that we need to  in xchk_validate_inputs()
580 	if (sm->sm_flags & XFS_SCRUB_IFLAG_REPAIR) {  in xchk_validate_inputs()
581 		error = -EOPNOTSUPP;  in xchk_validate_inputs()
585 		error = -EROFS;  in xchk_validate_inputs()
603 	if ((sc->sm->sm_flags & XFS_SCRUB_IFLAG_REPAIR) &&  in xchk_postmortem()
604 	    (sc->sm->sm_flags & (XFS_SCRUB_OFLAG_CORRUPT |  in xchk_postmortem()
606 		xrep_failure(sc->mp);  in xchk_postmortem()
615 	if (sc->sm->sm_flags & (XFS_SCRUB_OFLAG_CORRUPT |  in xchk_postmortem()
617 		xfs_alert_ratelimited(sc->mp,  in xchk_postmortem()
635 		return ERR_PTR(-ENOMEM);  in xchk_scrub_create_subord()
637 	sub->old_smtype = sc->sm->sm_type;  in xchk_scrub_create_subord()
638 	sub->old_smflags = sc->sm->sm_flags;  in xchk_scrub_create_subord()
639 	sub->parent_sc = sc;  in xchk_scrub_create_subord()
640 	memcpy(&sub->sc, sc, sizeof(struct xfs_scrub));  in xchk_scrub_create_subord()
641 	sub->sc.ops = &meta_scrub_ops[subtype];  in xchk_scrub_create_subord()
642 	sub->sc.sm->sm_type = subtype;  in xchk_scrub_create_subord()
643 	sub->sc.sm->sm_flags &= ~XFS_SCRUB_FLAGS_OUT;  in xchk_scrub_create_subord()
644 	sub->sc.buf = NULL;  in xchk_scrub_create_subord()
645 	sub->sc.buf_cleanup = NULL;  in xchk_scrub_create_subord()
646 	sub->sc.xfile = NULL;  in xchk_scrub_create_subord()
647 	sub->sc.xmbtp = NULL;  in xchk_scrub_create_subord()
660 	struct xfs_mount		*mp = XFS_I(file_inode(file))->i_mount;  in xfs_scrub_metadata()
670 	error = -ESHUTDOWN;  in xfs_scrub_metadata()
673 	error = -ENOTRECOVERABLE;  in xfs_scrub_metadata()
685 		error = -ENOMEM;  in xfs_scrub_metadata()
689 	sc->mp = mp;  in xfs_scrub_metadata()
690 	sc->file = file;  in xfs_scrub_metadata()
691 	sc->sm = sm;  in xfs_scrub_metadata()
692 	sc->ops = &meta_scrub_ops[sm->sm_type];  in xfs_scrub_metadata()
693 	sc->sick_mask = xchk_health_mask_for_scrub_type(sm->sm_type);  in xfs_scrub_metadata()
694 	sc->relax = INIT_XCHK_RELAX;  in xfs_scrub_metadata()
700 	if (sm->sm_flags & XFS_SCRUB_IFLAG_REPAIR) {  in xfs_scrub_metadata()
701 		error = mnt_want_write_file(sc->file);  in xfs_scrub_metadata()
705 		sc->flags |= XCHK_HAVE_FREEZE_PROT;  in xfs_scrub_metadata()
709 	error = sc->ops->setup(sc);  in xfs_scrub_metadata()
710 	if (error == -EDEADLOCK && !(sc->flags & XCHK_TRY_HARDER))  in xfs_scrub_metadata()
712 	if (error == -ECHRNG && !(sc->flags & XCHK_NEED_DRAIN))  in xfs_scrub_metadata()
719 	if ((sc->flags & XREP_ALREADY_FIXED) && sc->ops->repair_eval != NULL)  in xfs_scrub_metadata()
720 		error = sc->ops->repair_eval(sc);  in xfs_scrub_metadata()
722 		error = sc->ops->scrub(sc);  in xfs_scrub_metadata()
724 	if (error == -EDEADLOCK && !(sc->flags & XCHK_TRY_HARDER))  in xfs_scrub_metadata()
726 	if (error == -ECHRNG && !(sc->flags & XCHK_NEED_DRAIN))  in xfs_scrub_metadata()
728 	if (error || (sm->sm_flags & XFS_SCRUB_OFLAG_INCOMPLETE))  in xfs_scrub_metadata()
739 			sc->sm->sm_flags |= XFS_SCRUB_OFLAG_NO_REPAIR_NEEDED;  in xfs_scrub_metadata()
748 		if (error == -EAGAIN) {  in xfs_scrub_metadata()
768 	if (error != -ENOENT)  in xfs_scrub_metadata()
773 	if (error == -EFSCORRUPTED || error == -EFSBADCRC) {  in xfs_scrub_metadata()
774 		sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;  in xfs_scrub_metadata()
782 	sc->flags |= XCHK_NEED_DRAIN;  in xfs_scrub_metadata()
787 	 * Scrubbers return -EDEADLOCK to mean 'try harder'.  Tear down  in xfs_scrub_metadata()
789 	 * worst-case scenarios.  in xfs_scrub_metadata()
794 	sc->flags |= XCHK_TRY_HARDER;  in xfs_scrub_metadata()
809 		return -EPERM;  in xfs_ioc_scrub_metadata()
812 		return -EFAULT;  in xfs_ioc_scrub_metadata()
819 		return -EFAULT;  in xfs_ioc_scrub_metadata()
834 	failmask = stop_vec->sv_flags & XFS_SCRUB_FLAGS_OUT;  in xfs_scrubv_check_barrier()
837 		if (v->sv_type == XFS_SCRUB_TYPE_BARRIER)  in xfs_scrubv_check_barrier()
844 		switch (v->sv_ret) {  in xfs_scrubv_check_barrier()
845 		case -EBUSY:  in xfs_scrubv_check_barrier()
846 		case -ENOENT:  in xfs_scrubv_check_barrier()
847 		case -EUSERS:  in xfs_scrubv_check_barrier()
851 			return -ECANCELED;  in xfs_scrubv_check_barrier()
855 		 * If any of the out-flags on the scrub vector match the mask  in xfs_scrubv_check_barrier()
858 		if (v->sv_flags & failmask)  in xfs_scrubv_check_barrier()
859 			return -ECANCELED;  in xfs_scrubv_check_barrier()
883 	error = xfs_iget(mp, tp, head->svh_ino, XCHK_IGET_FLAGS, 0, &ip);  in xchk_scrubv_open_by_handle()
888 	if (VFS_I(ip)->i_generation != head->svh_gen) {  in xchk_scrubv_open_by_handle()
907 	struct xfs_mount		*mp = ip_in->i_mount;  in xfs_ioc_scrubv_metadata()
915 		return -EPERM;  in xfs_ioc_scrubv_metadata()
918 		return -EFAULT;  in xfs_ioc_scrubv_metadata()
921 		return -EINVAL;  in xfs_ioc_scrubv_metadata()
923 		return -EINVAL;  in xfs_ioc_scrubv_metadata()
929 		return -ENOMEM;  in xfs_ioc_scrubv_metadata()
939 		if (v->sv_reserved) {  in xfs_ioc_scrubv_metadata()
940 			error = -EINVAL;  in xfs_ioc_scrubv_metadata()
944 		if (v->sv_type == XFS_SCRUB_TYPE_BARRIER &&  in xfs_ioc_scrubv_metadata()
945 		    (v->sv_flags & ~XFS_SCRUB_FLAGS_OUT)) {  in xfs_ioc_scrubv_metadata()
946 			error = -EINVAL;  in xfs_ioc_scrubv_metadata()
954 	 * If the caller wants us to do a scrub-by-handle and the file used to  in xfs_ioc_scrubv_metadata()
958 	 * because each scrubber gets to decide its own strategy and return  in xfs_ioc_scrubv_metadata()
961 	if (head.svh_ino && head.svh_ino != ip_in->i_ino)  in xfs_ioc_scrubv_metadata()
967 			.sm_type		= v->sv_type,  in xfs_ioc_scrubv_metadata()
968 			.sm_flags		= v->sv_flags,  in xfs_ioc_scrubv_metadata()
974 		if (v->sv_type == XFS_SCRUB_TYPE_BARRIER) {  in xfs_ioc_scrubv_metadata()
975 			v->sv_ret = xfs_scrubv_check_barrier(mp, vectors, v);  in xfs_ioc_scrubv_metadata()
976 			if (v->sv_ret) {  in xfs_ioc_scrubv_metadata()
984 		v->sv_ret = xfs_scrub_metadata(file, &sm);  in xfs_ioc_scrubv_metadata()
985 		v->sv_flags = sm.sm_flags;  in xfs_ioc_scrubv_metadata()
999 			error = -EINTR;  in xfs_ioc_scrubv_metadata()
1006 		error = -EFAULT;  in xfs_ioc_scrubv_metadata()