1 // SPDX-License-Identifier: GPL-2.0+ 2 /* 3 * Copyright (C) 2017 Oracle. All Rights Reserved. 4 * Author: Darrick J. Wong <darrick.wong@oracle.com> 5 */ 6 #include "xfs.h" 7 #include "xfs_fs.h" 8 #include "xfs_shared.h" 9 #include "xfs_format.h" 10 #include "xfs_trans_resv.h" 11 #include "xfs_mount.h" 12 #include "xfs_btree.h" 13 #include "xfs_log_format.h" 14 #include "xfs_inode.h" 15 #include "xfs_ialloc.h" 16 #include "xfs_da_format.h" 17 #include "xfs_reflink.h" 18 #include "xfs_rmap.h" 19 #include "xfs_bmap_util.h" 20 #include "scrub/scrub.h" 21 #include "scrub/common.h" 22 #include "scrub/btree.h" 23 24 /* 25 * Grab total control of the inode metadata. It doesn't matter here if 26 * the file data is still changing; exclusive access to the metadata is 27 * the goal. 28 */ 29 int 30 xchk_setup_inode( 31 struct xfs_scrub *sc, 32 struct xfs_inode *ip) 33 { 34 int error; 35 36 /* 37 * Try to get the inode. If the verifiers fail, we try again 38 * in raw mode. 39 */ 40 error = xchk_get_inode(sc, ip); 41 switch (error) { 42 case 0: 43 break; 44 case -EFSCORRUPTED: 45 case -EFSBADCRC: 46 return xchk_trans_alloc(sc, 0); 47 default: 48 return error; 49 } 50 51 /* Got the inode, lock it and we're ready to go. */ 52 sc->ilock_flags = XFS_IOLOCK_EXCL | XFS_MMAPLOCK_EXCL; 53 xfs_ilock(sc->ip, sc->ilock_flags); 54 error = xchk_trans_alloc(sc, 0); 55 if (error) 56 goto out; 57 sc->ilock_flags |= XFS_ILOCK_EXCL; 58 xfs_ilock(sc->ip, XFS_ILOCK_EXCL); 59 60 out: 61 /* scrub teardown will unlock and release the inode for us */ 62 return error; 63 } 64 65 /* Inode core */ 66 67 /* Validate di_extsize hint. */ 68 STATIC void 69 xchk_inode_extsize( 70 struct xfs_scrub *sc, 71 struct xfs_dinode *dip, 72 xfs_ino_t ino, 73 uint16_t mode, 74 uint16_t flags) 75 { 76 xfs_failaddr_t fa; 77 78 fa = xfs_inode_validate_extsize(sc->mp, be32_to_cpu(dip->di_extsize), 79 mode, flags); 80 if (fa) 81 xchk_ino_set_corrupt(sc, ino); 82 } 83 84 /* 85 * Validate di_cowextsize hint. 86 * 87 * The rules are documented at xfs_ioctl_setattr_check_cowextsize(). 88 * These functions must be kept in sync with each other. 89 */ 90 STATIC void 91 xchk_inode_cowextsize( 92 struct xfs_scrub *sc, 93 struct xfs_dinode *dip, 94 xfs_ino_t ino, 95 uint16_t mode, 96 uint16_t flags, 97 uint64_t flags2) 98 { 99 xfs_failaddr_t fa; 100 101 fa = xfs_inode_validate_cowextsize(sc->mp, 102 be32_to_cpu(dip->di_cowextsize), mode, flags, 103 flags2); 104 if (fa) 105 xchk_ino_set_corrupt(sc, ino); 106 } 107 108 /* Make sure the di_flags make sense for the inode. */ 109 STATIC void 110 xchk_inode_flags( 111 struct xfs_scrub *sc, 112 struct xfs_dinode *dip, 113 xfs_ino_t ino, 114 uint16_t mode, 115 uint16_t flags) 116 { 117 struct xfs_mount *mp = sc->mp; 118 119 /* di_flags are all taken, last bit cannot be used */ 120 if (flags & ~XFS_DIFLAG_ANY) 121 goto bad; 122 123 /* rt flags require rt device */ 124 if ((flags & XFS_DIFLAG_REALTIME) && !mp->m_rtdev_targp) 125 goto bad; 126 127 /* new rt bitmap flag only valid for rbmino */ 128 if ((flags & XFS_DIFLAG_NEWRTBM) && ino != mp->m_sb.sb_rbmino) 129 goto bad; 130 131 /* directory-only flags */ 132 if ((flags & (XFS_DIFLAG_RTINHERIT | 133 XFS_DIFLAG_EXTSZINHERIT | 134 XFS_DIFLAG_PROJINHERIT | 135 XFS_DIFLAG_NOSYMLINKS)) && 136 !S_ISDIR(mode)) 137 goto bad; 138 139 /* file-only flags */ 140 if ((flags & (XFS_DIFLAG_REALTIME | FS_XFLAG_EXTSIZE)) && 141 !S_ISREG(mode)) 142 goto bad; 143 144 /* filestreams and rt make no sense */ 145 if ((flags & XFS_DIFLAG_FILESTREAM) && (flags & XFS_DIFLAG_REALTIME)) 146 goto bad; 147 148 return; 149 bad: 150 xchk_ino_set_corrupt(sc, ino); 151 } 152 153 /* Make sure the di_flags2 make sense for the inode. */ 154 STATIC void 155 xchk_inode_flags2( 156 struct xfs_scrub *sc, 157 struct xfs_dinode *dip, 158 xfs_ino_t ino, 159 uint16_t mode, 160 uint16_t flags, 161 uint64_t flags2) 162 { 163 struct xfs_mount *mp = sc->mp; 164 165 /* Unknown di_flags2 could be from a future kernel */ 166 if (flags2 & ~XFS_DIFLAG2_ANY) 167 xchk_ino_set_warning(sc, ino); 168 169 /* reflink flag requires reflink feature */ 170 if ((flags2 & XFS_DIFLAG2_REFLINK) && 171 !xfs_sb_version_hasreflink(&mp->m_sb)) 172 goto bad; 173 174 /* cowextsize flag is checked w.r.t. mode separately */ 175 176 /* file/dir-only flags */ 177 if ((flags2 & XFS_DIFLAG2_DAX) && !(S_ISREG(mode) || S_ISDIR(mode))) 178 goto bad; 179 180 /* file-only flags */ 181 if ((flags2 & XFS_DIFLAG2_REFLINK) && !S_ISREG(mode)) 182 goto bad; 183 184 /* realtime and reflink make no sense, currently */ 185 if ((flags & XFS_DIFLAG_REALTIME) && (flags2 & XFS_DIFLAG2_REFLINK)) 186 goto bad; 187 188 /* no bigtime iflag without the bigtime feature */ 189 if (xfs_dinode_has_bigtime(dip) && 190 !xfs_sb_version_hasbigtime(&mp->m_sb)) 191 goto bad; 192 193 return; 194 bad: 195 xchk_ino_set_corrupt(sc, ino); 196 } 197 198 static inline void 199 xchk_dinode_nsec( 200 struct xfs_scrub *sc, 201 xfs_ino_t ino, 202 struct xfs_dinode *dip, 203 const xfs_timestamp_t ts) 204 { 205 struct timespec64 tv; 206 207 tv = xfs_inode_from_disk_ts(dip, ts); 208 if (tv.tv_nsec < 0 || tv.tv_nsec >= NSEC_PER_SEC) 209 xchk_ino_set_corrupt(sc, ino); 210 } 211 212 /* Scrub all the ondisk inode fields. */ 213 STATIC void 214 xchk_dinode( 215 struct xfs_scrub *sc, 216 struct xfs_dinode *dip, 217 xfs_ino_t ino) 218 { 219 struct xfs_mount *mp = sc->mp; 220 size_t fork_recs; 221 unsigned long long isize; 222 uint64_t flags2; 223 uint32_t nextents; 224 uint16_t flags; 225 uint16_t mode; 226 227 flags = be16_to_cpu(dip->di_flags); 228 if (dip->di_version >= 3) 229 flags2 = be64_to_cpu(dip->di_flags2); 230 else 231 flags2 = 0; 232 233 /* di_mode */ 234 mode = be16_to_cpu(dip->di_mode); 235 switch (mode & S_IFMT) { 236 case S_IFLNK: 237 case S_IFREG: 238 case S_IFDIR: 239 case S_IFCHR: 240 case S_IFBLK: 241 case S_IFIFO: 242 case S_IFSOCK: 243 /* mode is recognized */ 244 break; 245 default: 246 xchk_ino_set_corrupt(sc, ino); 247 break; 248 } 249 250 /* v1/v2 fields */ 251 switch (dip->di_version) { 252 case 1: 253 /* 254 * We autoconvert v1 inodes into v2 inodes on writeout, 255 * so just mark this inode for preening. 256 */ 257 xchk_ino_set_preen(sc, ino); 258 break; 259 case 2: 260 case 3: 261 if (dip->di_onlink != 0) 262 xchk_ino_set_corrupt(sc, ino); 263 264 if (dip->di_mode == 0 && sc->ip) 265 xchk_ino_set_corrupt(sc, ino); 266 267 if (dip->di_projid_hi != 0 && 268 !xfs_sb_version_hasprojid32bit(&mp->m_sb)) 269 xchk_ino_set_corrupt(sc, ino); 270 break; 271 default: 272 xchk_ino_set_corrupt(sc, ino); 273 return; 274 } 275 276 /* 277 * di_uid/di_gid -- -1 isn't invalid, but there's no way that 278 * userspace could have created that. 279 */ 280 if (dip->di_uid == cpu_to_be32(-1U) || 281 dip->di_gid == cpu_to_be32(-1U)) 282 xchk_ino_set_warning(sc, ino); 283 284 /* di_format */ 285 switch (dip->di_format) { 286 case XFS_DINODE_FMT_DEV: 287 if (!S_ISCHR(mode) && !S_ISBLK(mode) && 288 !S_ISFIFO(mode) && !S_ISSOCK(mode)) 289 xchk_ino_set_corrupt(sc, ino); 290 break; 291 case XFS_DINODE_FMT_LOCAL: 292 if (!S_ISDIR(mode) && !S_ISLNK(mode)) 293 xchk_ino_set_corrupt(sc, ino); 294 break; 295 case XFS_DINODE_FMT_EXTENTS: 296 if (!S_ISREG(mode) && !S_ISDIR(mode) && !S_ISLNK(mode)) 297 xchk_ino_set_corrupt(sc, ino); 298 break; 299 case XFS_DINODE_FMT_BTREE: 300 if (!S_ISREG(mode) && !S_ISDIR(mode)) 301 xchk_ino_set_corrupt(sc, ino); 302 break; 303 case XFS_DINODE_FMT_UUID: 304 default: 305 xchk_ino_set_corrupt(sc, ino); 306 break; 307 } 308 309 /* di_[amc]time.nsec */ 310 xchk_dinode_nsec(sc, ino, dip, dip->di_atime); 311 xchk_dinode_nsec(sc, ino, dip, dip->di_mtime); 312 xchk_dinode_nsec(sc, ino, dip, dip->di_ctime); 313 314 /* 315 * di_size. xfs_dinode_verify checks for things that screw up 316 * the VFS such as the upper bit being set and zero-length 317 * symlinks/directories, but we can do more here. 318 */ 319 isize = be64_to_cpu(dip->di_size); 320 if (isize & (1ULL << 63)) 321 xchk_ino_set_corrupt(sc, ino); 322 323 /* Devices, fifos, and sockets must have zero size */ 324 if (!S_ISDIR(mode) && !S_ISREG(mode) && !S_ISLNK(mode) && isize != 0) 325 xchk_ino_set_corrupt(sc, ino); 326 327 /* Directories can't be larger than the data section size (32G) */ 328 if (S_ISDIR(mode) && (isize == 0 || isize >= XFS_DIR2_SPACE_SIZE)) 329 xchk_ino_set_corrupt(sc, ino); 330 331 /* Symlinks can't be larger than SYMLINK_MAXLEN */ 332 if (S_ISLNK(mode) && (isize == 0 || isize >= XFS_SYMLINK_MAXLEN)) 333 xchk_ino_set_corrupt(sc, ino); 334 335 /* 336 * Warn if the running kernel can't handle the kinds of offsets 337 * needed to deal with the file size. In other words, if the 338 * pagecache can't cache all the blocks in this file due to 339 * overly large offsets, flag the inode for admin review. 340 */ 341 if (isize >= mp->m_super->s_maxbytes) 342 xchk_ino_set_warning(sc, ino); 343 344 /* di_nblocks */ 345 if (flags2 & XFS_DIFLAG2_REFLINK) { 346 ; /* nblocks can exceed dblocks */ 347 } else if (flags & XFS_DIFLAG_REALTIME) { 348 /* 349 * nblocks is the sum of data extents (in the rtdev), 350 * attr extents (in the datadev), and both forks' bmbt 351 * blocks (in the datadev). This clumsy check is the 352 * best we can do without cross-referencing with the 353 * inode forks. 354 */ 355 if (be64_to_cpu(dip->di_nblocks) >= 356 mp->m_sb.sb_dblocks + mp->m_sb.sb_rblocks) 357 xchk_ino_set_corrupt(sc, ino); 358 } else { 359 if (be64_to_cpu(dip->di_nblocks) >= mp->m_sb.sb_dblocks) 360 xchk_ino_set_corrupt(sc, ino); 361 } 362 363 xchk_inode_flags(sc, dip, ino, mode, flags); 364 365 xchk_inode_extsize(sc, dip, ino, mode, flags); 366 367 /* di_nextents */ 368 nextents = be32_to_cpu(dip->di_nextents); 369 fork_recs = XFS_DFORK_DSIZE(dip, mp) / sizeof(struct xfs_bmbt_rec); 370 switch (dip->di_format) { 371 case XFS_DINODE_FMT_EXTENTS: 372 if (nextents > fork_recs) 373 xchk_ino_set_corrupt(sc, ino); 374 break; 375 case XFS_DINODE_FMT_BTREE: 376 if (nextents <= fork_recs) 377 xchk_ino_set_corrupt(sc, ino); 378 break; 379 default: 380 if (nextents != 0) 381 xchk_ino_set_corrupt(sc, ino); 382 break; 383 } 384 385 /* di_forkoff */ 386 if (XFS_DFORK_APTR(dip) >= (char *)dip + mp->m_sb.sb_inodesize) 387 xchk_ino_set_corrupt(sc, ino); 388 if (dip->di_anextents != 0 && dip->di_forkoff == 0) 389 xchk_ino_set_corrupt(sc, ino); 390 if (dip->di_forkoff == 0 && dip->di_aformat != XFS_DINODE_FMT_EXTENTS) 391 xchk_ino_set_corrupt(sc, ino); 392 393 /* di_aformat */ 394 if (dip->di_aformat != XFS_DINODE_FMT_LOCAL && 395 dip->di_aformat != XFS_DINODE_FMT_EXTENTS && 396 dip->di_aformat != XFS_DINODE_FMT_BTREE) 397 xchk_ino_set_corrupt(sc, ino); 398 399 /* di_anextents */ 400 nextents = be16_to_cpu(dip->di_anextents); 401 fork_recs = XFS_DFORK_ASIZE(dip, mp) / sizeof(struct xfs_bmbt_rec); 402 switch (dip->di_aformat) { 403 case XFS_DINODE_FMT_EXTENTS: 404 if (nextents > fork_recs) 405 xchk_ino_set_corrupt(sc, ino); 406 break; 407 case XFS_DINODE_FMT_BTREE: 408 if (nextents <= fork_recs) 409 xchk_ino_set_corrupt(sc, ino); 410 break; 411 default: 412 if (nextents != 0) 413 xchk_ino_set_corrupt(sc, ino); 414 } 415 416 if (dip->di_version >= 3) { 417 xchk_dinode_nsec(sc, ino, dip, dip->di_crtime); 418 xchk_inode_flags2(sc, dip, ino, mode, flags, flags2); 419 xchk_inode_cowextsize(sc, dip, ino, mode, flags, 420 flags2); 421 } 422 } 423 424 /* 425 * Make sure the finobt doesn't think this inode is free. 426 * We don't have to check the inobt ourselves because we got the inode via 427 * IGET_UNTRUSTED, which checks the inobt for us. 428 */ 429 static void 430 xchk_inode_xref_finobt( 431 struct xfs_scrub *sc, 432 xfs_ino_t ino) 433 { 434 struct xfs_inobt_rec_incore rec; 435 xfs_agino_t agino; 436 int has_record; 437 int error; 438 439 if (!sc->sa.fino_cur || xchk_skip_xref(sc->sm)) 440 return; 441 442 agino = XFS_INO_TO_AGINO(sc->mp, ino); 443 444 /* 445 * Try to get the finobt record. If we can't get it, then we're 446 * in good shape. 447 */ 448 error = xfs_inobt_lookup(sc->sa.fino_cur, agino, XFS_LOOKUP_LE, 449 &has_record); 450 if (!xchk_should_check_xref(sc, &error, &sc->sa.fino_cur) || 451 !has_record) 452 return; 453 454 error = xfs_inobt_get_rec(sc->sa.fino_cur, &rec, &has_record); 455 if (!xchk_should_check_xref(sc, &error, &sc->sa.fino_cur) || 456 !has_record) 457 return; 458 459 /* 460 * Otherwise, make sure this record either doesn't cover this inode, 461 * or that it does but it's marked present. 462 */ 463 if (rec.ir_startino > agino || 464 rec.ir_startino + XFS_INODES_PER_CHUNK <= agino) 465 return; 466 467 if (rec.ir_free & XFS_INOBT_MASK(agino - rec.ir_startino)) 468 xchk_btree_xref_set_corrupt(sc, sc->sa.fino_cur, 0); 469 } 470 471 /* Cross reference the inode fields with the forks. */ 472 STATIC void 473 xchk_inode_xref_bmap( 474 struct xfs_scrub *sc, 475 struct xfs_dinode *dip) 476 { 477 xfs_extnum_t nextents; 478 xfs_filblks_t count; 479 xfs_filblks_t acount; 480 int error; 481 482 if (xchk_skip_xref(sc->sm)) 483 return; 484 485 /* Walk all the extents to check nextents/naextents/nblocks. */ 486 error = xfs_bmap_count_blocks(sc->tp, sc->ip, XFS_DATA_FORK, 487 &nextents, &count); 488 if (!xchk_should_check_xref(sc, &error, NULL)) 489 return; 490 if (nextents < be32_to_cpu(dip->di_nextents)) 491 xchk_ino_xref_set_corrupt(sc, sc->ip->i_ino); 492 493 error = xfs_bmap_count_blocks(sc->tp, sc->ip, XFS_ATTR_FORK, 494 &nextents, &acount); 495 if (!xchk_should_check_xref(sc, &error, NULL)) 496 return; 497 if (nextents != be16_to_cpu(dip->di_anextents)) 498 xchk_ino_xref_set_corrupt(sc, sc->ip->i_ino); 499 500 /* Check nblocks against the inode. */ 501 if (count + acount != be64_to_cpu(dip->di_nblocks)) 502 xchk_ino_xref_set_corrupt(sc, sc->ip->i_ino); 503 } 504 505 /* Cross-reference with the other btrees. */ 506 STATIC void 507 xchk_inode_xref( 508 struct xfs_scrub *sc, 509 xfs_ino_t ino, 510 struct xfs_dinode *dip) 511 { 512 xfs_agnumber_t agno; 513 xfs_agblock_t agbno; 514 int error; 515 516 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT) 517 return; 518 519 agno = XFS_INO_TO_AGNO(sc->mp, ino); 520 agbno = XFS_INO_TO_AGBNO(sc->mp, ino); 521 522 error = xchk_ag_init(sc, agno, &sc->sa); 523 if (!xchk_xref_process_error(sc, agno, agbno, &error)) 524 return; 525 526 xchk_xref_is_used_space(sc, agbno, 1); 527 xchk_inode_xref_finobt(sc, ino); 528 xchk_xref_is_owned_by(sc, agbno, 1, &XFS_RMAP_OINFO_INODES); 529 xchk_xref_is_not_shared(sc, agbno, 1); 530 xchk_inode_xref_bmap(sc, dip); 531 532 xchk_ag_free(sc, &sc->sa); 533 } 534 535 /* 536 * If the reflink iflag disagrees with a scan for shared data fork extents, 537 * either flag an error (shared extents w/ no flag) or a preen (flag set w/o 538 * any shared extents). We already checked for reflink iflag set on a non 539 * reflink filesystem. 540 */ 541 static void 542 xchk_inode_check_reflink_iflag( 543 struct xfs_scrub *sc, 544 xfs_ino_t ino) 545 { 546 struct xfs_mount *mp = sc->mp; 547 bool has_shared; 548 int error; 549 550 if (!xfs_sb_version_hasreflink(&mp->m_sb)) 551 return; 552 553 error = xfs_reflink_inode_has_shared_extents(sc->tp, sc->ip, 554 &has_shared); 555 if (!xchk_xref_process_error(sc, XFS_INO_TO_AGNO(mp, ino), 556 XFS_INO_TO_AGBNO(mp, ino), &error)) 557 return; 558 if (xfs_is_reflink_inode(sc->ip) && !has_shared) 559 xchk_ino_set_preen(sc, ino); 560 else if (!xfs_is_reflink_inode(sc->ip) && has_shared) 561 xchk_ino_set_corrupt(sc, ino); 562 } 563 564 /* Scrub an inode. */ 565 int 566 xchk_inode( 567 struct xfs_scrub *sc) 568 { 569 struct xfs_dinode di; 570 int error = 0; 571 572 /* 573 * If sc->ip is NULL, that means that the setup function called 574 * xfs_iget to look up the inode. xfs_iget returned a EFSCORRUPTED 575 * and a NULL inode, so flag the corruption error and return. 576 */ 577 if (!sc->ip) { 578 xchk_ino_set_corrupt(sc, sc->sm->sm_ino); 579 return 0; 580 } 581 582 /* Scrub the inode core. */ 583 xfs_inode_to_disk(sc->ip, &di, 0); 584 xchk_dinode(sc, &di, sc->ip->i_ino); 585 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT) 586 goto out; 587 588 /* 589 * Look for discrepancies between file's data blocks and the reflink 590 * iflag. We already checked the iflag against the file mode when 591 * we scrubbed the dinode. 592 */ 593 if (S_ISREG(VFS_I(sc->ip)->i_mode)) 594 xchk_inode_check_reflink_iflag(sc, sc->ip->i_ino); 595 596 xchk_inode_xref(sc, sc->ip->i_ino, &di); 597 out: 598 return error; 599 } 600