iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

xfs: online repair of directories [v30.3 09/16]

Browse Source 
This series employs atomic extent swapping to enable safe reconstruction
 of directory data.  For now, XFS does not support reverse directory
 links (aka parent pointers), so we can only salvage the dirents of a
 directory and construct a new structure.
 
 Directory repair therefore consists of five main parts:
 
 First, we walk the existing directory to salvage as many entries as we
 can, by adding them as new directory entries to the repair temp dir.
 
 Second, we validate the parent pointer found in the directory.  If one
 was not found, we scan the entire filesystem looking for a potential
 parent.
 
 Third, we use atomic extent swaps to exchange the entire data fork
 between the two directories.
 
 Fourth, we reap the old directory blocks as carefully as we can.
 
 To wrap up the directory repair code, we need to add to the regular
 filesystem the ability to free all the data fork blocks in a directory.
 This does not change anything with normal directories, since they must
 still unlink and shrink one entry at a time.  However, this will
 facilitate freeing of partially-inactivated temporary directories during
 log recovery.
 
 The second half of this patchset implements repairs for the dotdot
 entries of directories.  For now there is only rudimentary support for
 this, because there are no directory parent pointers, so the best we can
 do is scanning the filesystem and the VFS dcache for answers.
 
 This has been running on the djcloud for months with no problems.  Enjoy!
 
 Signed-off-by: Darrick J. Wong <djwong@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQ2qTKExjcn+O1o2YRKO3ySh0YRpgUCZh23UwAKCRBKO3ySh0YR
 piAGAP4hhYmBAiSGau5anRwUAFiELV2Irgz8k5oIGeWhg2m/kgEAn00d1rX8buLz
 ZQyYs1dSRtBpYs2EIZRTnnM2W4dYLQY=
 =2L3x
 -----END PGP SIGNATURE-----

Merge tag 'repair-dirs-6.10_2024-04-15' of https://git.kernel.org/pub/scm/linux/kernel/git/djwong/xfs-linux into xfs-6.10-mergeA

xfs: online repair of directories

This series employs atomic extent swapping to enable safe reconstruction
of directory data.  For now, XFS does not support reverse directory
links (aka parent pointers), so we can only salvage the dirents of a
directory and construct a new structure.

Directory repair therefore consists of five main parts:

First, we walk the existing directory to salvage as many entries as we
can, by adding them as new directory entries to the repair temp dir.

Second, we validate the parent pointer found in the directory.  If one
was not found, we scan the entire filesystem looking for a potential
parent.

Third, we use atomic extent swaps to exchange the entire data fork
between the two directories.

Fourth, we reap the old directory blocks as carefully as we can.

To wrap up the directory repair code, we need to add to the regular
filesystem the ability to free all the data fork blocks in a directory.
This does not change anything with normal directories, since they must
still unlink and shrink one entry at a time.  However, this will
facilitate freeing of partially-inactivated temporary directories during
log recovery.

The second half of this patchset implements repairs for the dotdot
entries of directories.  For now there is only rudimentary support for
this, because there are no directory parent pointers, so the best we can
do is scanning the filesystem and the VFS dcache for answers.

Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Chandan Babu R <chandanbabu@kernel.org>

* tag 'repair-dirs-6.10_2024-04-15' of https://git.kernel.org/pub/scm/linux/kernel/git/djwong/xfs-linux:
  xfs: ask the dentry cache if it knows the parent of a directory
  xfs: online repair of parent pointers
  xfs: scan the filesystem to repair a directory dotdot entry
  xfs: online repair of directories
  xfs: inactivate directory data blocks
This commit is contained in:
Chandan Babu R 2024-04-16 12:01:06 +05:30
commit 9e6b93b727
21 changed files with 2437 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
fs/xfs/Makefile
View File

@ -198,11 +198,14 @@ xfs-y += $(addprefix scrub/, \
attr_repair.o \
bmap_repair.o \
cow_repair.o \
dir_repair.o \
findparent.o \
fscounters_repair.o \
ialloc_repair.o \
inode_repair.o \
newbt.o \
nlinks_repair.o \
parent_repair.o \
rcbag_btree.o \
rcbag.o \
reap.o \

9
fs/xfs/scrub/dir.c
View File

@ -21,12 +21,21 @@
#include "scrub/dabtree.h"
#include "scrub/readdir.h"
#include "scrub/health.h"
#include "scrub/repair.h"
/* Set us up to scrub directories. */
int
xchk_setup_directory(
struct xfs_scrub *sc)
{
int error;
if (xchk_could_repair(sc)) {
error = xrep_setup_directory(sc);
if (error)
return error;
}
return xchk_setup_inode_contents(sc, 0);
}

1402
fs/xfs/scrub/dir_repair.c Normal file
View File

File diff suppressed because it is too large Load Diff

448
fs/xfs/scrub/findparent.c Normal file
View File

@ -0,0 +1,448 @@
// SPDX-License-Identifier: GPL-2.0-or-later
/*
* Copyright (c) 2020-2024 Oracle. All Rights Reserved.
* Author: Darrick J. Wong <djwong@kernel.org>
*/
#include "xfs.h"
#include "xfs_fs.h"
#include "xfs_shared.h"
#include "xfs_format.h"
#include "xfs_trans_resv.h"
#include "xfs_mount.h"
#include "xfs_defer.h"
#include "xfs_bit.h"
#include "xfs_log_format.h"
#include "xfs_trans.h"
#include "xfs_sb.h"
#include "xfs_inode.h"
#include "xfs_icache.h"
#include "xfs_da_format.h"
#include "xfs_da_btree.h"
#include "xfs_dir2.h"
#include "xfs_bmap_btree.h"
#include "xfs_dir2_priv.h"
#include "xfs_trans_space.h"
#include "xfs_health.h"
#include "xfs_exchmaps.h"
#include "scrub/xfs_scrub.h"
#include "scrub/scrub.h"
#include "scrub/common.h"
#include "scrub/trace.h"
#include "scrub/repair.h"
#include "scrub/iscan.h"
#include "scrub/findparent.h"
#include "scrub/readdir.h"
#include "scrub/tempfile.h"
/*
* Finding the Parent of a Directory
* =================================
*
* Directories have parent pointers, in the sense that each directory contains
* a dotdot entry that points to the single allowed parent. The brute force
* way to find the parent of a given directory is to scan every directory in
* the filesystem looking for a child dirent that references this directory.
*
* This module wraps the process of scanning the directory tree. It requires
* that @sc->ip is the directory whose parent we want to find, and that the
* caller hold only the IOLOCK on that directory. The scan itself needs to
* take the ILOCK of each directory visited.
*
* Because we cannot hold @sc->ip's ILOCK during a scan of the whole fs, it is
* necessary to use dirent hook to update the parent scan results. Callers
* must not read the scan results without re-taking @sc->ip's ILOCK.
*
* There are a few shortcuts that we can take to avoid scanning the entire
* filesystem, such as noticing directory tree roots and querying the dentry
* cache for parent information.
*/
struct xrep_findparent_info {
/* The directory currently being scanned. */
struct xfs_inode *dp;
/*
* Scrub context. We're looking for a @dp containing a directory
* entry pointing to sc->ip->i_ino.
*/
struct xfs_scrub *sc;
/* Optional scan information for a xrep_findparent_scan call. */
struct xrep_parent_scan_info *parent_scan;
/*
* Parent that we've found for sc->ip. If we're scanning the entire
* directory tree, we need this to ensure that we only find /one/
* parent directory.
*/
xfs_ino_t found_parent;
/*
* This is set to true if @found_parent was not observed directly from
* the directory scan but by noticing a change in dotdot entries after
* cycling the sc->ip IOLOCK.
*/
bool parent_tentative;
};
/*
* If this directory entry points to the scrub target inode, then the directory
* we're scanning is the parent of the scrub target inode.
*/
STATIC int
xrep_findparent_dirent(
struct xfs_scrub *sc,
struct xfs_inode *dp,
xfs_dir2_dataptr_t dapos,
const struct xfs_name *name,
xfs_ino_t ino,
void *priv)
{
struct xrep_findparent_info *fpi = priv;
int error = 0;
if (xchk_should_terminate(fpi->sc, &error))
return error;
if (ino != fpi->sc->ip->i_ino)
return 0;
/* Ignore garbage directory entry names. */
if (name->len == 0 || !xfs_dir2_namecheck(name->name, name->len))
return -EFSCORRUPTED;
/*
* Ignore dotdot and dot entries -- we're looking for parent -> child
* links only.
*/
if (name->name[0] == '.' && (name->len == 1 ||
(name->len == 2 && name->name[1] == '.')))
return 0;
/* Uhoh, more than one parent for a dir? */
if (fpi->found_parent != NULLFSINO &&
!(fpi->parent_tentative && fpi->found_parent == fpi->dp->i_ino)) {
trace_xrep_findparent_dirent(fpi->sc->ip, 0);
return -EFSCORRUPTED;
}
/* We found a potential parent; remember this. */
trace_xrep_findparent_dirent(fpi->sc->ip, fpi->dp->i_ino);
fpi->found_parent = fpi->dp->i_ino;
fpi->parent_tentative = false;
if (fpi->parent_scan)
xrep_findparent_scan_found(fpi->parent_scan, fpi->dp->i_ino);
return 0;
}
/*
* If this is a directory, walk the dirents looking for any that point to the
* scrub target inode.
*/
STATIC int
xrep_findparent_walk_directory(
struct xrep_findparent_info *fpi)
{
struct xfs_scrub *sc = fpi->sc;
struct xfs_inode *dp = fpi->dp;
unsigned int lock_mode;
int error = 0;
/*
* The inode being scanned cannot be its own parent, nor can any
* temporary directory we created to stage this repair.
*/
if (dp == sc->ip || dp == sc->tempip)
return 0;
/*
* Similarly, temporary files created to stage a repair cannot be the
* parent of this inode.
*/
if (xrep_is_tempfile(dp))
return 0;
/*
* Scan the directory to see if there it contains an entry pointing to
* the directory that we are repairing.
*/
lock_mode = xfs_ilock_data_map_shared(dp);
/*
* If this directory is known to be sick, we cannot scan it reliably
* and must abort.
*/
if (xfs_inode_has_sickness(dp, XFS_SICK_INO_CORE |
XFS_SICK_INO_BMBTD |
XFS_SICK_INO_DIR)) {
error = -EFSCORRUPTED;
goto out_unlock;
}
/*
* We cannot complete our parent pointer scan if a directory looks as
* though it has been zapped by the inode record repair code.
*/
if (xchk_dir_looks_zapped(dp)) {
error = -EBUSY;
goto out_unlock;
}
error = xchk_dir_walk(sc, dp, xrep_findparent_dirent, fpi);
if (error)
goto out_unlock;
out_unlock:
xfs_iunlock(dp, lock_mode);
return error;
}
/*
* Update this directory's dotdot pointer based on ongoing dirent updates.
*/
STATIC int
xrep_findparent_live_update(
struct notifier_block *nb,
unsigned long action,
void *data)
{
struct xfs_dir_update_params *p = data;
struct xrep_parent_scan_info *pscan;
struct xfs_scrub *sc;
pscan = container_of(nb, struct xrep_parent_scan_info,
dhook.dirent_hook.nb);
sc = pscan->sc;
/*
* If @p->ip is the subdirectory that we're interested in and we've
* already scanned @p->dp, update the dotdot target inumber to the
* parent inode.
*/
if (p->ip->i_ino == sc->ip->i_ino &&
xchk_iscan_want_live_update(&pscan->iscan, p->dp->i_ino)) {
if (p->delta > 0) {
xrep_findparent_scan_found(pscan, p->dp->i_ino);
} else {
xrep_findparent_scan_found(pscan, NULLFSINO);
}
}
return NOTIFY_DONE;
}
/*
* Set up a scan to find the parent of a directory. The provided dirent hook
* will be called when there is a dotdot update for the inode being repaired.
*/
int
xrep_findparent_scan_start(
struct xfs_scrub *sc,
struct xrep_parent_scan_info *pscan)
{
int error;
if (!(sc->flags & XCHK_FSGATES_DIRENTS)) {
ASSERT(sc->flags & XCHK_FSGATES_DIRENTS);
return -EINVAL;
}
pscan->sc = sc;
pscan->parent_ino = NULLFSINO;
mutex_init(&pscan->lock);
xchk_iscan_start(sc, 30000, 100, &pscan->iscan);
/*
* Hook into the dirent update code. The hook only operates on inodes
* that were already scanned, and the scanner thread takes each inode's
* ILOCK, which means that any in-progress inode updates will finish
* before we can scan the inode.
*/
xfs_dir_hook_setup(&pscan->dhook, xrep_findparent_live_update);
error = xfs_dir_hook_add(sc->mp, &pscan->dhook);
if (error)
goto out_iscan;
return 0;
out_iscan:
xchk_iscan_teardown(&pscan->iscan);
mutex_destroy(&pscan->lock);
return error;
}
/*
* Scan the entire filesystem looking for a parent inode for the inode being
* scrubbed. @sc->ip must not be the root of a directory tree. Callers must
* not hold a dirty transaction or any lock that would interfere with taking
* an ILOCK.
*
* Returns 0 with @pscan->parent_ino set to the parent that we found.
* Returns 0 with @pscan->parent_ino set to NULLFSINO if we found no parents.
* Returns the usual negative errno if something else happened.
*/
int
xrep_findparent_scan(
struct xrep_parent_scan_info *pscan)
{
struct xrep_findparent_info fpi = {
.sc = pscan->sc,
.found_parent = NULLFSINO,
.parent_scan = pscan,
};
struct xfs_scrub *sc = pscan->sc;
int ret;
ASSERT(S_ISDIR(VFS_IC(sc->ip)->i_mode));
while ((ret = xchk_iscan_iter(&pscan->iscan, &fpi.dp)) == 1) {
if (S_ISDIR(VFS_I(fpi.dp)->i_mode))
ret = xrep_findparent_walk_directory(&fpi);
else
ret = 0;
xchk_iscan_mark_visited(&pscan->iscan, fpi.dp);
xchk_irele(sc, fpi.dp);
if (ret)
break;
if (xchk_should_terminate(sc, &ret))
break;
}
xchk_iscan_iter_finish(&pscan->iscan);
return ret;
}
/* Tear down a parent scan. */
void
xrep_findparent_scan_teardown(
struct xrep_parent_scan_info *pscan)
{
xfs_dir_hook_del(pscan->sc->mp, &pscan->dhook);
xchk_iscan_teardown(&pscan->iscan);
mutex_destroy(&pscan->lock);
}
/* Finish a parent scan early. */
void
xrep_findparent_scan_finish_early(
struct xrep_parent_scan_info *pscan,
xfs_ino_t ino)
{
xrep_findparent_scan_found(pscan, ino);
xchk_iscan_finish_early(&pscan->iscan);
}
/*
* Confirm that the directory @parent_ino actually contains a directory entry
* pointing to the child @sc->ip->ino. This function returns one of several
* ways:
*
* Returns 0 with @parent_ino unchanged if the parent was confirmed.
* Returns 0 with @parent_ino set to NULLFSINO if the parent was not valid.
* Returns the usual negative errno if something else happened.
*/
int
xrep_findparent_confirm(
struct xfs_scrub *sc,
xfs_ino_t *parent_ino)
{
struct xrep_findparent_info fpi = {
.sc = sc,
.found_parent = NULLFSINO,
};
int error;
/*
* The root directory always points to itself. Unlinked dirs can point
* anywhere, so we point them at the root dir too.
*/
if (sc->ip == sc->mp->m_rootip || VFS_I(sc->ip)->i_nlink == 0) {
*parent_ino = sc->mp->m_sb.sb_rootino;
return 0;
}
/* Reject garbage parent inode numbers and self-referential parents. */
if (*parent_ino == NULLFSINO)
return 0;
if (!xfs_verify_dir_ino(sc->mp, *parent_ino) ||
*parent_ino == sc->ip->i_ino) {
*parent_ino = NULLFSINO;
return 0;
}
error = xchk_iget(sc, *parent_ino, &fpi.dp);
if (error)
return error;
if (!S_ISDIR(VFS_I(fpi.dp)->i_mode)) {
*parent_ino = NULLFSINO;
goto out_rele;
}
error = xrep_findparent_walk_directory(&fpi);
if (error)
goto out_rele;
*parent_ino = fpi.found_parent;
out_rele:
xchk_irele(sc, fpi.dp);
return error;
}
/*
* If we're the root of a directory tree, we are our own parent. If we're an
* unlinked directory, the parent /won't/ have a link to us. Set the parent
* directory to the root for both cases. Returns NULLFSINO if we don't know
* what to do.
*/
xfs_ino_t
xrep_findparent_self_reference(
struct xfs_scrub *sc)
{
if (sc->ip->i_ino == sc->mp->m_sb.sb_rootino)
return sc->mp->m_sb.sb_rootino;
if (VFS_I(sc->ip)->i_nlink == 0)
return sc->mp->m_sb.sb_rootino;
return NULLFSINO;
}
/* Check the dentry cache to see if knows of a parent for the scrub target. */
xfs_ino_t
xrep_findparent_from_dcache(
struct xfs_scrub *sc)
{
struct inode *pip = NULL;
struct dentry *dentry, *parent;
xfs_ino_t ret = NULLFSINO;
dentry = d_find_alias(VFS_I(sc->ip));
if (!dentry)
goto out;
parent = dget_parent(dentry);
if (!parent)
goto out_dput;
ASSERT(parent->d_sb == sc->ip->i_mount->m_super);
pip = igrab(d_inode(parent));
dput(parent);
if (S_ISDIR(pip->i_mode)) {
trace_xrep_findparent_from_dcache(sc->ip, XFS_I(pip)->i_ino);
ret = XFS_I(pip)->i_ino;
}
xchk_irele(sc, XFS_I(pip));
out_dput:
dput(dentry);
out:
return ret;
}

50
fs/xfs/scrub/findparent.h Normal file
View File

@ -0,0 +1,50 @@
/* SPDX-License-Identifier: GPL-2.0-or-later */
/*
* Copyright (c) 2020-2024 Oracle. All Rights Reserved.
* Author: Darrick J. Wong <djwong@kernel.org>
*/
#ifndef __XFS_SCRUB_FINDPARENT_H__
#define __XFS_SCRUB_FINDPARENT_H__
struct xrep_parent_scan_info {
struct xfs_scrub *sc;
/* Inode scan cursor. */
struct xchk_iscan iscan;
/* Hook to capture directory entry updates. */
struct xfs_dir_hook dhook;
/* Lock protecting parent_ino. */
struct mutex lock;
/* Parent inode that we've found. */
xfs_ino_t parent_ino;
bool lookup_parent;
};
int xrep_findparent_scan_start(struct xfs_scrub *sc,
struct xrep_parent_scan_info *pscan);
int xrep_findparent_scan(struct xrep_parent_scan_info *pscan);
void xrep_findparent_scan_teardown(struct xrep_parent_scan_info *pscan);
static inline void
xrep_findparent_scan_found(
struct xrep_parent_scan_info *pscan,
xfs_ino_t ino)
{
mutex_lock(&pscan->lock);
pscan->parent_ino = ino;
mutex_unlock(&pscan->lock);
}
void xrep_findparent_scan_finish_early(struct xrep_parent_scan_info *pscan,
xfs_ino_t ino);
int xrep_findparent_confirm(struct xfs_scrub *sc, xfs_ino_t *parent_ino);
xfs_ino_t xrep_findparent_self_reference(struct xfs_scrub *sc);
xfs_ino_t xrep_findparent_from_dcache(struct xfs_scrub *sc);
#endif /* __XFS_SCRUB_FINDPARENT_H__ */

5
fs/xfs/scrub/inode_repair.c
View File

@ -46,6 +46,7 @@
#include "scrub/repair.h"
#include "scrub/iscan.h"
#include "scrub/readdir.h"
#include "scrub/tempfile.h"
/*
* Inode Record Repair
@ -340,6 +341,10 @@ xrep_dinode_findmode_walk_directory(
unsigned int lock_mode;
int error = 0;
/* Ignore temporary repair directories. */
if (xrep_is_tempfile(dp))
return 0;
/*
* Scan the directory to see if there it contains an entry pointing to
* the directory that we are repairing.

18
fs/xfs/scrub/iscan.c
View File

@ -243,6 +243,17 @@ xchk_iscan_finish(
mutex_unlock(&iscan->lock);
}
/* Mark an inode scan finished before we actually scan anything. */
void
xchk_iscan_finish_early(
struct xchk_iscan *iscan)
{
ASSERT(iscan->cursor_ino == iscan->scan_start_ino);
ASSERT(iscan->__visited_ino == iscan->scan_start_ino);
xchk_iscan_finish(iscan);
}
/*
* Grab the AGI to advance the inode scan. Returns 0 if *agi_bpp is now set,
* -ECANCELED if the live scan aborted, -EBUSY if the AGI could not be grabbed,
@ -436,8 +447,13 @@ xchk_iscan_iget(
* It's possible that this inode has lost all of its links but
* hasn't yet been inactivated. If we don't have a transaction
* or it's not writable, flush the inodegc workers and wait.
* If we have a non-empty transaction, we must not block on
* inodegc, which allocates its own transactions.
*/
xfs_inodegc_flush(mp);
if (sc->tp && !(sc->tp->t_flags & XFS_TRANS_NO_WRITECOUNT))
xfs_inodegc_push(mp);
else
xfs_inodegc_flush(mp);
return xchk_iscan_iget_retry(iscan, true);
}

1
fs/xfs/scrub/iscan.h
View File

@ -88,6 +88,7 @@ xchk_iscan_set_agi_trylock(struct xchk_iscan *iscan)
void xchk_iscan_start(struct xfs_scrub *sc, unsigned int iget_timeout,
unsigned int iget_retry_delay, struct xchk_iscan *iscan);
void xchk_iscan_finish_early(struct xchk_iscan *iscan);
void xchk_iscan_teardown(struct xchk_iscan *iscan);
int xchk_iscan_iter(struct xchk_iscan *iscan, struct xfs_inode **ipp);

23
fs/xfs/scrub/nlinks.c
View File

@ -27,6 +27,7 @@
#include "scrub/nlinks.h"
#include "scrub/trace.h"
#include "scrub/readdir.h"
#include "scrub/tempfile.h"
/*
* Live Inode Link Count Checking
@ -152,6 +153,13 @@ xchk_nlinks_live_update(
xnc = container_of(nb, struct xchk_nlink_ctrs, dhook.dirent_hook.nb);
/*
* Ignore temporary directories being used to stage dir repairs, since
* we don't bump the link counts of the children.
*/
if (xrep_is_tempfile(p->dp))
return NOTIFY_DONE;
trace_xchk_nlinks_live_update(xnc->sc->mp, p->dp, action, p->ip->i_ino,
p->delta, p->name->name, p->name->len);
@ -303,6 +311,13 @@ xchk_nlinks_collect_dir(
unsigned int lock_mode;
int error = 0;
/*
* Ignore temporary directories being used to stage dir repairs, since
* we don't bump the link counts of the children.
*/
if (xrep_is_tempfile(dp))
return 0;
/* Prevent anyone from changing this directory while we walk it. */
xfs_ilock(dp, XFS_IOLOCK_SHARED);
lock_mode = xfs_ilock_data_map_shared(dp);
@ -537,6 +552,14 @@ xchk_nlinks_compare_inode(
unsigned int actual_nlink;
int error;
/*
* Ignore temporary files being used to stage repairs, since we assume
* they're correct for non-directories, and the directory repair code
* doesn't bump the link counts for the children.
*/
if (xrep_is_tempfile(ip))
return 0;
xfs_ilock(ip, XFS_ILOCK_SHARED);
mutex_lock(&xnc->lock);

9
fs/xfs/scrub/nlinks_repair.c
View File

@ -26,6 +26,7 @@
#include "scrub/iscan.h"
#include "scrub/nlinks.h"
#include "scrub/trace.h"
#include "scrub/tempfile.h"
/*
* Live Inode Link Count Repair
@ -68,6 +69,14 @@ xrep_nlinks_repair_inode(
bool dirty = false;
int error;
/*
* Ignore temporary files being used to stage repairs, since we assume
* they're correct for non-directories, and the directory repair code
* doesn't bump the link counts for the children.
*/
if (xrep_is_tempfile(ip))
return 0;
xchk_ilock(sc, XFS_IOLOCK_EXCL);
error = xfs_trans_alloc(mp, &M_RES(mp)->tr_link, 0, 0, 0, &sc->tp);

14
fs/xfs/scrub/parent.c
View File

@ -10,6 +10,7 @@
#include "xfs_trans_resv.h"
#include "xfs_mount.h"
#include "xfs_log_format.h"
#include "xfs_trans.h"
#include "xfs_inode.h"
#include "xfs_icache.h"
#include "xfs_dir2.h"
@ -17,12 +18,22 @@
#include "scrub/scrub.h"
#include "scrub/common.h"
#include "scrub/readdir.h"
#include "scrub/tempfile.h"
#include "scrub/repair.h"
/* Set us up to scrub parents. */
int
xchk_setup_parent(
struct xfs_scrub *sc)
{
int error;
if (xchk_could_repair(sc)) {
error = xrep_setup_parent(sc);
if (error)
return error;
}
return xchk_setup_inode_contents(sc, 0);
}
@ -143,7 +154,8 @@ xchk_parent_validate(
}
if (!xchk_fblock_xref_process_error(sc, XFS_DATA_FORK, 0, &error))
return error;
if (dp == sc->ip || dp == sc->tempip || !S_ISDIR(VFS_I(dp)->i_mode)) {
if (dp == sc->ip || xrep_is_tempfile(dp) ||
!S_ISDIR(VFS_I(dp)->i_mode)) {
xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
goto out_rele;
}

234
fs/xfs/scrub/parent_repair.c Normal file
View File

@ -0,0 +1,234 @@
// SPDX-License-Identifier: GPL-2.0-or-later
/*
* Copyright (c) 2020-2024 Oracle. All Rights Reserved.
* Author: Darrick J. Wong <djwong@kernel.org>
*/
#include "xfs.h"
#include "xfs_fs.h"
#include "xfs_shared.h"
#include "xfs_format.h"
#include "xfs_trans_resv.h"
#include "xfs_mount.h"
#include "xfs_defer.h"
#include "xfs_bit.h"
#include "xfs_log_format.h"
#include "xfs_trans.h"
#include "xfs_sb.h"
#include "xfs_inode.h"
#include "xfs_icache.h"
#include "xfs_da_format.h"
#include "xfs_da_btree.h"
#include "xfs_dir2.h"
#include "xfs_bmap_btree.h"
#include "xfs_dir2_priv.h"
#include "xfs_trans_space.h"
#include "xfs_health.h"
#include "xfs_exchmaps.h"
#include "scrub/xfs_scrub.h"
#include "scrub/scrub.h"
#include "scrub/common.h"
#include "scrub/trace.h"
#include "scrub/repair.h"
#include "scrub/iscan.h"
#include "scrub/findparent.h"
#include "scrub/readdir.h"
/*
* Repairing The Directory Parent Pointer
* ======================================
*
* Currently, only directories support parent pointers (in the form of '..'
* entries), so we simply scan the filesystem and update the '..' entry.
*
* Note that because the only parent pointer is the dotdot entry, we won't
* touch an unhealthy directory, since the directory repair code is perfectly
* capable of rebuilding a directory with the proper parent inode.
*
* See the section on locking issues in dir_repair.c for more information about
* conflicts with the VFS. The findparent code wll keep our incore parent
* inode up to date.
*/
struct xrep_parent {
struct xfs_scrub *sc;
/*
* Information used to scan the filesystem to find the inumber of the
* dotdot entry for this directory.
*/
struct xrep_parent_scan_info pscan;
};
/* Tear down all the incore stuff we created. */
static void
xrep_parent_teardown(
struct xrep_parent *rp)
{
xrep_findparent_scan_teardown(&rp->pscan);
}
/* Set up for a parent repair. */
int
xrep_setup_parent(
struct xfs_scrub *sc)
{
struct xrep_parent *rp;
xchk_fsgates_enable(sc, XCHK_FSGATES_DIRENTS);
rp = kvzalloc(sizeof(struct xrep_parent), XCHK_GFP_FLAGS);
if (!rp)
return -ENOMEM;
rp->sc = sc;
sc->buf = rp;
return 0;
}
/*
* Scan all files in the filesystem for a child dirent that we can turn into
* the dotdot entry for this directory.
*/
STATIC int
xrep_parent_find_dotdot(
struct xrep_parent *rp)
{
struct xfs_scrub *sc = rp->sc;
xfs_ino_t ino;
unsigned int sick, checked;
int error;
/*
* Avoid sick directories. There shouldn't be anyone else clearing the
* directory's sick status.
*/
xfs_inode_measure_sickness(sc->ip, &sick, &checked);
if (sick & XFS_SICK_INO_DIR)
return -EFSCORRUPTED;
ino = xrep_findparent_self_reference(sc);
if (ino != NULLFSINO) {
xrep_findparent_scan_finish_early(&rp->pscan, ino);
return 0;
}
/*
* Drop the ILOCK on this directory so that we can scan for the dotdot
* entry. Figure out who is going to be the parent of this directory,
* then retake the ILOCK so that we can salvage directory entries.
*/
xchk_iunlock(sc, XFS_ILOCK_EXCL);
/* Does the VFS dcache have an answer for us? */
ino = xrep_findparent_from_dcache(sc);
if (ino != NULLFSINO) {
error = xrep_findparent_confirm(sc, &ino);
if (!error && ino != NULLFSINO) {
xrep_findparent_scan_finish_early(&rp->pscan, ino);
goto out_relock;
}
}
/* Scan the entire filesystem for a parent. */
error = xrep_findparent_scan(&rp->pscan);
out_relock:
xchk_ilock(sc, XFS_ILOCK_EXCL);
return error;
}
/* Reset a directory's dotdot entry, if needed. */
STATIC int
xrep_parent_reset_dotdot(
struct xrep_parent *rp)
{
struct xfs_scrub *sc = rp->sc;
xfs_ino_t ino;
unsigned int spaceres;
int error = 0;
ASSERT(sc->ilock_flags & XFS_ILOCK_EXCL);
error = xchk_dir_lookup(sc, sc->ip, &xfs_name_dotdot, &ino);
if (error || ino == rp->pscan.parent_ino)
return error;
xfs_trans_ijoin(sc->tp, sc->ip, 0);
trace_xrep_parent_reset_dotdot(sc->ip, rp->pscan.parent_ino);
/*
* Reserve more space just in case we have to expand the dir. We're
* allowed to exceed quota to repair inconsistent metadata.
*/
spaceres = XFS_RENAME_SPACE_RES(sc->mp, xfs_name_dotdot.len);
error = xfs_trans_reserve_more_inode(sc->tp, sc->ip, spaceres, 0,
true);
if (error)
return error;
error = xfs_dir_replace(sc->tp, sc->ip, &xfs_name_dotdot,
rp->pscan.parent_ino, spaceres);
if (error)
return error;
/*
* Roll transaction to detach the inode from the transaction but retain
* ILOCK_EXCL.
*/
return xfs_trans_roll(&sc->tp);
}
/*
* Commit the new parent pointer structure (currently only the dotdot entry) to
* the file that we're repairing.
*/
STATIC int
xrep_parent_rebuild_tree(
struct xrep_parent *rp)
{
if (rp->pscan.parent_ino == NULLFSINO) {
/* Cannot fix orphaned directories yet. */
return -EFSCORRUPTED;
}
return xrep_parent_reset_dotdot(rp);
}
/* Set up the filesystem scan so we can look for parents. */
STATIC int
xrep_parent_setup_scan(
struct xrep_parent *rp)
{
struct xfs_scrub *sc = rp->sc;
return xrep_findparent_scan_start(sc, &rp->pscan);
}
int
xrep_parent(
struct xfs_scrub *sc)
{
struct xrep_parent *rp = sc->buf;
int error;
error = xrep_parent_setup_scan(rp);
if (error)
return error;
error = xrep_parent_find_dotdot(rp);
if (error)
goto out_teardown;
/* Last chance to abort before we start committing fixes. */
if (xchk_should_terminate(sc, &error))
goto out_teardown;
error = xrep_parent_rebuild_tree(rp);
if (error)
goto out_teardown;
out_teardown:
xrep_parent_teardown(rp);
return error;
}

7
fs/xfs/scrub/readdir.c
View File

@ -333,6 +333,13 @@ xchk_dir_lookup(
if (xfs_is_shutdown(dp->i_mount))
return -EIO;
/*
* A temporary directory's block headers are written with the owner
* set to sc->ip, so we must switch the owner here for the lookup.
*/
if (dp == sc->tempip)
args.owner = sc->ip->i_ino;
ASSERT(S_ISDIR(VFS_I(dp)->i_mode));
xfs_assert_ilocked(dp, XFS_ILOCK_SHARED | XFS_ILOCK_EXCL);

1
fs/xfs/scrub/repair.c
View File

@ -35,6 +35,7 @@
#include "xfs_da_format.h"
#include "xfs_da_btree.h"
#include "xfs_attr.h"
#include "xfs_dir2.h"
#include "scrub/scrub.h"
#include "scrub/common.h"
#include "scrub/trace.h"

8
fs/xfs/scrub/repair.h
View File

@ -91,6 +91,8 @@ int xrep_metadata_inode_forks(struct xfs_scrub *sc);
int xrep_setup_ag_rmapbt(struct xfs_scrub *sc);
int xrep_setup_ag_refcountbt(struct xfs_scrub *sc);
int xrep_setup_xattr(struct xfs_scrub *sc);
int xrep_setup_directory(struct xfs_scrub *sc);
int xrep_setup_parent(struct xfs_scrub *sc);
/* Repair setup functions */
int xrep_setup_ag_allocbt(struct xfs_scrub *sc);
@ -125,6 +127,8 @@ int xrep_bmap_cow(struct xfs_scrub *sc);
int xrep_nlinks(struct xfs_scrub *sc);
int xrep_fscounters(struct xfs_scrub *sc);
int xrep_xattr(struct xfs_scrub *sc);
int xrep_directory(struct xfs_scrub *sc);
int xrep_parent(struct xfs_scrub *sc);
#ifdef CONFIG_XFS_RT
int xrep_rtbitmap(struct xfs_scrub *sc);
@ -195,6 +199,8 @@ xrep_setup_nothing(
#define xrep_setup_ag_rmapbt xrep_setup_nothing
#define xrep_setup_ag_refcountbt xrep_setup_nothing
#define xrep_setup_xattr xrep_setup_nothing
#define xrep_setup_directory xrep_setup_nothing
#define xrep_setup_parent xrep_setup_nothing
#define xrep_setup_inode(sc, imap) ((void)0)
@ -221,6 +227,8 @@ xrep_setup_nothing(
#define xrep_fscounters xrep_notsupported
#define xrep_rtsummary xrep_notsupported
#define xrep_xattr xrep_notsupported
#define xrep_directory xrep_notsupported
#define xrep_parent xrep_notsupported
#endif /* CONFIG_XFS_ONLINE_REPAIR */

4
fs/xfs/scrub/scrub.c
View File

@ -325,7 +325,7 @@ static const struct xchk_meta_ops meta_scrub_ops[] = {
.type = ST_INODE,
.setup = xchk_setup_directory,
.scrub = xchk_directory,
.repair = xrep_notsupported,
.repair = xrep_directory,
},
[XFS_SCRUB_TYPE_XATTR] = { /* extended attributes */
.type = ST_INODE,
@ -343,7 +343,7 @@ static const struct xchk_meta_ops meta_scrub_ops[] = {
.type = ST_INODE,
.setup = xchk_setup_parent,
.scrub = xchk_parent,
.repair = xrep_notsupported,
.repair = xrep_parent,
},
[XFS_SCRUB_TYPE_RTBITMAP] = { /* realtime bitmap */
.type = ST_FS,

13
fs/xfs/scrub/tempfile.c
View File

@ -841,3 +841,16 @@ xrep_tempfile_copyout_local(
ilog_flags |= xfs_ilog_fdata(whichfork);
xfs_trans_log_inode(sc->tp, sc->ip, ilog_flags);
}
/* Decide if a given XFS inode is a temporary file for a repair. */
bool
xrep_is_tempfile(
const struct xfs_inode *ip)
{
const struct inode *inode = &ip->i_vnode;
if (IS_PRIVATE(inode) && !(inode->i_opflags & IOP_XATTR))
return true;
return false;
}

2
fs/xfs/scrub/tempfile.h
View File

@ -35,11 +35,13 @@ int xrep_tempfile_set_isize(struct xfs_scrub *sc, unsigned long long isize);
int xrep_tempfile_roll_trans(struct xfs_scrub *sc);
void xrep_tempfile_copyout_local(struct xfs_scrub *sc, int whichfork);
bool xrep_is_tempfile(const struct xfs_inode *ip);
#else
static inline void xrep_tempfile_iolock_both(struct xfs_scrub *sc)
{
xchk_ilock(sc, XFS_IOLOCK_EXCL);
}
# define xrep_is_tempfile(ip) (false)
# define xrep_tempfile_rele(sc)
#endif /* CONFIG_XFS_ONLINE_REPAIR */

115
fs/xfs/scrub/trace.h
View File

@ -2500,6 +2500,121 @@ DEFINE_EVENT(xrep_xattr_class, name, \
DEFINE_XREP_XATTR_EVENT(xrep_xattr_rebuild_tree);
DEFINE_XREP_XATTR_EVENT(xrep_xattr_reset_fork);
TRACE_EVENT(xrep_dir_recover_dirblock,
TP_PROTO(struct xfs_inode *dp, xfs_dablk_t dabno, uint32_t magic,
uint32_t magic_guess),
TP_ARGS(dp, dabno, magic, magic_guess),
TP_STRUCT__entry(
__field(dev_t, dev)
__field(xfs_ino_t, dir_ino)
__field(xfs_dablk_t, dabno)
__field(uint32_t, magic)
__field(uint32_t, magic_guess)
),
TP_fast_assign(
__entry->dev = dp->i_mount->m_super->s_dev;
__entry->dir_ino = dp->i_ino;
__entry->dabno = dabno;
__entry->magic = magic;
__entry->magic_guess = magic_guess;
),
TP_printk("dev %d:%d dir 0x%llx dablk 0x%x magic 0x%x magic_guess 0x%x",
MAJOR(__entry->dev), MINOR(__entry->dev),
__entry->dir_ino,
__entry->dabno,
__entry->magic,
__entry->magic_guess)
);
DECLARE_EVENT_CLASS(xrep_dir_class,
TP_PROTO(struct xfs_inode *dp, xfs_ino_t parent_ino),
TP_ARGS(dp, parent_ino),
TP_STRUCT__entry(
__field(dev_t, dev)
__field(xfs_ino_t, dir_ino)
__field(xfs_ino_t, parent_ino)
),
TP_fast_assign(
__entry->dev = dp->i_mount->m_super->s_dev;
__entry->dir_ino = dp->i_ino;
__entry->parent_ino = parent_ino;
),
TP_printk("dev %d:%d dir 0x%llx parent 0x%llx",
MAJOR(__entry->dev), MINOR(__entry->dev),
__entry->dir_ino,
__entry->parent_ino)
)
#define DEFINE_XREP_DIR_EVENT(name) \
DEFINE_EVENT(xrep_dir_class, name, \
TP_PROTO(struct xfs_inode *dp, xfs_ino_t parent_ino), \
TP_ARGS(dp, parent_ino))
DEFINE_XREP_DIR_EVENT(xrep_dir_rebuild_tree);
DEFINE_XREP_DIR_EVENT(xrep_dir_reset_fork);
DEFINE_XREP_DIR_EVENT(xrep_parent_reset_dotdot);
DECLARE_EVENT_CLASS(xrep_dirent_class,
TP_PROTO(struct xfs_inode *dp, const struct xfs_name *name,
xfs_ino_t ino),
TP_ARGS(dp, name, ino),
TP_STRUCT__entry(
__field(dev_t, dev)
__field(xfs_ino_t, dir_ino)
__field(unsigned int, namelen)
__dynamic_array(char, name, name->len)
__field(xfs_ino_t, ino)
__field(uint8_t, ftype)
),
TP_fast_assign(
__entry->dev = dp->i_mount->m_super->s_dev;
__entry->dir_ino = dp->i_ino;
__entry->namelen = name->len;
memcpy(__get_str(name), name->name, name->len);
__entry->ino = ino;
__entry->ftype = name->type;
),
TP_printk("dev %d:%d dir 0x%llx ftype %s name '%.*s' ino 0x%llx",
MAJOR(__entry->dev), MINOR(__entry->dev),
__entry->dir_ino,
__print_symbolic(__entry->ftype, XFS_DIR3_FTYPE_STR),
__entry->namelen,
__get_str(name),
__entry->ino)
)
#define DEFINE_XREP_DIRENT_EVENT(name) \
DEFINE_EVENT(xrep_dirent_class, name, \
TP_PROTO(struct xfs_inode *dp, const struct xfs_name *name, \
xfs_ino_t ino), \
TP_ARGS(dp, name, ino))
DEFINE_XREP_DIRENT_EVENT(xrep_dir_salvage_entry);
DEFINE_XREP_DIRENT_EVENT(xrep_dir_stash_createname);
DEFINE_XREP_DIRENT_EVENT(xrep_dir_replay_createname);
DECLARE_EVENT_CLASS(xrep_parent_salvage_class,
TP_PROTO(struct xfs_inode *dp, xfs_ino_t ino),
TP_ARGS(dp, ino),
TP_STRUCT__entry(
__field(dev_t, dev)
__field(xfs_ino_t, dir_ino)
__field(xfs_ino_t, ino)
),
TP_fast_assign(
__entry->dev = dp->i_mount->m_super->s_dev;
__entry->dir_ino = dp->i_ino;
__entry->ino = ino;
),
TP_printk("dev %d:%d dir 0x%llx parent 0x%llx",
MAJOR(__entry->dev), MINOR(__entry->dev),
__entry->dir_ino,
__entry->ino)
)
#define DEFINE_XREP_PARENT_SALVAGE_EVENT(name) \
DEFINE_EVENT(xrep_parent_salvage_class, name, \
TP_PROTO(struct xfs_inode *dp, xfs_ino_t ino), \
TP_ARGS(dp, ino))
DEFINE_XREP_PARENT_SALVAGE_EVENT(xrep_dir_salvaged_parent);
DEFINE_XREP_PARENT_SALVAGE_EVENT(xrep_findparent_dirent);
DEFINE_XREP_PARENT_SALVAGE_EVENT(xrep_findparent_from_dcache);
#endif /* IS_ENABLED(CONFIG_XFS_ONLINE_REPAIR) */
#endif /* _TRACE_XFS_SCRUB_TRACE_H */

24
fs/xfs/scrub/xfblob.h
View File

@ -23,4 +23,28 @@ int xfblob_free(struct xfblob *blob, xfblob_cookie cookie);
unsigned long long xfblob_bytes(struct xfblob *blob);
void xfblob_truncate(struct xfblob *blob);
static inline int
xfblob_storename(
struct xfblob *blob,
xfblob_cookie *cookie,
const struct xfs_name *xname)
{
return xfblob_store(blob, cookie, xname->name, xname->len);
}
static inline int
xfblob_loadname(
struct xfblob *blob,
xfblob_cookie cookie,
struct xfs_name *xname,
uint32_t size)
{
int ret = xfblob_load(blob, cookie, (void *)xname->name, size);
if (ret)
return ret;
xname->len = size;
return 0;
}
#endif /* __XFS_SCRUB_XFBLOB_H__ */

51
fs/xfs/xfs_inode.c
View File

@ -16,6 +16,7 @@
#include "xfs_inode.h"
#include "xfs_dir2.h"
#include "xfs_attr.h"
#include "xfs_bit.h"
#include "xfs_trans_space.h"
#include "xfs_trans.h"
#include "xfs_buf_item.h"
@ -1551,6 +1552,51 @@ out_unlock:
return error;
}
/*
* Mark all the buffers attached to this directory stale. In theory we should
* never be freeing a directory with any blocks at all, but this covers the
* case where we've recovered a directory swap with a "temporary" directory
* created by online repair and now need to dump it.
*/
STATIC void
xfs_inactive_dir(
struct xfs_inode *dp)
{
struct xfs_iext_cursor icur;
struct xfs_bmbt_irec got;
struct xfs_mount *mp = dp->i_mount;
struct xfs_da_geometry *geo = mp->m_dir_geo;
struct xfs_ifork *ifp = xfs_ifork_ptr(dp, XFS_DATA_FORK);
xfs_fileoff_t off;
/*
* Invalidate each directory block. All directory blocks are of
* fsbcount length and alignment, so we only need to walk those same
* offsets. We hold the only reference to this inode, so we must wait
* for the buffer locks.
*/
for_each_xfs_iext(ifp, &icur, &got) {
for (off = round_up(got.br_startoff, geo->fsbcount);
off < got.br_startoff + got.br_blockcount;
off += geo->fsbcount) {
struct xfs_buf *bp = NULL;
xfs_fsblock_t fsbno;
int error;
fsbno = (off - got.br_startoff) + got.br_startblock;
error = xfs_buf_incore(mp->m_ddev_targp,
XFS_FSB_TO_DADDR(mp, fsbno),
XFS_FSB_TO_BB(mp, geo->fsbcount),
XBF_LIVESCAN, &bp);
if (error)
continue;
xfs_buf_stale(bp);
xfs_buf_relse(bp);
}
}
}
/*
* xfs_inactive_truncate
*
@ -1861,6 +1907,11 @@ xfs_inactive(
goto out;
}
if (S_ISDIR(VFS_I(ip)->i_mode) && ip->i_df.if_nextents > 0) {
xfs_inactive_dir(ip);
truncate = 1;
}
if (S_ISLNK(VFS_I(ip)->i_mode))
error = xfs_inactive_symlink(ip);
else if (truncate)