1 // SPDX-License-Identifier: GPL-2.0-or-later
3  * Copyright (C) 2017-2023 Oracle.  All Rights Reserved.
30  * repair on-disk data structures.  That task was left to the xfs_check
41  * also be cross-referenced against other btrees to look for potential
44  * It is expected that the checkers responsible for per-AG metadata
46  * metadata structure, and perform any relevant cross-referencing before
51  * Block maps and b-trees rooted in an inode present a special challenge
52  * because they can involve extents from any AG.  The general scrubber
53  * structure of lock -> check -> xref -> unlock still holds, but AG
58  * can signal a potential deadlock, in which case the scrubber can jump
63  * (directories and attributes) we follow the same btree-scrubbing
73  * re-grab the buffer in the context of the same transaction, we avoid
75  * scrubber, something will notice that something is amiss and report
76  * the corruption.  Therefore, each scrubber will allocate an empty
78  * end of the scrub run.  Cancelling a non-dirty transaction simply
90  * cross-referencing every record with all other available metadata.
97  * cross-reference with a defective btree.
101  * the metadata object by setting the REPAIR flag and re-calling the
103  * on-disk specification; operations cannot continue if the violation is
108  * done without rebuilding entire structures.
111  * Lock -> scrub -> repair -> commit -> re-lock -> re-scrub -> unlock.
118  * - "xfs_" are general XFS symbols.
119  * - "xchk_" are symbols related to metadata checking.
120  * - "xrep_" are symbols related to metadata repair.
121  * - "xfs_scrub_" are symbols that tie online fsck to the rest of XFS.
125  * Scrub probe -- userspace uses this to probe if we're willing to scrub
152 	if (!(sc->flags & XCHK_FSGATES_ALL))  in xchk_fsgates_disable()
155 	trace_xchk_fsgates_disable(sc, sc->flags & XCHK_FSGATES_ALL);  in xchk_fsgates_disable()
157 	if (sc->flags & XCHK_FSGATES_DRAIN)  in xchk_fsgates_disable()
160 	sc->flags &= ~XCHK_FSGATES_ALL;  in xchk_fsgates_disable()
169 	xchk_ag_free(sc, &sc->sa);  in xchk_teardown()
170 	if (sc->tp) {  in xchk_teardown()
171 		if (error == 0 && (sc->sm->sm_flags & XFS_SCRUB_IFLAG_REPAIR))  in xchk_teardown()
172 			error = xfs_trans_commit(sc->tp);  in xchk_teardown()
174 			xfs_trans_cancel(sc->tp);  in xchk_teardown()
175 		sc->tp = NULL;  in xchk_teardown()
177 	if (sc->ip) {  in xchk_teardown()
178 		if (sc->ilock_flags)  in xchk_teardown()
179 			xchk_iunlock(sc, sc->ilock_flags);  in xchk_teardown()
180 		xchk_irele(sc, sc->ip);  in xchk_teardown()
181 		sc->ip = NULL;  in xchk_teardown()
183 	if (sc->flags & XCHK_HAVE_FREEZE_PROT) {  in xchk_teardown()
184 		sc->flags &= ~XCHK_HAVE_FREEZE_PROT;  in xchk_teardown()
185 		mnt_drop_write_file(sc->file);  in xchk_teardown()
187 	if (sc->xfile) {  in xchk_teardown()
188 		xfile_destroy(sc->xfile);  in xchk_teardown()
189 		sc->xfile = NULL;  in xchk_teardown()
191 	if (sc->buf) {  in xchk_teardown()
192 		if (sc->buf_cleanup)  in xchk_teardown()
193 			sc->buf_cleanup(sc->buf);  in xchk_teardown()
194 		kvfree(sc->buf);  in xchk_teardown()
195 		sc->buf_cleanup = NULL;  in xchk_teardown()
196 		sc->buf = NULL;  in xchk_teardown()
373 	error = -EINVAL;  in xchk_validate_inputs()
375 	sm->sm_flags &= ~XFS_SCRUB_FLAGS_OUT;  in xchk_validate_inputs()
376 	if (sm->sm_flags & ~XFS_SCRUB_FLAGS_IN)  in xchk_validate_inputs()
379 	if (memchr_inv(sm->sm_reserved, 0, sizeof(sm->sm_reserved)))  in xchk_validate_inputs()
382 	error = -ENOENT;  in xchk_validate_inputs()
384 	if (sm->sm_type >= XFS_SCRUB_TYPE_NR)  in xchk_validate_inputs()
386 	ops = &meta_scrub_ops[sm->sm_type];  in xchk_validate_inputs()
387 	if (ops->setup == NULL || ops->scrub == NULL)  in xchk_validate_inputs()
390 	if (ops->has && !ops->has(mp))  in xchk_validate_inputs()
393 	error = -EINVAL;  in xchk_validate_inputs()
395 	switch (ops->type) {  in xchk_validate_inputs()
398 		if (sm->sm_ino || sm->sm_gen || sm->sm_agno)  in xchk_validate_inputs()
402 		if (sm->sm_ino || sm->sm_gen ||  in xchk_validate_inputs()
403 		    sm->sm_agno >= mp->m_sb.sb_agcount)  in xchk_validate_inputs()
407 		if (sm->sm_agno || (sm->sm_gen && !sm->sm_ino))  in xchk_validate_inputs()
415 	if ((sm->sm_flags & XFS_SCRUB_IFLAG_FORCE_REBUILD) &&  in xchk_validate_inputs()
416 	    !(sm->sm_flags & XFS_SCRUB_IFLAG_REPAIR))  in xchk_validate_inputs()
417 		return -EINVAL;  in xchk_validate_inputs()
420 	 * We only want to repair read-write v5+ filesystems.  Defer the check  in xchk_validate_inputs()
421 	 * for ops->repair until after our scrub confirms that we need to  in xchk_validate_inputs()
425 	if (sm->sm_flags & XFS_SCRUB_IFLAG_REPAIR) {  in xchk_validate_inputs()
426 		error = -EOPNOTSUPP;  in xchk_validate_inputs()
430 		error = -EROFS;  in xchk_validate_inputs()
448 	if ((sc->sm->sm_flags & XFS_SCRUB_IFLAG_REPAIR) &&  in xchk_postmortem()
449 	    (sc->sm->sm_flags & (XFS_SCRUB_OFLAG_CORRUPT |  in xchk_postmortem()
451 		xrep_failure(sc->mp);  in xchk_postmortem()
460 	if (sc->sm->sm_flags & (XFS_SCRUB_OFLAG_CORRUPT |  in xchk_postmortem()
462 		xfs_alert_ratelimited(sc->mp,  in xchk_postmortem()
475 	struct xfs_mount		*mp = XFS_I(file_inode(file))->i_mount;  in xfs_scrub_metadata()
485 	error = -ESHUTDOWN;  in xfs_scrub_metadata()
488 	error = -ENOTRECOVERABLE;  in xfs_scrub_metadata()
501 		error = -ENOMEM;  in xfs_scrub_metadata()
505 	sc->mp = mp;  in xfs_scrub_metadata()
506 	sc->file = file;  in xfs_scrub_metadata()
507 	sc->sm = sm;  in xfs_scrub_metadata()
508 	sc->ops = &meta_scrub_ops[sm->sm_type];  in xfs_scrub_metadata()
509 	sc->sick_mask = xchk_health_mask_for_scrub_type(sm->sm_type);  in xfs_scrub_metadata()
515 	if (sm->sm_flags & XFS_SCRUB_IFLAG_REPAIR) {  in xfs_scrub_metadata()
516 		error = mnt_want_write_file(sc->file);  in xfs_scrub_metadata()
520 		sc->flags |= XCHK_HAVE_FREEZE_PROT;  in xfs_scrub_metadata()
524 	error = sc->ops->setup(sc);  in xfs_scrub_metadata()
525 	if (error == -EDEADLOCK && !(sc->flags & XCHK_TRY_HARDER))  in xfs_scrub_metadata()
527 	if (error == -ECHRNG && !(sc->flags & XCHK_NEED_DRAIN))  in xfs_scrub_metadata()
534 	if ((sc->flags & XREP_ALREADY_FIXED) && sc->ops->repair_eval != NULL)  in xfs_scrub_metadata()
535 		error = sc->ops->repair_eval(sc);  in xfs_scrub_metadata()
537 		error = sc->ops->scrub(sc);  in xfs_scrub_metadata()
539 	if (error == -EDEADLOCK && !(sc->flags & XCHK_TRY_HARDER))  in xfs_scrub_metadata()
541 	if (error == -ECHRNG && !(sc->flags & XCHK_NEED_DRAIN))  in xfs_scrub_metadata()
543 	if (error || (sm->sm_flags & XFS_SCRUB_OFLAG_INCOMPLETE))  in xfs_scrub_metadata()
554 			sc->sm->sm_flags |= XFS_SCRUB_OFLAG_NO_REPAIR_NEEDED;  in xfs_scrub_metadata()
563 		if (error == -EAGAIN) {  in xfs_scrub_metadata()
583 	if (error != -ENOENT)  in xfs_scrub_metadata()
588 	if (error == -EFSCORRUPTED || error == -EFSBADCRC) {  in xfs_scrub_metadata()
589 		sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;  in xfs_scrub_metadata()
597 	sc->flags |= XCHK_NEED_DRAIN;  in xfs_scrub_metadata()
602 	 * Scrubbers return -EDEADLOCK to mean 'try harder'.  Tear down  in xfs_scrub_metadata()
604 	 * worst-case scenarios.  in xfs_scrub_metadata()
609 	sc->flags |= XCHK_TRY_HARDER;  in xfs_scrub_metadata()