xfs/scrub/scrub.c

0001 // SPDX-License-Identifier: GPL-2.0+
0002 /*
0003  * Copyright (C) 2017 Oracle.  All Rights Reserved.
0004  * Author: Darrick J. Wong <darrick.wong@oracle.com>
0005  */
0006 #include "xfs.h"
0007 #include "xfs_fs.h"
0008 #include "xfs_shared.h"
0009 #include "xfs_format.h"
0010 #include "xfs_trans_resv.h"
0011 #include "xfs_mount.h"
0012 #include "xfs_log_format.h"
0013 #include "xfs_trans.h"
0014 #include "xfs_inode.h"
0015 #include "xfs_quota.h"
0016 #include "xfs_qm.h"
0017 #include "xfs_errortag.h"
0018 #include "xfs_error.h"
0019 #include "xfs_scrub.h"
0020 #include "scrub/scrub.h"
0021 #include "scrub/common.h"
0022 #include "scrub/trace.h"
0023 #include "scrub/repair.h"
0024 #include "scrub/health.h"
0025
0026 /*
0027  * Online Scrub and Repair
0028  *
0029  * Traditionally, XFS (the kernel driver) did not know how to check or
0030  * repair on-disk data structures.  That task was left to the xfs_check
0031  * and xfs_repair tools, both of which require taking the filesystem
0032  * offline for a thorough but time consuming examination.  Online
0033  * scrub & repair, on the other hand, enables us to check the metadata
0034  * for obvious errors while carefully stepping around the filesystem's
0035  * ongoing operations, locking rules, etc.
0036  *
0037  * Given that most XFS metadata consist of records stored in a btree,
0038  * most of the checking functions iterate the btree blocks themselves
0039  * looking for irregularities.  When a record block is encountered, each
0040  * record can be checked for obviously bad values.  Record values can
0041  * also be cross-referenced against other btrees to look for potential
0042  * misunderstandings between pieces of metadata.
0043  *
0044  * It is expected that the checkers responsible for per-AG metadata
0045  * structures will lock the AG headers (AGI, AGF, AGFL), iterate the
0046  * metadata structure, and perform any relevant cross-referencing before
0047  * unlocking the AG and returning the results to userspace.  These
0048  * scrubbers must not keep an AG locked for too long to avoid tying up
0049  * the block and inode allocators.
0050  *
0051  * Block maps and b-trees rooted in an inode present a special challenge
0052  * because they can involve extents from any AG.  The general scrubber
0053  * structure of lock -> check -> xref -> unlock still holds, but AG
0054  * locking order rules /must/ be obeyed to avoid deadlocks.  The
0055  * ordering rule, of course, is that we must lock in increasing AG
0056  * order.  Helper functions are provided to track which AG headers we've
0057  * already locked.  If we detect an imminent locking order violation, we
0058  * can signal a potential deadlock, in which case the scrubber can jump
0059  * out to the top level, lock all the AGs in order, and retry the scrub.
0060  *
0061  * For file data (directories, extended attributes, symlinks) scrub, we
0062  * can simply lock the inode and walk the data.  For btree data
0063  * (directories and attributes) we follow the same btree-scrubbing
0064  * strategy outlined previously to check the records.
0065  *
0066  * We use a bit of trickery with transactions to avoid buffer deadlocks
0067  * if there is a cycle in the metadata.  The basic problem is that
0068  * travelling down a btree involves locking the current buffer at each
0069  * tree level.  If a pointer should somehow point back to a buffer that
0070  * we've already examined, we will deadlock due to the second buffer
0071  * locking attempt.  Note however that grabbing a buffer in transaction
0072  * context links the locked buffer to the transaction.  If we try to
0073  * re-grab the buffer in the context of the same transaction, we avoid
0074  * the second lock attempt and continue.  Between the verifier and the
0075  * scrubber, something will notice that something is amiss and report
0076  * the corruption.  Therefore, each scrubber will allocate an empty
0077  * transaction, attach buffers to it, and cancel the transaction at the
0078  * end of the scrub run.  Cancelling a non-dirty transaction simply
0079  * unlocks the buffers.
0080  *
0081  * There are four pieces of data that scrub can communicate to
0082  * userspace.  The first is the error code (errno), which can be used to
0083  * communicate operational errors in performing the scrub.  There are
0084  * also three flags that can be set in the scrub context.  If the data
0085  * structure itself is corrupt, the CORRUPT flag will be set.  If
0086  * the metadata is correct but otherwise suboptimal, the PREEN flag
0087  * will be set.
0088  *
0089  * We perform secondary validation of filesystem metadata by
0090  * cross-referencing every record with all other available metadata.
0091  * For example, for block mapping extents, we verify that there are no
0092  * records in the free space and inode btrees corresponding to that
0093  * space extent and that there is a corresponding entry in the reverse
0094  * mapping btree.  Inconsistent metadata is noted by setting the
0095  * XCORRUPT flag; btree query function errors are noted by setting the
0096  * XFAIL flag and deleting the cursor to prevent further attempts to
0097  * cross-reference with a defective btree.
0098  *
0099  * If a piece of metadata proves corrupt or suboptimal, the userspace
0100  * program can ask the kernel to apply some tender loving care (TLC) to
0101  * the metadata object by setting the REPAIR flag and re-calling the
0102  * scrub ioctl.  "Corruption" is defined by metadata violating the
0103  * on-disk specification; operations cannot continue if the violation is
0104  * left untreated.  It is possible for XFS to continue if an object is
0105  * "suboptimal", however performance may be degraded.  Repairs are
0106  * usually performed by rebuilding the metadata entirely out of
0107  * redundant metadata.  Optimizing, on the other hand, can sometimes be
0108  * done without rebuilding entire structures.
0109  *
0110  * Generally speaking, the repair code has the following code structure:
0111  * Lock -> scrub -> repair -> commit -> re-lock -> re-scrub -> unlock.
0112  * The first check helps us figure out if we need to rebuild or simply
0113  * optimize the structure so that the rebuild knows what to do.  The
0114  * second check evaluates the completeness of the repair; that is what
0115  * is reported to userspace.
0116  *
0117  * A quick note on symbol prefixes:
0118  * - "xfs_" are general XFS symbols.
0119  * - "xchk_" are symbols related to metadata checking.
0120  * - "xrep_" are symbols related to metadata repair.
0121  * - "xfs_scrub_" are symbols that tie online fsck to the rest of XFS.
0122  */
0123
0124 /*
0125  * Scrub probe -- userspace uses this to probe if we're willing to scrub
0126  * or repair a given mountpoint.  This will be used by xfs_scrub to
0127  * probe the kernel's abilities to scrub (and repair) the metadata.  We
0128  * do this by validating the ioctl inputs from userspace, preparing the
0129  * filesystem for a scrub (or a repair) operation, and immediately
0130  * returning to userspace.  Userspace can use the returned errno and
0131  * structure state to decide (in broad terms) if scrub/repair are
0132  * supported by the running kernel.
0133  */
0134 static int
0135 xchk_probe(
0136     struct xfs_scrub    *sc)
0137 {
0138     int         error = 0;
0139
0140     if (xchk_should_terminate(sc, &error))
0141         return error;
0142
0143     return 0;
0144 }
0145
0146 /* Scrub setup and teardown */
0147
0148 /* Free all the resources and finish the transactions. */
0149 STATIC int
0150 xchk_teardown(
0151     struct xfs_scrub    *sc,
0152     int         error)
0153 {
0154     struct xfs_inode    *ip_in = XFS_I(file_inode(sc->file));
0155
0156     xchk_ag_free(sc, &sc->sa);
0157     if (sc->tp) {
0158         if (error == 0 && (sc->sm->sm_flags & XFS_SCRUB_IFLAG_REPAIR))
0159             error = xfs_trans_commit(sc->tp);
0160         else
0161             xfs_trans_cancel(sc->tp);
0162         sc->tp = NULL;
0163     }
0164     if (sc->ip) {
0165         if (sc->ilock_flags)
0166             xfs_iunlock(sc->ip, sc->ilock_flags);
0167         if (sc->ip != ip_in &&
0168             !xfs_internal_inum(sc->mp, sc->ip->i_ino))
0169             xfs_irele(sc->ip);
0170         sc->ip = NULL;
0171     }
0172     if (sc->sm->sm_flags & XFS_SCRUB_IFLAG_REPAIR)
0173         mnt_drop_write_file(sc->file);
0174     if (sc->flags & XCHK_REAPING_DISABLED)
0175         xchk_start_reaping(sc);
0176     if (sc->buf) {
0177         kmem_free(sc->buf);
0178         sc->buf = NULL;
0179     }
0180     return error;
0181 }
0182
0183 /* Scrubbing dispatch. */
0184
0185 static const struct xchk_meta_ops meta_scrub_ops[] = {
0186     [XFS_SCRUB_TYPE_PROBE] = {  /* ioctl presence test */
0187         .type   = ST_NONE,
0188         .setup  = xchk_setup_fs,
0189         .scrub  = xchk_probe,
0190         .repair = xrep_probe,
0191     },
0192     [XFS_SCRUB_TYPE_SB] = {     /* superblock */
0193         .type   = ST_PERAG,
0194         .setup  = xchk_setup_fs,
0195         .scrub  = xchk_superblock,
0196         .repair = xrep_superblock,
0197     },
0198     [XFS_SCRUB_TYPE_AGF] = {    /* agf */
0199         .type   = ST_PERAG,
0200         .setup  = xchk_setup_fs,
0201         .scrub  = xchk_agf,
0202         .repair = xrep_agf,
0203     },
0204     [XFS_SCRUB_TYPE_AGFL]= {    /* agfl */
0205         .type   = ST_PERAG,
0206         .setup  = xchk_setup_fs,
0207         .scrub  = xchk_agfl,
0208         .repair = xrep_agfl,
0209     },
0210     [XFS_SCRUB_TYPE_AGI] = {    /* agi */
0211         .type   = ST_PERAG,
0212         .setup  = xchk_setup_fs,
0213         .scrub  = xchk_agi,
0214         .repair = xrep_agi,
0215     },
0216     [XFS_SCRUB_TYPE_BNOBT] = {  /* bnobt */
0217         .type   = ST_PERAG,
0218         .setup  = xchk_setup_ag_allocbt,
0219         .scrub  = xchk_bnobt,
0220         .repair = xrep_notsupported,
0221     },
0222     [XFS_SCRUB_TYPE_CNTBT] = {  /* cntbt */
0223         .type   = ST_PERAG,
0224         .setup  = xchk_setup_ag_allocbt,
0225         .scrub  = xchk_cntbt,
0226         .repair = xrep_notsupported,
0227     },
0228     [XFS_SCRUB_TYPE_INOBT] = {  /* inobt */
0229         .type   = ST_PERAG,
0230         .setup  = xchk_setup_ag_iallocbt,
0231         .scrub  = xchk_inobt,
0232         .repair = xrep_notsupported,
0233     },
0234     [XFS_SCRUB_TYPE_FINOBT] = { /* finobt */
0235         .type   = ST_PERAG,
0236         .setup  = xchk_setup_ag_iallocbt,
0237         .scrub  = xchk_finobt,
0238         .has    = xfs_has_finobt,
0239         .repair = xrep_notsupported,
0240     },
0241     [XFS_SCRUB_TYPE_RMAPBT] = { /* rmapbt */
0242         .type   = ST_PERAG,
0243         .setup  = xchk_setup_ag_rmapbt,
0244         .scrub  = xchk_rmapbt,
0245         .has    = xfs_has_rmapbt,
0246         .repair = xrep_notsupported,
0247     },
0248     [XFS_SCRUB_TYPE_REFCNTBT] = {   /* refcountbt */
0249         .type   = ST_PERAG,
0250         .setup  = xchk_setup_ag_refcountbt,
0251         .scrub  = xchk_refcountbt,
0252         .has    = xfs_has_reflink,
0253         .repair = xrep_notsupported,
0254     },
0255     [XFS_SCRUB_TYPE_INODE] = {  /* inode record */
0256         .type   = ST_INODE,
0257         .setup  = xchk_setup_inode,
0258         .scrub  = xchk_inode,
0259         .repair = xrep_notsupported,
0260     },
0261     [XFS_SCRUB_TYPE_BMBTD] = {  /* inode data fork */
0262         .type   = ST_INODE,
0263         .setup  = xchk_setup_inode_bmap,
0264         .scrub  = xchk_bmap_data,
0265         .repair = xrep_notsupported,
0266     },
0267     [XFS_SCRUB_TYPE_BMBTA] = {  /* inode attr fork */
0268         .type   = ST_INODE,
0269         .setup  = xchk_setup_inode_bmap,
0270         .scrub  = xchk_bmap_attr,
0271         .repair = xrep_notsupported,
0272     },
0273     [XFS_SCRUB_TYPE_BMBTC] = {  /* inode CoW fork */
0274         .type   = ST_INODE,
0275         .setup  = xchk_setup_inode_bmap,
0276         .scrub  = xchk_bmap_cow,
0277         .repair = xrep_notsupported,
0278     },
0279     [XFS_SCRUB_TYPE_DIR] = {    /* directory */
0280         .type   = ST_INODE,
0281         .setup  = xchk_setup_directory,
0282         .scrub  = xchk_directory,
0283         .repair = xrep_notsupported,
0284     },
0285     [XFS_SCRUB_TYPE_XATTR] = {  /* extended attributes */
0286         .type   = ST_INODE,
0287         .setup  = xchk_setup_xattr,
0288         .scrub  = xchk_xattr,
0289         .repair = xrep_notsupported,
0290     },
0291     [XFS_SCRUB_TYPE_SYMLINK] = {    /* symbolic link */
0292         .type   = ST_INODE,
0293         .setup  = xchk_setup_symlink,
0294         .scrub  = xchk_symlink,
0295         .repair = xrep_notsupported,
0296     },
0297     [XFS_SCRUB_TYPE_PARENT] = { /* parent pointers */
0298         .type   = ST_INODE,
0299         .setup  = xchk_setup_parent,
0300         .scrub  = xchk_parent,
0301         .repair = xrep_notsupported,
0302     },
0303     [XFS_SCRUB_TYPE_RTBITMAP] = {   /* realtime bitmap */
0304         .type   = ST_FS,
0305         .setup  = xchk_setup_rt,
0306         .scrub  = xchk_rtbitmap,
0307         .has    = xfs_has_realtime,
0308         .repair = xrep_notsupported,
0309     },
0310     [XFS_SCRUB_TYPE_RTSUM] = {  /* realtime summary */
0311         .type   = ST_FS,
0312         .setup  = xchk_setup_rt,
0313         .scrub  = xchk_rtsummary,
0314         .has    = xfs_has_realtime,
0315         .repair = xrep_notsupported,
0316     },
0317     [XFS_SCRUB_TYPE_UQUOTA] = { /* user quota */
0318         .type   = ST_FS,
0319         .setup  = xchk_setup_quota,
0320         .scrub  = xchk_quota,
0321         .repair = xrep_notsupported,
0322     },
0323     [XFS_SCRUB_TYPE_GQUOTA] = { /* group quota */
0324         .type   = ST_FS,
0325         .setup  = xchk_setup_quota,
0326         .scrub  = xchk_quota,
0327         .repair = xrep_notsupported,
0328     },
0329     [XFS_SCRUB_TYPE_PQUOTA] = { /* project quota */
0330         .type   = ST_FS,
0331         .setup  = xchk_setup_quota,
0332         .scrub  = xchk_quota,
0333         .repair = xrep_notsupported,
0334     },
0335     [XFS_SCRUB_TYPE_FSCOUNTERS] = { /* fs summary counters */
0336         .type   = ST_FS,
0337         .setup  = xchk_setup_fscounters,
0338         .scrub  = xchk_fscounters,
0339         .repair = xrep_notsupported,
0340     },
0341 };
0342
0343 static int
0344 xchk_validate_inputs(
0345     struct xfs_mount        *mp,
0346     struct xfs_scrub_metadata   *sm)
0347 {
0348     int             error;
0349     const struct xchk_meta_ops  *ops;
0350
0351     error = -EINVAL;
0352     /* Check our inputs. */
0353     sm->sm_flags &= ~XFS_SCRUB_FLAGS_OUT;
0354     if (sm->sm_flags & ~XFS_SCRUB_FLAGS_IN)
0355         goto out;
0356     /* sm_reserved[] must be zero */
0357     if (memchr_inv(sm->sm_reserved, 0, sizeof(sm->sm_reserved)))
0358         goto out;
0359
0360     error = -ENOENT;
0361     /* Do we know about this type of metadata? */
0362     if (sm->sm_type >= XFS_SCRUB_TYPE_NR)
0363         goto out;
0364     ops = &meta_scrub_ops[sm->sm_type];
0365     if (ops->setup == NULL || ops->scrub == NULL)
0366         goto out;
0367     /* Does this fs even support this type of metadata? */
0368     if (ops->has && !ops->has(mp))
0369         goto out;
0370
0371     error = -EINVAL;
0372     /* restricting fields must be appropriate for type */
0373     switch (ops->type) {
0374     case ST_NONE:
0375     case ST_FS:
0376         if (sm->sm_ino || sm->sm_gen || sm->sm_agno)
0377             goto out;
0378         break;
0379     case ST_PERAG:
0380         if (sm->sm_ino || sm->sm_gen ||
0381             sm->sm_agno >= mp->m_sb.sb_agcount)
0382             goto out;
0383         break;
0384     case ST_INODE:
0385         if (sm->sm_agno || (sm->sm_gen && !sm->sm_ino))
0386             goto out;
0387         break;
0388     default:
0389         goto out;
0390     }
0391
0392     /*
0393      * We only want to repair read-write v5+ filesystems.  Defer the check
0394      * for ops->repair until after our scrub confirms that we need to
0395      * perform repairs so that we avoid failing due to not supporting
0396      * repairing an object that doesn't need repairs.
0397      */
0398     if (sm->sm_flags & XFS_SCRUB_IFLAG_REPAIR) {
0399         error = -EOPNOTSUPP;
0400         if (!xfs_has_crc(mp))
0401             goto out;
0402
0403         error = -EROFS;
0404         if (xfs_is_readonly(mp))
0405             goto out;
0406     }
0407
0408     error = 0;
0409 out:
0410     return error;
0411 }
0412
0413 #ifdef CONFIG_XFS_ONLINE_REPAIR
0414 static inline void xchk_postmortem(struct xfs_scrub *sc)
0415 {
0416     /*
0417      * Userspace asked us to repair something, we repaired it, rescanned
0418      * it, and the rescan says it's still broken.  Scream about this in
0419      * the system logs.
0420      */
0421     if ((sc->sm->sm_flags & XFS_SCRUB_IFLAG_REPAIR) &&
0422         (sc->sm->sm_flags & (XFS_SCRUB_OFLAG_CORRUPT |
0423                  XFS_SCRUB_OFLAG_XCORRUPT)))
0424         xrep_failure(sc->mp);
0425 }
0426 #else
0427 static inline void xchk_postmortem(struct xfs_scrub *sc)
0428 {
0429     /*
0430      * Userspace asked us to scrub something, it's broken, and we have no
0431      * way of fixing it.  Scream in the logs.
0432      */
0433     if (sc->sm->sm_flags & (XFS_SCRUB_OFLAG_CORRUPT |
0434                 XFS_SCRUB_OFLAG_XCORRUPT))
0435         xfs_alert_ratelimited(sc->mp,
0436                 "Corruption detected during scrub.");
0437 }
0438 #endif /* CONFIG_XFS_ONLINE_REPAIR */
0439
0440 /* Dispatch metadata scrubbing. */
0441 int
0442 xfs_scrub_metadata(
0443     struct file         *file,
0444     struct xfs_scrub_metadata   *sm)
0445 {
0446     struct xfs_scrub        *sc;
0447     struct xfs_mount        *mp = XFS_I(file_inode(file))->i_mount;
0448     int             error = 0;
0449
0450     BUILD_BUG_ON(sizeof(meta_scrub_ops) !=
0451         (sizeof(struct xchk_meta_ops) * XFS_SCRUB_TYPE_NR));
0452
0453     trace_xchk_start(XFS_I(file_inode(file)), sm, error);
0454
0455     /* Forbidden if we are shut down or mounted norecovery. */
0456     error = -ESHUTDOWN;
0457     if (xfs_is_shutdown(mp))
0458         goto out;
0459     error = -ENOTRECOVERABLE;
0460     if (xfs_has_norecovery(mp))
0461         goto out;
0462
0463     error = xchk_validate_inputs(mp, sm);
0464     if (error)
0465         goto out;
0466
0467     xfs_warn_mount(mp, XFS_OPSTATE_WARNED_SCRUB,
0468  "EXPERIMENTAL online scrub feature in use. Use at your own risk!");
0469
0470     sc = kmem_zalloc(sizeof(struct xfs_scrub), KM_NOFS | KM_MAYFAIL);
0471     if (!sc) {
0472         error = -ENOMEM;
0473         goto out;
0474     }
0475
0476     sc->mp = mp;
0477     sc->file = file;
0478     sc->sm = sm;
0479     sc->ops = &meta_scrub_ops[sm->sm_type];
0480     sc->sick_mask = xchk_health_mask_for_scrub_type(sm->sm_type);
0481 retry_op:
0482     /*
0483      * When repairs are allowed, prevent freezing or readonly remount while
0484      * scrub is running with a real transaction.
0485      */
0486     if (sm->sm_flags & XFS_SCRUB_IFLAG_REPAIR) {
0487         error = mnt_want_write_file(sc->file);
0488         if (error)
0489             goto out_sc;
0490     }
0491
0492     /* Set up for the operation. */
0493     error = sc->ops->setup(sc);
0494     if (error)
0495         goto out_teardown;
0496
0497     /* Scrub for errors. */
0498     error = sc->ops->scrub(sc);
0499     if (!(sc->flags & XCHK_TRY_HARDER) && error == -EDEADLOCK) {
0500         /*
0501          * Scrubbers return -EDEADLOCK to mean 'try harder'.
0502          * Tear down everything we hold, then set up again with
0503          * preparation for worst-case scenarios.
0504          */
0505         error = xchk_teardown(sc, 0);
0506         if (error)
0507             goto out_sc;
0508         sc->flags |= XCHK_TRY_HARDER;
0509         goto retry_op;
0510     } else if (error || (sm->sm_flags & XFS_SCRUB_OFLAG_INCOMPLETE))
0511         goto out_teardown;
0512
0513     xchk_update_health(sc);
0514
0515     if ((sc->sm->sm_flags & XFS_SCRUB_IFLAG_REPAIR) &&
0516         !(sc->flags & XREP_ALREADY_FIXED)) {
0517         bool needs_fix;
0518
0519         /* Let debug users force us into the repair routines. */
0520         if (XFS_TEST_ERROR(false, mp, XFS_ERRTAG_FORCE_SCRUB_REPAIR))
0521             sc->sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;
0522
0523         needs_fix = (sc->sm->sm_flags & (XFS_SCRUB_OFLAG_CORRUPT |
0524                          XFS_SCRUB_OFLAG_XCORRUPT |
0525                          XFS_SCRUB_OFLAG_PREEN));
0526         /*
0527          * If userspace asked for a repair but it wasn't necessary,
0528          * report that back to userspace.
0529          */
0530         if (!needs_fix) {
0531             sc->sm->sm_flags |= XFS_SCRUB_OFLAG_NO_REPAIR_NEEDED;
0532             goto out_nofix;
0533         }
0534
0535         /*
0536          * If it's broken, userspace wants us to fix it, and we haven't
0537          * already tried to fix it, then attempt a repair.
0538          */
0539         error = xrep_attempt(sc);
0540         if (error == -EAGAIN) {
0541             /*
0542              * Either the repair function succeeded or it couldn't
0543              * get all the resources it needs; either way, we go
0544              * back to the beginning and call the scrub function.
0545              */
0546             error = xchk_teardown(sc, 0);
0547             if (error) {
0548                 xrep_failure(mp);
0549                 goto out_sc;
0550             }
0551             goto retry_op;
0552         }
0553     }
0554
0555 out_nofix:
0556     xchk_postmortem(sc);
0557 out_teardown:
0558     error = xchk_teardown(sc, error);
0559 out_sc:
0560     kmem_free(sc);
0561 out:
0562     trace_xchk_done(XFS_I(file_inode(file)), sm, error);
0563     if (error == -EFSCORRUPTED || error == -EFSBADCRC) {
0564         sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;
0565         error = 0;
0566     }
0567     return error;
0568 }