1 // SPDX-License-Identifier: GPL-2.0+
3 * Copyright (C) 2017 Oracle. All Rights Reserved.
4 * Author: Darrick J. Wong <darrick.wong@oracle.com>
8 #include "xfs_shared.h"
9 #include "xfs_format.h"
10 #include "xfs_trans_resv.h"
11 #include "xfs_mount.h"
12 #include "xfs_btree.h"
14 #include "xfs_log_format.h"
15 #include "xfs_trans.h"
16 #include "xfs_inode.h"
17 #include "xfs_alloc.h"
19 #include "xfs_bmap_btree.h"
21 #include "xfs_rmap_btree.h"
22 #include "scrub/scrub.h"
23 #include "scrub/common.h"
24 #include "scrub/btree.h"
27 /* Set us up with an inode's bmap. */
29 xchk_setup_inode_bmap(
34 error = xchk_get_inode(sc);
38 sc->ilock_flags = XFS_IOLOCK_EXCL | XFS_MMAPLOCK_EXCL;
39 xfs_ilock(sc->ip, sc->ilock_flags);
42 * We don't want any ephemeral data fork updates sitting around
43 * while we inspect block mappings, so wait for directio to finish
44 * and flush dirty data if we have delalloc reservations.
46 if (S_ISREG(VFS_I(sc->ip)->i_mode) &&
47 sc->sm->sm_type == XFS_SCRUB_TYPE_BMBTD) {
48 struct address_space *mapping = VFS_I(sc->ip)->i_mapping;
50 inode_dio_wait(VFS_I(sc->ip));
53 * Try to flush all incore state to disk before we examine the
54 * space mappings for the data fork. Leave accumulated errors
55 * in the mapping for the writer threads to consume.
57 * On ENOSPC or EIO writeback errors, we continue into the
58 * extent mapping checks because write failures do not
59 * necessarily imply anything about the correctness of the file
60 * metadata. The metadata and the file data could be on
61 * completely separate devices; a media failure might only
62 * affect a subset of the disk, etc. We can handle delalloc
63 * extents in the scrubber, so leaving them in memory is fine.
65 error = filemap_fdatawrite(mapping);
67 error = filemap_fdatawait_keep_errors(mapping);
68 if (error && (error != -ENOSPC && error != -EIO))
72 /* Got the inode, lock it and we're ready to go. */
73 error = xchk_trans_alloc(sc, 0);
76 sc->ilock_flags |= XFS_ILOCK_EXCL;
77 xfs_ilock(sc->ip, XFS_ILOCK_EXCL);
80 /* scrub teardown will unlock and release the inode */
85 * Inode fork block mapping (BMBT) scrubber.
86 * More complex than the others because we have to scrub
87 * all the extents regardless of whether or not the fork
91 struct xchk_bmap_info {
93 xfs_fileoff_t lastoff;
100 /* Look for a corresponding rmap for this irec. */
103 struct xchk_bmap_info *info,
104 struct xfs_bmbt_irec *irec,
107 struct xfs_rmap_irec *rmap)
109 xfs_fileoff_t offset;
110 unsigned int rflags = 0;
114 if (info->whichfork == XFS_ATTR_FORK)
115 rflags |= XFS_RMAP_ATTR_FORK;
116 if (irec->br_state == XFS_EXT_UNWRITTEN)
117 rflags |= XFS_RMAP_UNWRITTEN;
120 * CoW staging extents are owned (on disk) by the refcountbt, so
121 * their rmaps do not have offsets.
123 if (info->whichfork == XFS_COW_FORK)
126 offset = irec->br_startoff;
129 * If the caller thinks this could be a shared bmbt extent (IOWs,
130 * any data fork extent of a reflink inode) then we have to use the
131 * range rmap lookup to make sure we get the correct owner/offset.
133 if (info->is_shared) {
134 error = xfs_rmap_lookup_le_range(info->sc->sa.rmap_cur, agbno,
135 owner, offset, rflags, rmap, &has_rmap);
136 if (!xchk_should_check_xref(info->sc, &error,
137 &info->sc->sa.rmap_cur))
143 * Otherwise, use the (faster) regular lookup.
145 error = xfs_rmap_lookup_le(info->sc->sa.rmap_cur, agbno, 0, owner,
146 offset, rflags, &has_rmap);
147 if (!xchk_should_check_xref(info->sc, &error,
148 &info->sc->sa.rmap_cur))
153 error = xfs_rmap_get_rec(info->sc->sa.rmap_cur, rmap, &has_rmap);
154 if (!xchk_should_check_xref(info->sc, &error,
155 &info->sc->sa.rmap_cur))
160 xchk_fblock_xref_set_corrupt(info->sc, info->whichfork,
165 /* Make sure that we have rmapbt records for this extent. */
168 struct xchk_bmap_info *info,
169 struct xfs_bmbt_irec *irec,
172 struct xfs_rmap_irec rmap;
173 unsigned long long rmap_end;
176 if (!info->sc->sa.rmap_cur || xchk_skip_xref(info->sc->sm))
179 if (info->whichfork == XFS_COW_FORK)
180 owner = XFS_RMAP_OWN_COW;
182 owner = info->sc->ip->i_ino;
184 /* Find the rmap record for this irec. */
185 if (!xchk_bmap_get_rmap(info, irec, agbno, owner, &rmap))
188 /* Check the rmap. */
189 rmap_end = (unsigned long long)rmap.rm_startblock + rmap.rm_blockcount;
190 if (rmap.rm_startblock > agbno ||
191 agbno + irec->br_blockcount > rmap_end)
192 xchk_fblock_xref_set_corrupt(info->sc, info->whichfork,
196 * Check the logical offsets if applicable. CoW staging extents
197 * don't track logical offsets since the mappings only exist in
200 if (info->whichfork != XFS_COW_FORK) {
201 rmap_end = (unsigned long long)rmap.rm_offset +
203 if (rmap.rm_offset > irec->br_startoff ||
204 irec->br_startoff + irec->br_blockcount > rmap_end)
205 xchk_fblock_xref_set_corrupt(info->sc,
206 info->whichfork, irec->br_startoff);
209 if (rmap.rm_owner != owner)
210 xchk_fblock_xref_set_corrupt(info->sc, info->whichfork,
214 * Check for discrepancies between the unwritten flag in the irec and
215 * the rmap. Note that the (in-memory) CoW fork distinguishes between
216 * unwritten and written extents, but we don't track that in the rmap
217 * records because the blocks are owned (on-disk) by the refcountbt,
218 * which doesn't track unwritten state.
220 if (owner != XFS_RMAP_OWN_COW &&
221 !!(irec->br_state == XFS_EXT_UNWRITTEN) !=
222 !!(rmap.rm_flags & XFS_RMAP_UNWRITTEN))
223 xchk_fblock_xref_set_corrupt(info->sc, info->whichfork,
226 if (!!(info->whichfork == XFS_ATTR_FORK) !=
227 !!(rmap.rm_flags & XFS_RMAP_ATTR_FORK))
228 xchk_fblock_xref_set_corrupt(info->sc, info->whichfork,
230 if (rmap.rm_flags & XFS_RMAP_BMBT_BLOCK)
231 xchk_fblock_xref_set_corrupt(info->sc, info->whichfork,
235 /* Cross-reference a single rtdev extent record. */
237 xchk_bmap_rt_iextent_xref(
238 struct xfs_inode *ip,
239 struct xchk_bmap_info *info,
240 struct xfs_bmbt_irec *irec)
242 xchk_xref_is_used_rt_space(info->sc, irec->br_startblock,
243 irec->br_blockcount);
246 /* Cross-reference a single datadev extent record. */
248 xchk_bmap_iextent_xref(
249 struct xfs_inode *ip,
250 struct xchk_bmap_info *info,
251 struct xfs_bmbt_irec *irec)
253 struct xfs_mount *mp = info->sc->mp;
259 agno = XFS_FSB_TO_AGNO(mp, irec->br_startblock);
260 agbno = XFS_FSB_TO_AGBNO(mp, irec->br_startblock);
261 len = irec->br_blockcount;
263 error = xchk_ag_init_existing(info->sc, agno, &info->sc->sa);
264 if (!xchk_fblock_process_error(info->sc, info->whichfork,
265 irec->br_startoff, &error))
268 xchk_xref_is_used_space(info->sc, agbno, len);
269 xchk_xref_is_not_inode_chunk(info->sc, agbno, len);
270 xchk_bmap_xref_rmap(info, irec, agbno);
271 switch (info->whichfork) {
273 if (xfs_is_reflink_inode(info->sc->ip))
277 xchk_xref_is_not_shared(info->sc, agbno,
278 irec->br_blockcount);
281 xchk_xref_is_cow_staging(info->sc, agbno,
282 irec->br_blockcount);
286 xchk_ag_free(info->sc, &info->sc->sa);
290 * Directories and attr forks should never have blocks that can't be addressed
294 xchk_bmap_dirattr_extent(
295 struct xfs_inode *ip,
296 struct xchk_bmap_info *info,
297 struct xfs_bmbt_irec *irec)
299 struct xfs_mount *mp = ip->i_mount;
302 if (!S_ISDIR(VFS_I(ip)->i_mode) && info->whichfork != XFS_ATTR_FORK)
305 if (!xfs_verify_dablk(mp, irec->br_startoff))
306 xchk_fblock_set_corrupt(info->sc, info->whichfork,
309 off = irec->br_startoff + irec->br_blockcount - 1;
310 if (!xfs_verify_dablk(mp, off))
311 xchk_fblock_set_corrupt(info->sc, info->whichfork, off);
314 /* Scrub a single extent record. */
317 struct xfs_inode *ip,
318 struct xchk_bmap_info *info,
319 struct xfs_bmbt_irec *irec)
321 struct xfs_mount *mp = info->sc->mp;
325 * Check for out-of-order extents. This record could have come
326 * from the incore list, for which there is no ordering check.
328 if (irec->br_startoff < info->lastoff)
329 xchk_fblock_set_corrupt(info->sc, info->whichfork,
332 if (!xfs_verify_fileext(mp, irec->br_startoff, irec->br_blockcount))
333 xchk_fblock_set_corrupt(info->sc, info->whichfork,
336 xchk_bmap_dirattr_extent(ip, info, irec);
338 /* There should never be a "hole" extent in either extent list. */
339 if (irec->br_startblock == HOLESTARTBLOCK)
340 xchk_fblock_set_corrupt(info->sc, info->whichfork,
344 * Check for delalloc extents. We never iterate the ones in the
345 * in-core extent scan, and we should never see these in the bmbt.
347 if (isnullstartblock(irec->br_startblock))
348 xchk_fblock_set_corrupt(info->sc, info->whichfork,
351 /* Make sure the extent points to a valid place. */
352 if (irec->br_blockcount > MAXEXTLEN)
353 xchk_fblock_set_corrupt(info->sc, info->whichfork,
356 !xfs_verify_rtext(mp, irec->br_startblock, irec->br_blockcount))
357 xchk_fblock_set_corrupt(info->sc, info->whichfork,
360 !xfs_verify_fsbext(mp, irec->br_startblock, irec->br_blockcount))
361 xchk_fblock_set_corrupt(info->sc, info->whichfork,
364 /* We don't allow unwritten extents on attr forks. */
365 if (irec->br_state == XFS_EXT_UNWRITTEN &&
366 info->whichfork == XFS_ATTR_FORK)
367 xchk_fblock_set_corrupt(info->sc, info->whichfork,
370 if (info->sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
374 xchk_bmap_rt_iextent_xref(ip, info, irec);
376 xchk_bmap_iextent_xref(ip, info, irec);
378 info->lastoff = irec->br_startoff + irec->br_blockcount;
382 /* Scrub a bmbt record. */
385 struct xchk_btree *bs,
386 const union xfs_btree_rec *rec)
388 struct xfs_bmbt_irec irec;
389 struct xfs_bmbt_irec iext_irec;
390 struct xfs_iext_cursor icur;
391 struct xchk_bmap_info *info = bs->private;
392 struct xfs_inode *ip = bs->cur->bc_ino.ip;
393 struct xfs_buf *bp = NULL;
394 struct xfs_btree_block *block;
395 struct xfs_ifork *ifp = XFS_IFORK_PTR(ip, info->whichfork);
400 * Check the owners of the btree blocks up to the level below
401 * the root since the verifiers don't do that.
403 if (xfs_sb_version_hascrc(&bs->cur->bc_mp->m_sb) &&
404 bs->cur->bc_ptrs[0] == 1) {
405 for (i = 0; i < bs->cur->bc_nlevels - 1; i++) {
406 block = xfs_btree_get_block(bs->cur, i, &bp);
407 owner = be64_to_cpu(block->bb_u.l.bb_owner);
408 if (owner != ip->i_ino)
409 xchk_fblock_set_corrupt(bs->sc,
415 * Check that the incore extent tree contains an extent that matches
416 * this one exactly. We validate those cached bmaps later, so we don't
417 * need to check them here. If the incore extent tree was just loaded
418 * from disk by the scrubber, we assume that its contents match what's
419 * on disk (we still hold the ILOCK) and skip the equivalence check.
421 if (!info->was_loaded)
424 xfs_bmbt_disk_get_all(&rec->bmbt, &irec);
425 if (!xfs_iext_lookup_extent(ip, ifp, irec.br_startoff, &icur,
427 irec.br_startoff != iext_irec.br_startoff ||
428 irec.br_startblock != iext_irec.br_startblock ||
429 irec.br_blockcount != iext_irec.br_blockcount ||
430 irec.br_state != iext_irec.br_state)
431 xchk_fblock_set_corrupt(bs->sc, info->whichfork,
436 /* Scan the btree records. */
439 struct xfs_scrub *sc,
441 struct xchk_bmap_info *info)
443 struct xfs_owner_info oinfo;
444 struct xfs_ifork *ifp = XFS_IFORK_PTR(sc->ip, whichfork);
445 struct xfs_mount *mp = sc->mp;
446 struct xfs_inode *ip = sc->ip;
447 struct xfs_btree_cur *cur;
450 /* Load the incore bmap cache if it's not loaded. */
451 info->was_loaded = !xfs_need_iread_extents(ifp);
453 error = xfs_iread_extents(sc->tp, ip, whichfork);
454 if (!xchk_fblock_process_error(sc, whichfork, 0, &error))
457 /* Check the btree structure. */
458 cur = xfs_bmbt_init_cursor(mp, sc->tp, ip, whichfork);
459 xfs_rmap_ino_bmbt_owner(&oinfo, ip->i_ino, whichfork);
460 error = xchk_btree(sc, cur, xchk_bmapbt_rec, &oinfo, info);
461 xfs_btree_del_cursor(cur, error);
466 struct xchk_bmap_check_rmap_info {
467 struct xfs_scrub *sc;
469 struct xfs_iext_cursor icur;
472 /* Can we find bmaps that fit this rmap? */
474 xchk_bmap_check_rmap(
475 struct xfs_btree_cur *cur,
476 const struct xfs_rmap_irec *rec,
479 struct xfs_bmbt_irec irec;
480 struct xfs_rmap_irec check_rec;
481 struct xchk_bmap_check_rmap_info *sbcri = priv;
482 struct xfs_ifork *ifp;
483 struct xfs_scrub *sc = sbcri->sc;
486 /* Is this even the right fork? */
487 if (rec->rm_owner != sc->ip->i_ino)
489 if ((sbcri->whichfork == XFS_ATTR_FORK) ^
490 !!(rec->rm_flags & XFS_RMAP_ATTR_FORK))
492 if (rec->rm_flags & XFS_RMAP_BMBT_BLOCK)
495 /* Now look up the bmbt record. */
496 ifp = XFS_IFORK_PTR(sc->ip, sbcri->whichfork);
498 xchk_fblock_set_corrupt(sc, sbcri->whichfork,
502 have_map = xfs_iext_lookup_extent(sc->ip, ifp, rec->rm_offset,
503 &sbcri->icur, &irec);
505 xchk_fblock_set_corrupt(sc, sbcri->whichfork,
508 * bmap extent record lengths are constrained to 2^21 blocks in length
509 * because of space constraints in the on-disk metadata structure.
510 * However, rmap extent record lengths are constrained only by AG
511 * length, so we have to loop through the bmbt to make sure that the
512 * entire rmap is covered by bmbt records.
516 if (irec.br_startoff != check_rec.rm_offset)
517 xchk_fblock_set_corrupt(sc, sbcri->whichfork,
518 check_rec.rm_offset);
519 if (irec.br_startblock != XFS_AGB_TO_FSB(sc->mp,
520 cur->bc_ag.pag->pag_agno,
521 check_rec.rm_startblock))
522 xchk_fblock_set_corrupt(sc, sbcri->whichfork,
523 check_rec.rm_offset);
524 if (irec.br_blockcount > check_rec.rm_blockcount)
525 xchk_fblock_set_corrupt(sc, sbcri->whichfork,
526 check_rec.rm_offset);
527 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
529 check_rec.rm_startblock += irec.br_blockcount;
530 check_rec.rm_offset += irec.br_blockcount;
531 check_rec.rm_blockcount -= irec.br_blockcount;
532 if (check_rec.rm_blockcount == 0)
534 have_map = xfs_iext_next_extent(ifp, &sbcri->icur, &irec);
536 xchk_fblock_set_corrupt(sc, sbcri->whichfork,
537 check_rec.rm_offset);
541 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
546 /* Make sure each rmap has a corresponding bmbt entry. */
548 xchk_bmap_check_ag_rmaps(
549 struct xfs_scrub *sc,
551 struct xfs_perag *pag)
553 struct xchk_bmap_check_rmap_info sbcri;
554 struct xfs_btree_cur *cur;
558 error = xfs_alloc_read_agf(sc->mp, sc->tp, pag->pag_agno, 0, &agf);
562 cur = xfs_rmapbt_init_cursor(sc->mp, sc->tp, agf, pag);
565 sbcri.whichfork = whichfork;
566 error = xfs_rmap_query_all(cur, xchk_bmap_check_rmap, &sbcri);
567 if (error == -ECANCELED)
570 xfs_btree_del_cursor(cur, error);
571 xfs_trans_brelse(sc->tp, agf);
575 /* Make sure each rmap has a corresponding bmbt entry. */
577 xchk_bmap_check_rmaps(
578 struct xfs_scrub *sc,
581 struct xfs_ifork *ifp = XFS_IFORK_PTR(sc->ip, whichfork);
582 struct xfs_perag *pag;
587 if (!xfs_sb_version_hasrmapbt(&sc->mp->m_sb) ||
588 whichfork == XFS_COW_FORK ||
589 (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT))
592 /* Don't support realtime rmap checks yet. */
593 if (XFS_IS_REALTIME_INODE(sc->ip) && whichfork == XFS_DATA_FORK)
596 ASSERT(XFS_IFORK_PTR(sc->ip, whichfork) != NULL);
599 * Only do this for complex maps that are in btree format, or for
600 * situations where we would seem to have a size but zero extents.
601 * The inode repair code can zap broken iforks, which means we have
602 * to flag this bmap as corrupt if there are rmaps that need to be
606 if (whichfork == XFS_DATA_FORK)
607 zero_size = i_size_read(VFS_I(sc->ip)) == 0;
611 if (ifp->if_format != XFS_DINODE_FMT_BTREE &&
612 (zero_size || ifp->if_nextents > 0))
615 for_each_perag(sc->mp, agno, pag) {
616 error = xchk_bmap_check_ag_rmaps(sc, whichfork, pag);
619 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
628 * Scrub an inode fork's block mappings.
630 * First we scan every record in every btree block, if applicable.
631 * Then we unconditionally scan the incore extent cache.
635 struct xfs_scrub *sc,
638 struct xfs_bmbt_irec irec;
639 struct xchk_bmap_info info = { NULL };
640 struct xfs_mount *mp = sc->mp;
641 struct xfs_inode *ip = sc->ip;
642 struct xfs_ifork *ifp = XFS_IFORK_PTR(ip, whichfork);
643 xfs_fileoff_t endoff;
644 struct xfs_iext_cursor icur;
647 /* Non-existent forks can be ignored. */
651 info.is_rt = whichfork == XFS_DATA_FORK && XFS_IS_REALTIME_INODE(ip);
652 info.whichfork = whichfork;
653 info.is_shared = whichfork == XFS_DATA_FORK && xfs_is_reflink_inode(ip);
658 /* No CoW forks on non-reflink inodes/filesystems. */
659 if (!xfs_is_reflink_inode(ip)) {
660 xchk_ino_set_corrupt(sc, sc->ip->i_ino);
665 if (!xfs_sb_version_hasattr(&mp->m_sb) &&
666 !xfs_sb_version_hasattr2(&mp->m_sb))
667 xchk_ino_set_corrupt(sc, sc->ip->i_ino);
670 ASSERT(whichfork == XFS_DATA_FORK);
674 /* Check the fork values */
675 switch (ifp->if_format) {
676 case XFS_DINODE_FMT_UUID:
677 case XFS_DINODE_FMT_DEV:
678 case XFS_DINODE_FMT_LOCAL:
679 /* No mappings to check. */
681 case XFS_DINODE_FMT_EXTENTS:
683 case XFS_DINODE_FMT_BTREE:
684 if (whichfork == XFS_COW_FORK) {
685 xchk_fblock_set_corrupt(sc, whichfork, 0);
689 error = xchk_bmap_btree(sc, whichfork, &info);
694 xchk_fblock_set_corrupt(sc, whichfork, 0);
698 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
701 /* Find the offset of the last extent in the mapping. */
702 error = xfs_bmap_last_offset(ip, &endoff, whichfork);
703 if (!xchk_fblock_process_error(sc, whichfork, 0, &error))
706 /* Scrub extent records. */
708 ifp = XFS_IFORK_PTR(ip, whichfork);
709 for_each_xfs_iext(ifp, &icur, &irec) {
710 if (xchk_should_terminate(sc, &error) ||
711 (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT))
713 if (isnullstartblock(irec.br_startblock))
715 if (irec.br_startoff >= endoff) {
716 xchk_fblock_set_corrupt(sc, whichfork,
720 error = xchk_bmap_iextent(ip, &info, &irec);
725 error = xchk_bmap_check_rmaps(sc, whichfork);
726 if (!xchk_fblock_xref_process_error(sc, whichfork, 0, &error))
732 /* Scrub an inode's data fork. */
735 struct xfs_scrub *sc)
737 return xchk_bmap(sc, XFS_DATA_FORK);
740 /* Scrub an inode's attr fork. */
743 struct xfs_scrub *sc)
745 return xchk_bmap(sc, XFS_ATTR_FORK);
748 /* Scrub an inode's CoW fork. */
751 struct xfs_scrub *sc)
753 if (!xfs_is_reflink_inode(sc->ip))
756 return xchk_bmap(sc, XFS_COW_FORK);