1 // SPDX-License-Identifier: GPL-2.0+
30  * repair on-disk data structures.  That task was left to the xfs_check
41  * also be cross-referenced against other btrees to look for potential
44  * It is expected that the checkers responsible for per-AG metadata
46  * metadata structure, and perform any relevant cross-referencing before
51  * Block maps and b-trees rooted in an inode present a special challenge
52  * because they can involve extents from any AG.  The general scrubber
53  * structure of lock -> check -> xref -> unlock still holds, but AG
58  * can signal a potential deadlock, in which case the scrubber can jump
63  * (directories and attributes) we follow the same btree-scrubbing
73  * re-grab the buffer in the context of the same transaction, we avoid
75  * scrubber, something will notice that something is amiss and report
76  * the corruption.  Therefore, each scrubber will allocate an empty
78  * end of the scrub run.  Cancelling a non-dirty transaction simply
90  * cross-referencing every record with all other available metadata.
97  * cross-reference with a defective btree.
101  * the metadata object by setting the REPAIR flag and re-calling the
103  * on-disk specification; operations cannot continue if the violation is
108  * done without rebuilding entire structures.
111  * Lock -> scrub -> repair -> commit -> re-lock -> re-scrub -> unlock.
118  * - "xfs_" are general XFS symbols.
119  * - "xchk_" are symbols related to metadata checking.
120  * - "xrep_" are symbols related to metadata repair.
121  * - "xfs_scrub_" are symbols that tie online fsck to the rest of XFS.
125  * Scrub probe -- userspace uses this to probe if we're willing to scrub
155 	xchk_ag_free(sc, &sc->sa);  in xchk_teardown()
156 	if (sc->tp) {  in xchk_teardown()
157 		if (error == 0 && (sc->sm->sm_flags & XFS_SCRUB_IFLAG_REPAIR))  in xchk_teardown()
158 			error = xfs_trans_commit(sc->tp);  in xchk_teardown()
160 			xfs_trans_cancel(sc->tp);  in xchk_teardown()
161 		sc->tp = NULL;  in xchk_teardown()
163 	if (sc->ip) {  in xchk_teardown()
164 		if (sc->ilock_flags)  in xchk_teardown()
165 			xfs_iunlock(sc->ip, sc->ilock_flags);  in xchk_teardown()
166 		if (sc->ip != ip_in &&  in xchk_teardown()
167 		    !xfs_internal_inum(sc->mp, sc->ip->i_ino))  in xchk_teardown()
168 			xfs_irele(sc->ip);  in xchk_teardown()
169 		sc->ip = NULL;  in xchk_teardown()
171 	sb_end_write(sc->mp->m_super);  in xchk_teardown()
172 	if (sc->flags & XCHK_REAPING_DISABLED)  in xchk_teardown()
174 	if (sc->flags & XCHK_HAS_QUOTAOFFLOCK) {  in xchk_teardown()
175 		mutex_unlock(&sc->mp->m_quotainfo->qi_quotaofflock);  in xchk_teardown()
176 		sc->flags &= ~XCHK_HAS_QUOTAOFFLOCK;  in xchk_teardown()
178 	if (sc->buf) {  in xchk_teardown()
179 		kmem_free(sc->buf);  in xchk_teardown()
180 		sc->buf = NULL;  in xchk_teardown()
367 	error = -EINVAL;  in xchk_validate_inputs()
369 	sm->sm_flags &= ~XFS_SCRUB_FLAGS_OUT;  in xchk_validate_inputs()
370 	if (sm->sm_flags & ~XFS_SCRUB_FLAGS_IN)  in xchk_validate_inputs()
373 	if (memchr_inv(sm->sm_reserved, 0, sizeof(sm->sm_reserved)))  in xchk_validate_inputs()
376 	error = -ENOENT;  in xchk_validate_inputs()
378 	if (sm->sm_type >= XFS_SCRUB_TYPE_NR)  in xchk_validate_inputs()
380 	ops = &meta_scrub_ops[sm->sm_type];  in xchk_validate_inputs()
381 	if (ops->setup == NULL || ops->scrub == NULL)  in xchk_validate_inputs()
384 	if (ops->has && !ops->has(&mp->m_sb))  in xchk_validate_inputs()
387 	error = -EINVAL;  in xchk_validate_inputs()
389 	switch (ops->type) {  in xchk_validate_inputs()
392 		if (sm->sm_ino || sm->sm_gen || sm->sm_agno)  in xchk_validate_inputs()
396 		if (sm->sm_ino || sm->sm_gen ||  in xchk_validate_inputs()
397 		    sm->sm_agno >= mp->m_sb.sb_agcount)  in xchk_validate_inputs()
401 		if (sm->sm_agno || (sm->sm_gen && !sm->sm_ino))  in xchk_validate_inputs()
409 	 * We only want to repair read-write v5+ filesystems.  Defer the check  in xchk_validate_inputs()
410 	 * for ops->repair until after our scrub confirms that we need to  in xchk_validate_inputs()
414 	if (sm->sm_flags & XFS_SCRUB_IFLAG_REPAIR) {  in xchk_validate_inputs()
415 		error = -EOPNOTSUPP;  in xchk_validate_inputs()
416 		if (!xfs_sb_version_hascrc(&mp->m_sb))  in xchk_validate_inputs()
419 		error = -EROFS;  in xchk_validate_inputs()
420 		if (mp->m_flags & XFS_MOUNT_RDONLY)  in xchk_validate_inputs()
437 	if ((sc->sm->sm_flags & XFS_SCRUB_IFLAG_REPAIR) &&  in xchk_postmortem()
438 	    (sc->sm->sm_flags & (XFS_SCRUB_OFLAG_CORRUPT |  in xchk_postmortem()
440 		xrep_failure(sc->mp);  in xchk_postmortem()
449 	if (sc->sm->sm_flags & (XFS_SCRUB_OFLAG_CORRUPT |  in xchk_postmortem()
451 		xfs_alert_ratelimited(sc->mp,  in xchk_postmortem()
463 		.mp			= ip->i_mount,  in xfs_scrub_metadata()
469 	struct xfs_mount		*mp = ip->i_mount;  in xfs_scrub_metadata()
478 	error = -ESHUTDOWN;  in xfs_scrub_metadata()
481 	error = -ENOTRECOVERABLE;  in xfs_scrub_metadata()
482 	if (mp->m_flags & XFS_MOUNT_NORECOVERY)  in xfs_scrub_metadata()
491 	sc.ops = &meta_scrub_ops[sm->sm_type];  in xfs_scrub_metadata()
492 	sc.sick_mask = xchk_health_mask_for_scrub_type(sm->sm_type);  in xfs_scrub_metadata()
500 	sb_start_write(mp->m_super);  in xfs_scrub_metadata()
503 	error = sc.ops->setup(&sc, ip);  in xfs_scrub_metadata()
508 	error = sc.ops->scrub(&sc);  in xfs_scrub_metadata()
509 	if (!(sc.flags & XCHK_TRY_HARDER) && error == -EDEADLOCK) {  in xfs_scrub_metadata()
511 		 * Scrubbers return -EDEADLOCK to mean 'try harder'.  in xfs_scrub_metadata()
513 		 * preparation for worst-case scenarios.  in xfs_scrub_metadata()
525 	if ((sc.sm->sm_flags & XFS_SCRUB_IFLAG_REPAIR) &&  in xfs_scrub_metadata()
531 			sc.sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;  in xfs_scrub_metadata()
533 		needs_fix = (sc.sm->sm_flags & (XFS_SCRUB_OFLAG_CORRUPT |  in xfs_scrub_metadata()
541 			sc.sm->sm_flags |= XFS_SCRUB_OFLAG_NO_REPAIR_NEEDED;  in xfs_scrub_metadata()
550 		if (error == -EAGAIN) {  in xfs_scrub_metadata()
571 	if (error == -EFSCORRUPTED || error == -EFSBADCRC) {  in xfs_scrub_metadata()
572 		sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;  in xfs_scrub_metadata()