common.c 34.8 KB
Newer Older
1
// SPDX-License-Identifier: GPL-2.0-or-later
2
/*
3
 * Copyright (C) 2017-2023 Oracle.  All Rights Reserved.
4
 * Author: Darrick J. Wong <djwong@kernel.org>
5 6 7 8 9 10 11 12 13 14 15
 */
#include "xfs.h"
#include "xfs_fs.h"
#include "xfs_shared.h"
#include "xfs_format.h"
#include "xfs_trans_resv.h"
#include "xfs_mount.h"
#include "xfs_btree.h"
#include "xfs_log_format.h"
#include "xfs_trans.h"
#include "xfs_inode.h"
Darrick J. Wong's avatar
Darrick J. Wong committed
16
#include "xfs_icache.h"
17 18 19 20 21 22 23
#include "xfs_alloc.h"
#include "xfs_alloc_btree.h"
#include "xfs_ialloc.h"
#include "xfs_ialloc_btree.h"
#include "xfs_refcount_btree.h"
#include "xfs_rmap.h"
#include "xfs_rmap_btree.h"
Darrick J. Wong's avatar
Darrick J. Wong committed
24 25
#include "xfs_log.h"
#include "xfs_trans_priv.h"
26 27
#include "xfs_da_format.h"
#include "xfs_da_btree.h"
28 29
#include "xfs_attr.h"
#include "xfs_reflink.h"
30
#include "xfs_ag.h"
31 32 33
#include "scrub/scrub.h"
#include "scrub/common.h"
#include "scrub/trace.h"
34
#include "scrub/repair.h"
35
#include "scrub/health.h"
36 37 38

/* Common code for the metadata scrubbers. */

39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64
/*
 * Handling operational errors.
 *
 * The *_process_error() family of functions are used to process error return
 * codes from functions called as part of a scrub operation.
 *
 * If there's no error, we return true to tell the caller that it's ok
 * to move on to the next check in its list.
 *
 * For non-verifier errors (e.g. ENOMEM) we return false to tell the
 * caller that something bad happened, and we preserve *error so that
 * the caller can return the *error up the stack to userspace.
 *
 * Verifier errors (EFSBADCRC/EFSCORRUPTED) are recorded by setting
 * OFLAG_CORRUPT in sm_flags and the *error is cleared.  In other words,
 * we track verifier errors (and failed scrub checks) via OFLAG_CORRUPT,
 * not via return codes.  We return false to tell the caller that
 * something bad happened.  Since the error has been cleared, the caller
 * will (presumably) return that zero and scrubbing will move on to
 * whatever's next.
 *
 * ftrace can be used to record the precise metadata location and the
 * approximate code location of the failed operation.
 */

/* Check for operational errors. */
65
static bool
66
__xchk_process_error(
67
	struct xfs_scrub	*sc,
68 69 70 71 72
	xfs_agnumber_t		agno,
	xfs_agblock_t		bno,
	int			*error,
	__u32			errflag,
	void			*ret_ip)
73 74 75 76 77
{
	switch (*error) {
	case 0:
		return true;
	case -EDEADLOCK:
78
	case -ECHRNG:
79
		/* Used to restart an op with deadlock avoidance. */
80 81 82
		trace_xchk_deadlock_retry(
				sc->ip ? sc->ip : XFS_I(file_inode(sc->file)),
				sc->sm, *error);
83 84 85 86
		break;
	case -EFSBADCRC:
	case -EFSCORRUPTED:
		/* Note the badness but don't abort. */
87
		sc->sm->sm_flags |= errflag;
88
		*error = 0;
89
		fallthrough;
90
	default:
91
		trace_xchk_op_error(sc, agno, bno, *error,
92
				ret_ip);
93 94 95 96 97 98
		break;
	}
	return false;
}

bool
99
xchk_process_error(
100
	struct xfs_scrub	*sc,
101 102 103
	xfs_agnumber_t		agno,
	xfs_agblock_t		bno,
	int			*error)
104
{
105
	return __xchk_process_error(sc, agno, bno, error,
106 107 108 109
			XFS_SCRUB_OFLAG_CORRUPT, __return_address);
}

bool
110
xchk_xref_process_error(
111
	struct xfs_scrub	*sc,
112 113 114
	xfs_agnumber_t		agno,
	xfs_agblock_t		bno,
	int			*error)
115
{
116
	return __xchk_process_error(sc, agno, bno, error,
117 118 119 120 121
			XFS_SCRUB_OFLAG_XFAIL, __return_address);
}

/* Check for operational errors for a file offset. */
static bool
122
__xchk_fblock_process_error(
123
	struct xfs_scrub	*sc,
124 125 126 127 128
	int			whichfork,
	xfs_fileoff_t		offset,
	int			*error,
	__u32			errflag,
	void			*ret_ip)
129 130 131 132 133
{
	switch (*error) {
	case 0:
		return true;
	case -EDEADLOCK:
134
	case -ECHRNG:
135
		/* Used to restart an op with deadlock avoidance. */
136
		trace_xchk_deadlock_retry(sc->ip, sc->sm, *error);
137 138 139 140
		break;
	case -EFSBADCRC:
	case -EFSCORRUPTED:
		/* Note the badness but don't abort. */
141
		sc->sm->sm_flags |= errflag;
142
		*error = 0;
143
		fallthrough;
144
	default:
145
		trace_xchk_file_op_error(sc, whichfork, offset, *error,
146
				ret_ip);
147 148 149 150 151
		break;
	}
	return false;
}

152
bool
153
xchk_fblock_process_error(
154
	struct xfs_scrub	*sc,
155 156 157
	int			whichfork,
	xfs_fileoff_t		offset,
	int			*error)
158
{
159
	return __xchk_fblock_process_error(sc, whichfork, offset, error,
160 161 162 163
			XFS_SCRUB_OFLAG_CORRUPT, __return_address);
}

bool
164
xchk_fblock_xref_process_error(
165
	struct xfs_scrub	*sc,
166 167 168
	int			whichfork,
	xfs_fileoff_t		offset,
	int			*error)
169
{
170
	return __xchk_fblock_process_error(sc, whichfork, offset, error,
171 172 173
			XFS_SCRUB_OFLAG_XFAIL, __return_address);
}

174 175 176 177 178 179 180 181 182 183 184 185 186 187
/*
 * Handling scrub corruption/optimization/warning checks.
 *
 * The *_set_{corrupt,preen,warning}() family of functions are used to
 * record the presence of metadata that is incorrect (corrupt), could be
 * optimized somehow (preen), or should be flagged for administrative
 * review but is not incorrect (warn).
 *
 * ftrace can be used to record the precise metadata location and
 * approximate code location of the failed check.
 */

/* Record a block which could be optimized. */
void
188
xchk_block_set_preen(
189
	struct xfs_scrub	*sc,
190
	struct xfs_buf		*bp)
191 192
{
	sc->sm->sm_flags |= XFS_SCRUB_OFLAG_PREEN;
193
	trace_xchk_block_preen(sc, xfs_buf_daddr(bp), __return_address);
194 195 196 197 198 199 200 201
}

/*
 * Record an inode which could be optimized.  The trace data will
 * include the block given by bp if bp is given; otherwise it will use
 * the block location of the inode record itself.
 */
void
202
xchk_ino_set_preen(
203
	struct xfs_scrub	*sc,
204
	xfs_ino_t		ino)
205 206
{
	sc->sm->sm_flags |= XFS_SCRUB_OFLAG_PREEN;
207
	trace_xchk_ino_preen(sc, ino, __return_address);
208 209
}

210 211 212 213 214 215 216 217 218
/* Record something being wrong with the filesystem primary superblock. */
void
xchk_set_corrupt(
	struct xfs_scrub	*sc)
{
	sc->sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;
	trace_xchk_fs_error(sc, 0, __return_address);
}

219 220
/* Record a corrupt block. */
void
221
xchk_block_set_corrupt(
222
	struct xfs_scrub	*sc,
223
	struct xfs_buf		*bp)
224 225
{
	sc->sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;
226
	trace_xchk_block_error(sc, xfs_buf_daddr(bp), __return_address);
227 228
}

229 230
/* Record a corruption while cross-referencing. */
void
231
xchk_block_xref_set_corrupt(
232
	struct xfs_scrub	*sc,
233
	struct xfs_buf		*bp)
234 235
{
	sc->sm->sm_flags |= XFS_SCRUB_OFLAG_XCORRUPT;
236
	trace_xchk_block_error(sc, xfs_buf_daddr(bp), __return_address);
237 238
}

239 240 241 242 243 244
/*
 * Record a corrupt inode.  The trace data will include the block given
 * by bp if bp is given; otherwise it will use the block location of the
 * inode record itself.
 */
void
245
xchk_ino_set_corrupt(
246
	struct xfs_scrub	*sc,
247
	xfs_ino_t		ino)
248 249
{
	sc->sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;
250
	trace_xchk_ino_error(sc, ino, __return_address);
251 252
}

253 254
/* Record a corruption while cross-referencing with an inode. */
void
255
xchk_ino_xref_set_corrupt(
256
	struct xfs_scrub	*sc,
257
	xfs_ino_t		ino)
258 259
{
	sc->sm->sm_flags |= XFS_SCRUB_OFLAG_XCORRUPT;
260
	trace_xchk_ino_error(sc, ino, __return_address);
261 262
}

263 264
/* Record corruption in a block indexed by a file fork. */
void
265
xchk_fblock_set_corrupt(
266
	struct xfs_scrub	*sc,
267 268
	int			whichfork,
	xfs_fileoff_t		offset)
269 270
{
	sc->sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;
271
	trace_xchk_fblock_error(sc, whichfork, offset, __return_address);
272 273
}

274 275
/* Record a corruption while cross-referencing a fork block. */
void
276
xchk_fblock_xref_set_corrupt(
277
	struct xfs_scrub	*sc,
278 279
	int			whichfork,
	xfs_fileoff_t		offset)
280 281
{
	sc->sm->sm_flags |= XFS_SCRUB_OFLAG_XCORRUPT;
282
	trace_xchk_fblock_error(sc, whichfork, offset, __return_address);
283 284
}

285 286 287 288 289
/*
 * Warn about inodes that need administrative review but is not
 * incorrect.
 */
void
290
xchk_ino_set_warning(
291
	struct xfs_scrub	*sc,
292
	xfs_ino_t		ino)
293 294
{
	sc->sm->sm_flags |= XFS_SCRUB_OFLAG_WARNING;
295
	trace_xchk_ino_warning(sc, ino, __return_address);
296 297 298 299
}

/* Warn about a block indexed by a file fork that needs review. */
void
300
xchk_fblock_set_warning(
301
	struct xfs_scrub	*sc,
302 303
	int			whichfork,
	xfs_fileoff_t		offset)
304 305
{
	sc->sm->sm_flags |= XFS_SCRUB_OFLAG_WARNING;
306
	trace_xchk_fblock_warning(sc, whichfork, offset, __return_address);
307 308 309 310
}

/* Signal an incomplete scrub. */
void
311
xchk_set_incomplete(
312
	struct xfs_scrub	*sc)
313 314
{
	sc->sm->sm_flags |= XFS_SCRUB_OFLAG_INCOMPLETE;
315
	trace_xchk_incomplete(sc, __return_address);
316 317
}

318 319 320 321 322
/*
 * rmap scrubbing -- compute the number of blocks with a given owner,
 * at least according to the reverse mapping data.
 */

323
struct xchk_rmap_ownedby_info {
324 325
	const struct xfs_owner_info	*oinfo;
	xfs_filblks_t			*blocks;
326 327 328
};

STATIC int
329
xchk_count_rmap_ownedby_irec(
330
	struct xfs_btree_cur		*cur,
331
	const struct xfs_rmap_irec	*rec,
332
	void				*priv)
333
{
334 335 336
	struct xchk_rmap_ownedby_info	*sroi = priv;
	bool				irec_attr;
	bool				oinfo_attr;
337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354

	irec_attr = rec->rm_flags & XFS_RMAP_ATTR_FORK;
	oinfo_attr = sroi->oinfo->oi_flags & XFS_OWNER_INFO_ATTR_FORK;

	if (rec->rm_owner != sroi->oinfo->oi_owner)
		return 0;

	if (XFS_RMAP_NON_INODE_OWNER(rec->rm_owner) || irec_attr == oinfo_attr)
		(*sroi->blocks) += rec->rm_blockcount;

	return 0;
}

/*
 * Calculate the number of blocks the rmap thinks are owned by something.
 * The caller should pass us an rmapbt cursor.
 */
int
355
xchk_count_rmap_ownedby_ag(
356
	struct xfs_scrub		*sc,
357
	struct xfs_btree_cur		*cur,
358
	const struct xfs_owner_info	*oinfo,
359
	xfs_filblks_t			*blocks)
360
{
361 362 363 364
	struct xchk_rmap_ownedby_info	sroi = {
		.oinfo			= oinfo,
		.blocks			= blocks,
	};
365 366

	*blocks = 0;
367
	return xfs_rmap_query_all(cur, xchk_count_rmap_ownedby_irec,
368 369 370
			&sroi);
}

371 372 373 374 375 376 377 378
/*
 * AG scrubbing
 *
 * These helpers facilitate locking an allocation group's header
 * buffers, setting up cursors for all btrees that are present, and
 * cleaning everything up once we're through.
 */

Darrick J. Wong's avatar
Darrick J. Wong committed
379 380 381
/* Decide if we want to return an AG header read failure. */
static inline bool
want_ag_read_header_failure(
382
	struct xfs_scrub	*sc,
383
	unsigned int		type)
Darrick J. Wong's avatar
Darrick J. Wong committed
384 385 386
{
	/* Return all AG header read failures when scanning btrees. */
	if (sc->sm->sm_type != XFS_SCRUB_TYPE_AGF &&
Darrick J. Wong's avatar
Darrick J. Wong committed
387 388
	    sc->sm->sm_type != XFS_SCRUB_TYPE_AGFL &&
	    sc->sm->sm_type != XFS_SCRUB_TYPE_AGI)
Darrick J. Wong's avatar
Darrick J. Wong committed
389 390 391 392 393 394 395 396 397 398 399
		return true;
	/*
	 * If we're scanning a given type of AG header, we only want to
	 * see read failures from that specific header.  We'd like the
	 * other headers to cross-check them, but this isn't required.
	 */
	if (sc->sm->sm_type == type)
		return true;
	return false;
}

400
/*
401
 * Grab the AG header buffers for the attached perag structure.
402
 *
403 404
 * The headers should be released by xchk_ag_free, but as a fail safe we attach
 * all the buffers we grab to the scrub transaction so they'll all be freed
405
 * when we cancel it.
406
 */
407 408
static inline int
xchk_perag_read_headers(
409
	struct xfs_scrub	*sc,
410
	struct xchk_ag		*sa)
411
{
412
	int			error;
413

414
	error = xfs_ialloc_read_agi(sa->pag, sc->tp, &sa->agi_bp);
Darrick J. Wong's avatar
Darrick J. Wong committed
415
	if (error && want_ag_read_header_failure(sc, XFS_SCRUB_TYPE_AGI))
416
		return error;
417

418
	error = xfs_alloc_read_agf(sa->pag, sc->tp, 0, &sa->agf_bp);
Darrick J. Wong's avatar
Darrick J. Wong committed
419
	if (error && want_ag_read_header_failure(sc, XFS_SCRUB_TYPE_AGF))
420
		return error;
421

422
	return 0;
423 424
}

425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491
/*
 * Grab the AG headers for the attached perag structure and wait for pending
 * intents to drain.
 */
static int
xchk_perag_drain_and_lock(
	struct xfs_scrub	*sc)
{
	struct xchk_ag		*sa = &sc->sa;
	int			error = 0;

	ASSERT(sa->pag != NULL);
	ASSERT(sa->agi_bp == NULL);
	ASSERT(sa->agf_bp == NULL);

	do {
		if (xchk_should_terminate(sc, &error))
			return error;

		error = xchk_perag_read_headers(sc, sa);
		if (error)
			return error;

		/*
		 * If we've grabbed an inode for scrubbing then we assume that
		 * holding its ILOCK will suffice to coordinate with any intent
		 * chains involving this inode.
		 */
		if (sc->ip)
			return 0;

		/*
		 * Decide if this AG is quiet enough for all metadata to be
		 * consistent with each other.  XFS allows the AG header buffer
		 * locks to cycle across transaction rolls while processing
		 * chains of deferred ops, which means that there could be
		 * other threads in the middle of processing a chain of
		 * deferred ops.  For regular operations we are careful about
		 * ordering operations to prevent collisions between threads
		 * (which is why we don't need a per-AG lock), but scrub and
		 * repair have to serialize against chained operations.
		 *
		 * We just locked all the AG headers buffers; now take a look
		 * to see if there are any intents in progress.  If there are,
		 * drop the AG headers and wait for the intents to drain.
		 * Since we hold all the AG header locks for the duration of
		 * the scrub, this is the only time we have to sample the
		 * intents counter; any threads increasing it after this point
		 * can't possibly be in the middle of a chain of AG metadata
		 * updates.
		 *
		 * Obviously, this should be slanted against scrub and in favor
		 * of runtime threads.
		 */
		if (!xfs_perag_intent_busy(sa->pag))
			return 0;

		if (sa->agf_bp) {
			xfs_trans_brelse(sc->tp, sa->agf_bp);
			sa->agf_bp = NULL;
		}

		if (sa->agi_bp) {
			xfs_trans_brelse(sc->tp, sa->agi_bp);
			sa->agi_bp = NULL;
		}

492
		if (!(sc->flags & XCHK_FSGATES_DRAIN))
493
			return -ECHRNG;
494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522
		error = xfs_perag_intent_drain(sa->pag);
		if (error == -ERESTARTSYS)
			error = -EINTR;
	} while (!error);

	return error;
}

/*
 * Grab the per-AG structure, grab all AG header buffers, and wait until there
 * aren't any pending intents.  Returns -ENOENT if we can't grab the perag
 * structure.
 */
int
xchk_ag_read_headers(
	struct xfs_scrub	*sc,
	xfs_agnumber_t		agno,
	struct xchk_ag		*sa)
{
	struct xfs_mount	*mp = sc->mp;

	ASSERT(!sa->pag);
	sa->pag = xfs_perag_get(mp, agno);
	if (!sa->pag)
		return -ENOENT;

	return xchk_perag_drain_and_lock(sc);
}

523 524
/* Release all the AG btree cursors. */
void
525 526
xchk_ag_btcur_free(
	struct xchk_ag		*sa)
527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549
{
	if (sa->refc_cur)
		xfs_btree_del_cursor(sa->refc_cur, XFS_BTREE_ERROR);
	if (sa->rmap_cur)
		xfs_btree_del_cursor(sa->rmap_cur, XFS_BTREE_ERROR);
	if (sa->fino_cur)
		xfs_btree_del_cursor(sa->fino_cur, XFS_BTREE_ERROR);
	if (sa->ino_cur)
		xfs_btree_del_cursor(sa->ino_cur, XFS_BTREE_ERROR);
	if (sa->cnt_cur)
		xfs_btree_del_cursor(sa->cnt_cur, XFS_BTREE_ERROR);
	if (sa->bno_cur)
		xfs_btree_del_cursor(sa->bno_cur, XFS_BTREE_ERROR);

	sa->refc_cur = NULL;
	sa->rmap_cur = NULL;
	sa->fino_cur = NULL;
	sa->ino_cur = NULL;
	sa->bno_cur = NULL;
	sa->cnt_cur = NULL;
}

/* Initialize all the btree cursors for an AG. */
550
void
551
xchk_ag_btcur_init(
552
	struct xfs_scrub	*sc,
553
	struct xchk_ag		*sa)
554
{
555
	struct xfs_mount	*mp = sc->mp;
556

557 558
	if (sa->agf_bp &&
	    xchk_ag_btree_healthy_enough(sc, sa->pag, XFS_BTNUM_BNO)) {
559 560
		/* Set up a bnobt cursor for cross-referencing. */
		sa->bno_cur = xfs_allocbt_init_cursor(mp, sc->tp, sa->agf_bp,
561
				sa->pag, XFS_BTNUM_BNO);
562
	}
563

564 565
	if (sa->agf_bp &&
	    xchk_ag_btree_healthy_enough(sc, sa->pag, XFS_BTNUM_CNT)) {
566 567
		/* Set up a cntbt cursor for cross-referencing. */
		sa->cnt_cur = xfs_allocbt_init_cursor(mp, sc->tp, sa->agf_bp,
568
				sa->pag, XFS_BTNUM_CNT);
569 570 571
	}

	/* Set up a inobt cursor for cross-referencing. */
572 573
	if (sa->agi_bp &&
	    xchk_ag_btree_healthy_enough(sc, sa->pag, XFS_BTNUM_INO)) {
574 575
		sa->ino_cur = xfs_inobt_init_cursor(sa->pag, sc->tp, sa->agi_bp,
				XFS_BTNUM_INO);
576 577 578
	}

	/* Set up a finobt cursor for cross-referencing. */
579
	if (sa->agi_bp && xfs_has_finobt(mp) &&
580
	    xchk_ag_btree_healthy_enough(sc, sa->pag, XFS_BTNUM_FINO)) {
581 582
		sa->fino_cur = xfs_inobt_init_cursor(sa->pag, sc->tp, sa->agi_bp,
				XFS_BTNUM_FINO);
583 584 585
	}

	/* Set up a rmapbt cursor for cross-referencing. */
586
	if (sa->agf_bp && xfs_has_rmapbt(mp) &&
587
	    xchk_ag_btree_healthy_enough(sc, sa->pag, XFS_BTNUM_RMAP)) {
588
		sa->rmap_cur = xfs_rmapbt_init_cursor(mp, sc->tp, sa->agf_bp,
589
				sa->pag);
590 591 592
	}

	/* Set up a refcountbt cursor for cross-referencing. */
593
	if (sa->agf_bp && xfs_has_reflink(mp) &&
594
	    xchk_ag_btree_healthy_enough(sc, sa->pag, XFS_BTNUM_REFC)) {
595
		sa->refc_cur = xfs_refcountbt_init_cursor(mp, sc->tp,
596
				sa->agf_bp, sa->pag);
597 598 599 600 601
	}
}

/* Release the AG header context and btree cursors. */
void
602
xchk_ag_free(
603
	struct xfs_scrub	*sc,
604
	struct xchk_ag		*sa)
605
{
606
	xchk_ag_btcur_free(sa);
607 608 609 610 611 612 613 614
	if (sa->agf_bp) {
		xfs_trans_brelse(sc->tp, sa->agf_bp);
		sa->agf_bp = NULL;
	}
	if (sa->agi_bp) {
		xfs_trans_brelse(sc->tp, sa->agi_bp);
		sa->agi_bp = NULL;
	}
615 616 617 618
	if (sa->pag) {
		xfs_perag_put(sa->pag);
		sa->pag = NULL;
	}
619 620 621
}

/*
622 623 624 625 626
 * For scrub, grab the perag structure, the AGI, and the AGF headers, in that
 * order.  Locking order requires us to get the AGI before the AGF.  We use the
 * transaction to avoid deadlocking on crosslinked metadata buffers; either the
 * caller passes one in (bmap scrub) or we have to create a transaction
 * ourselves.  Returns ENOENT if the perag struct cannot be grabbed.
627 628
 */
int
629
xchk_ag_init(
630
	struct xfs_scrub	*sc,
631
	xfs_agnumber_t		agno,
632
	struct xchk_ag		*sa)
633
{
634
	int			error;
635

636
	error = xchk_ag_read_headers(sc, agno, sa);
637 638 639
	if (error)
		return error;

640 641
	xchk_ag_btcur_init(sc, sa);
	return 0;
642 643
}

644 645
/* Per-scrubber setup functions */

646 647 648 649 650 651 652 653
void
xchk_trans_cancel(
	struct xfs_scrub	*sc)
{
	xfs_trans_cancel(sc->tp);
	sc->tp = NULL;
}

654 655 656
/*
 * Grab an empty transaction so that we can re-grab locked buffers if
 * one of our btrees turns out to be cyclic.
657 658 659 660 661 662
 *
 * If we're going to repair something, we need to ask for the largest possible
 * log reservation so that we can handle the worst case scenario for metadata
 * updates while rebuilding a metadata item.  We also need to reserve as many
 * blocks in the head transaction as we think we're going to need to rebuild
 * the metadata object.
663 664
 */
int
665
xchk_trans_alloc(
666
	struct xfs_scrub	*sc,
667
	uint			resblks)
668
{
669 670 671 672
	if (sc->sm->sm_flags & XFS_SCRUB_IFLAG_REPAIR)
		return xfs_trans_alloc(sc->mp, &M_RES(sc->mp)->tr_itruncate,
				resblks, 0, 0, &sc->tp);

673 674 675
	return xfs_trans_alloc_empty(sc->mp, &sc->tp);
}

676 677
/* Set us up with a transaction and an empty context. */
int
678
xchk_setup_fs(
679
	struct xfs_scrub	*sc)
680
{
681
	uint			resblks;
682

683
	resblks = xrep_calc_ag_resblks(sc);
684
	return xchk_trans_alloc(sc, resblks);
685
}
686 687 688

/* Set us up with AG headers and btree cursors. */
int
689
xchk_setup_ag_btree(
690
	struct xfs_scrub	*sc,
691
	bool			force_log)
692
{
693 694
	struct xfs_mount	*mp = sc->mp;
	int			error;
695

Darrick J. Wong's avatar
Darrick J. Wong committed
696 697 698 699 700 701 702
	/*
	 * If the caller asks us to checkpont the log, do so.  This
	 * expensive operation should be performed infrequently and only
	 * as a last resort.  Any caller that sets force_log should
	 * document why they need to do so.
	 */
	if (force_log) {
703
		error = xchk_checkpoint_log(mp);
Darrick J. Wong's avatar
Darrick J. Wong committed
704 705 706 707
		if (error)
			return error;
	}

708
	error = xchk_setup_fs(sc);
709 710 711
	if (error)
		return error;

712
	return xchk_ag_init(sc, sc->sm->sm_agno, &sc->sa);
713
}
Darrick J. Wong's avatar
Darrick J. Wong committed
714 715 716

/* Push everything out of the log onto disk. */
int
717
xchk_checkpoint_log(
Darrick J. Wong's avatar
Darrick J. Wong committed
718 719 720 721
	struct xfs_mount	*mp)
{
	int			error;

722
	error = xfs_log_force(mp, XFS_LOG_SYNC);
Darrick J. Wong's avatar
Darrick J. Wong committed
723 724 725 726 727
	if (error)
		return error;
	xfs_ail_push_all_sync(mp->m_ail);
	return 0;
}
Darrick J. Wong's avatar
Darrick J. Wong committed
728

729 730 731 732 733 734 735
/* Verify that an inode is allocated ondisk, then return its cached inode. */
int
xchk_iget(
	struct xfs_scrub	*sc,
	xfs_ino_t		inum,
	struct xfs_inode	**ipp)
{
736 737
	ASSERT(sc->tp != NULL);

738 739 740
	return xfs_iget(sc->mp, sc->tp, inum, XFS_IGET_UNTRUSTED, 0, ipp);
}

741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821
/*
 * Try to grab an inode in a manner that avoids races with physical inode
 * allocation.  If we can't, return the locked AGI buffer so that the caller
 * can single-step the loading process to see where things went wrong.
 * Callers must have a valid scrub transaction.
 *
 * If the iget succeeds, return 0, a NULL AGI, and the inode.
 *
 * If the iget fails, return the error, the locked AGI, and a NULL inode.  This
 * can include -EINVAL and -ENOENT for invalid inode numbers or inodes that are
 * no longer allocated; or any other corruption or runtime error.
 *
 * If the AGI read fails, return the error, a NULL AGI, and NULL inode.
 *
 * If a fatal signal is pending, return -EINTR, a NULL AGI, and a NULL inode.
 */
int
xchk_iget_agi(
	struct xfs_scrub	*sc,
	xfs_ino_t		inum,
	struct xfs_buf		**agi_bpp,
	struct xfs_inode	**ipp)
{
	struct xfs_mount	*mp = sc->mp;
	struct xfs_trans	*tp = sc->tp;
	struct xfs_perag	*pag;
	int			error;

	ASSERT(sc->tp != NULL);

again:
	*agi_bpp = NULL;
	*ipp = NULL;
	error = 0;

	if (xchk_should_terminate(sc, &error))
		return error;

	/*
	 * Attach the AGI buffer to the scrub transaction to avoid deadlocks
	 * in the iget cache miss path.
	 */
	pag = xfs_perag_get(mp, XFS_INO_TO_AGNO(mp, inum));
	error = xfs_ialloc_read_agi(pag, tp, agi_bpp);
	xfs_perag_put(pag);
	if (error)
		return error;

	error = xfs_iget(mp, tp, inum,
			XFS_IGET_NORETRY | XFS_IGET_UNTRUSTED, 0, ipp);
	if (error == -EAGAIN) {
		/*
		 * The inode may be in core but temporarily unavailable and may
		 * require the AGI buffer before it can be returned.  Drop the
		 * AGI buffer and retry the lookup.
		 *
		 * Incore lookup will fail with EAGAIN on a cache hit if the
		 * inode is queued to the inactivation list.  The inactivation
		 * worker may remove the inode from the unlinked list and hence
		 * needs the AGI.
		 *
		 * Hence xchk_iget_agi() needs to drop the AGI lock on EAGAIN
		 * to allow inodegc to make progress and move the inode to
		 * IRECLAIMABLE state where xfs_iget will be able to return it
		 * again if it can lock the inode.
		 */
		xfs_trans_brelse(tp, *agi_bpp);
		delay(1);
		goto again;
	}
	if (error)
		return error;

	/* We got the inode, so we can release the AGI. */
	ASSERT(*ipp != NULL);
	xfs_trans_brelse(tp, *agi_bpp);
	*agi_bpp = NULL;
	return 0;
}

/* Install an inode that we opened by handle for scrubbing. */
822
int
823 824 825 826 827 828 829 830 831 832 833 834 835
xchk_install_handle_inode(
	struct xfs_scrub	*sc,
	struct xfs_inode	*ip)
{
	if (VFS_I(ip)->i_generation != sc->sm->sm_gen) {
		xchk_irele(sc, ip);
		return -ENOENT;
	}

	sc->ip = ip;
	return 0;
}

836 837 838 839 840 841 842 843 844 845 846 847 848 849 850 851 852 853 854
/*
 * Install an already-referenced inode for scrubbing.  Get our own reference to
 * the inode to make disposal simpler.  The inode must not be in I_FREEING or
 * I_WILL_FREE state!
 */
int
xchk_install_live_inode(
	struct xfs_scrub	*sc,
	struct xfs_inode	*ip)
{
	if (!igrab(VFS_I(ip))) {
		xchk_ino_set_corrupt(sc, ip->i_ino);
		return -EFSCORRUPTED;
	}

	sc->ip = ip;
	return 0;
}

Darrick J. Wong's avatar
Darrick J. Wong committed
855
/*
856 857 858 859 860
 * In preparation to scrub metadata structures that hang off of an inode,
 * grab either the inode referenced in the scrub control structure or the
 * inode passed in.  If the inumber does not reference an allocated inode
 * record, the function returns ENOENT to end the scrub early.  The inode
 * is not locked.
Darrick J. Wong's avatar
Darrick J. Wong committed
861 862
 */
int
863
xchk_iget_for_scrubbing(
864
	struct xfs_scrub	*sc)
Darrick J. Wong's avatar
Darrick J. Wong committed
865
{
866 867
	struct xfs_imap		imap;
	struct xfs_mount	*mp = sc->mp;
868
	struct xfs_perag	*pag;
869
	struct xfs_buf		*agi_bp;
870
	struct xfs_inode	*ip_in = XFS_I(file_inode(sc->file));
871
	struct xfs_inode	*ip = NULL;
872
	xfs_agnumber_t		agno = XFS_INO_TO_AGNO(mp, sc->sm->sm_ino);
873
	int			error;
Darrick J. Wong's avatar
Darrick J. Wong committed
874

875 876
	ASSERT(sc->tp == NULL);

Darrick J. Wong's avatar
Darrick J. Wong committed
877
	/* We want to scan the inode we already had opened. */
878 879
	if (sc->sm->sm_ino == 0 || sc->sm->sm_ino == ip_in->i_ino)
		return xchk_install_live_inode(sc, ip_in);
Darrick J. Wong's avatar
Darrick J. Wong committed
880

881
	/* Reject internal metadata files and obviously bad inode numbers. */
Darrick J. Wong's avatar
Darrick J. Wong committed
882 883
	if (xfs_internal_inum(mp, sc->sm->sm_ino))
		return -ENOENT;
884 885 886
	if (!xfs_verify_ino(sc->mp, sc->sm->sm_ino))
		return -ENOENT;

887 888
	/* Try a safe untrusted iget. */
	error = xchk_iget_safe(sc, sc->sm->sm_ino, &ip);
889 890 891
	if (!error)
		return xchk_install_handle_inode(sc, ip);
	if (error == -ENOENT)
Darrick J. Wong's avatar
Darrick J. Wong committed
892
		return error;
893 894 895 896 897 898 899 900 901 902 903 904 905 906 907 908 909 910 911 912 913 914 915 916 917 918 919
	if (error != -EINVAL)
		goto out_error;

	/*
	 * EINVAL with IGET_UNTRUSTED probably means one of several things:
	 * userspace gave us an inode number that doesn't correspond to fs
	 * space; the inode btree lacks a record for this inode; or there is a
	 * record, and it says this inode is free.
	 *
	 * We want to look up this inode in the inobt to distinguish two
	 * scenarios: (1) the inobt says the inode is free, in which case
	 * there's nothing to do; and (2) the inobt says the inode is
	 * allocated, but loading it failed due to corruption.
	 *
	 * Allocate a transaction and grab the AGI to prevent inobt activity
	 * in this AG.  Retry the iget in case someone allocated a new inode
	 * after the first iget failed.
	 */
	error = xchk_trans_alloc(sc, 0);
	if (error)
		goto out_error;

	error = xchk_iget_agi(sc, sc->sm->sm_ino, &agi_bp, &ip);
	if (error == 0) {
		/* Actually got the inode, so install it. */
		xchk_trans_cancel(sc);
		return xchk_install_handle_inode(sc, ip);
Darrick J. Wong's avatar
Darrick J. Wong committed
920
	}
921 922 923 924 925 926 927 928 929 930
	if (error == -ENOENT)
		goto out_gone;
	if (error != -EINVAL)
		goto out_cancel;

	/* Ensure that we have protected against inode allocation/freeing. */
	if (agi_bp == NULL) {
		ASSERT(agi_bp != NULL);
		error = -ECANCELED;
		goto out_cancel;
Darrick J. Wong's avatar
Darrick J. Wong committed
931 932
	}

933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972
	/*
	 * Untrusted iget failed a second time.  Let's try an inobt lookup.
	 * If the inobt thinks this the inode neither can exist inside the
	 * filesystem nor is allocated, return ENOENT to signal that the check
	 * can be skipped.
	 *
	 * If the lookup returns corruption, we'll mark this inode corrupt and
	 * exit to userspace.  There's little chance of fixing anything until
	 * the inobt is straightened out, but there's nothing we can do here.
	 *
	 * If the lookup encounters any other error, exit to userspace.
	 *
	 * If the lookup succeeds, something else must be very wrong in the fs
	 * such that setting up the incore inode failed in some strange way.
	 * Treat those as corruptions.
	 */
	pag = xfs_perag_get(mp, XFS_INO_TO_AGNO(mp, sc->sm->sm_ino));
	if (!pag) {
		error = -EFSCORRUPTED;
		goto out_cancel;
	}

	error = xfs_imap(pag, sc->tp, sc->sm->sm_ino, &imap,
			XFS_IGET_UNTRUSTED);
	xfs_perag_put(pag);
	if (error == -EINVAL || error == -ENOENT)
		goto out_gone;
	if (!error)
		error = -EFSCORRUPTED;

out_cancel:
	xchk_trans_cancel(sc);
out_error:
	trace_xchk_op_error(sc, agno, XFS_INO_TO_AGBNO(mp, sc->sm->sm_ino),
			error, __return_address);
	return error;
out_gone:
	/* The file is gone, so there's nothing to check. */
	xchk_trans_cancel(sc);
	return -ENOENT;
Darrick J. Wong's avatar
Darrick J. Wong committed
973
}
974

975 976 977 978 979 980 981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009
/* Release an inode, possibly dropping it in the process. */
void
xchk_irele(
	struct xfs_scrub	*sc,
	struct xfs_inode	*ip)
{
	if (current->journal_info != NULL) {
		ASSERT(current->journal_info == sc->tp);

		/*
		 * If we are in a transaction, we /cannot/ drop the inode
		 * ourselves, because the VFS will trigger writeback, which
		 * can require a transaction.  Clear DONTCACHE to force the
		 * inode to the LRU, where someone else can take care of
		 * dropping it.
		 *
		 * Note that when we grabbed our reference to the inode, it
		 * could have had an active ref and DONTCACHE set if a sysadmin
		 * is trying to coerce a change in file access mode.  icache
		 * hits do not clear DONTCACHE, so we must do it here.
		 */
		spin_lock(&VFS_I(ip)->i_lock);
		VFS_I(ip)->i_state &= ~I_DONTCACHE;
		spin_unlock(&VFS_I(ip)->i_lock);
	} else if (atomic_read(&VFS_I(ip)->i_count) == 1) {
		/*
		 * If this is the last reference to the inode and the caller
		 * permits it, set DONTCACHE to avoid thrashing.
		 */
		d_mark_dontcache(VFS_I(ip));
	}

	xfs_irele(ip);
}

1010 1011 1012 1013 1014
/*
 * Set us up to scrub metadata mapped by a file's fork.  Callers must not use
 * this to operate on user-accessible regular file data because the MMAPLOCK is
 * not taken.
 */
1015
int
1016
xchk_setup_inode_contents(
1017
	struct xfs_scrub	*sc,
1018
	unsigned int		resblks)
1019
{
1020
	int			error;
1021

1022
	error = xchk_iget_for_scrubbing(sc);
1023 1024 1025
	if (error)
		return error;

1026
	/* Lock the inode so the VFS cannot touch this file. */
1027
	xchk_ilock(sc, XFS_IOLOCK_EXCL);
1028

1029
	error = xchk_trans_alloc(sc, resblks);
1030 1031
	if (error)
		goto out;
1032
	xchk_ilock(sc, XFS_ILOCK_EXCL);
1033 1034 1035 1036
out:
	/* scrub teardown will unlock and release the inode for us */
	return error;
}
1037

1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068
void
xchk_ilock(
	struct xfs_scrub	*sc,
	unsigned int		ilock_flags)
{
	xfs_ilock(sc->ip, ilock_flags);
	sc->ilock_flags |= ilock_flags;
}

bool
xchk_ilock_nowait(
	struct xfs_scrub	*sc,
	unsigned int		ilock_flags)
{
	if (xfs_ilock_nowait(sc->ip, ilock_flags)) {
		sc->ilock_flags |= ilock_flags;
		return true;
	}

	return false;
}

void
xchk_iunlock(
	struct xfs_scrub	*sc,
	unsigned int		ilock_flags)
{
	sc->ilock_flags &= ~ilock_flags;
	xfs_iunlock(sc->ip, ilock_flags);
}

1069 1070 1071 1072 1073 1074
/*
 * Predicate that decides if we need to evaluate the cross-reference check.
 * If there was an error accessing the cross-reference btree, just delete
 * the cursor and skip the check.
 */
bool
1075
xchk_should_check_xref(
1076
	struct xfs_scrub	*sc,
1077 1078
	int			*error,
	struct xfs_btree_cur	**curpp)
1079
{
1080
	/* No point in xref if we already know we're corrupt. */
1081
	if (xchk_skip_xref(sc->sm))
1082 1083
		return false;

1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097
	if (*error == 0)
		return true;

	if (curpp) {
		/* If we've already given up on xref, just bail out. */
		if (!*curpp)
			return false;

		/* xref error, delete cursor and bail out. */
		xfs_btree_del_cursor(*curpp, XFS_BTREE_ERROR);
		*curpp = NULL;
	}

	sc->sm->sm_flags |= XFS_SCRUB_OFLAG_XFAIL;
1098
	trace_xchk_xref_error(sc, *error, __return_address);
1099 1100 1101 1102 1103 1104 1105 1106

	/*
	 * Errors encountered during cross-referencing with another
	 * data structure should not cause this scrubber to abort.
	 */
	*error = 0;
	return false;
}
1107 1108 1109

/* Run the structure verifiers on in-memory buffers to detect bad memory. */
void
1110
xchk_buffer_recheck(
1111
	struct xfs_scrub	*sc,
1112
	struct xfs_buf		*bp)
1113
{
1114
	xfs_failaddr_t		fa;
1115 1116

	if (bp->b_ops == NULL) {
1117
		xchk_block_set_corrupt(sc, bp);
1118 1119 1120
		return;
	}
	if (bp->b_ops->verify_struct == NULL) {
1121
		xchk_set_incomplete(sc);
1122 1123 1124 1125 1126 1127
		return;
	}
	fa = bp->b_ops->verify_struct(bp);
	if (!fa)
		return;
	sc->sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;
1128
	trace_xchk_block_error(sc, xfs_buf_daddr(bp), fa);
1129
}
1130

1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157
static inline int
xchk_metadata_inode_subtype(
	struct xfs_scrub	*sc,
	unsigned int		scrub_type)
{
	__u32			smtype = sc->sm->sm_type;
	int			error;

	sc->sm->sm_type = scrub_type;

	switch (scrub_type) {
	case XFS_SCRUB_TYPE_INODE:
		error = xchk_inode(sc);
		break;
	case XFS_SCRUB_TYPE_BMBTD:
		error = xchk_bmap_data(sc);
		break;
	default:
		ASSERT(0);
		error = -EFSCORRUPTED;
		break;
	}

	sc->sm->sm_type = smtype;
	return error;
}

1158 1159 1160 1161 1162
/*
 * Scrub the attr/data forks of a metadata inode.  The metadata inode must be
 * pointed to by sc->ip and the ILOCK must be held.
 */
int
1163
xchk_metadata_inode_forks(
1164
	struct xfs_scrub	*sc)
1165
{
1166 1167
	bool			shared;
	int			error;
1168 1169 1170 1171

	if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
		return 0;

1172 1173 1174 1175 1176
	/* Check the inode record. */
	error = xchk_metadata_inode_subtype(sc, XFS_SCRUB_TYPE_INODE);
	if (error || (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT))
		return error;

1177
	/* Metadata inodes don't live on the rt device. */
1178
	if (sc->ip->i_diflags & XFS_DIFLAG_REALTIME) {
1179
		xchk_ino_set_corrupt(sc, sc->ip->i_ino);
1180 1181 1182 1183 1184
		return 0;
	}

	/* They should never participate in reflink. */
	if (xfs_is_reflink_inode(sc->ip)) {
1185
		xchk_ino_set_corrupt(sc, sc->ip->i_ino);
1186 1187 1188 1189 1190
		return 0;
	}

	/* They also should never have extended attributes. */
	if (xfs_inode_hasattr(sc->ip)) {
1191
		xchk_ino_set_corrupt(sc, sc->ip->i_ino);
1192 1193 1194 1195
		return 0;
	}

	/* Invoke the data fork scrubber. */
1196
	error = xchk_metadata_inode_subtype(sc, XFS_SCRUB_TYPE_BMBTD);
1197 1198 1199 1200
	if (error || (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT))
		return error;

	/* Look for incorrect shared blocks. */
1201
	if (xfs_has_reflink(sc->mp)) {
1202 1203
		error = xfs_reflink_inode_has_shared_extents(sc->tp, sc->ip,
				&shared);
1204
		if (!xchk_fblock_process_error(sc, XFS_DATA_FORK, 0,
1205 1206 1207
				&error))
			return error;
		if (shared)
1208
			xchk_ino_set_corrupt(sc, sc->ip->i_ino);
1209 1210
	}

1211
	return 0;
1212
}
1213

1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234
/*
 * Enable filesystem hooks (i.e. runtime code patching) before starting a scrub
 * operation.  Callers must not hold any locks that intersect with the CPU
 * hotplug lock (e.g. writeback locks) because code patching must halt the CPUs
 * to change kernel code.
 */
void
xchk_fsgates_enable(
	struct xfs_scrub	*sc,
	unsigned int		scrub_fsgates)
{
	ASSERT(!(scrub_fsgates & ~XCHK_FSGATES_ALL));
	ASSERT(!(sc->flags & scrub_fsgates));

	trace_xchk_fsgates_enable(sc, scrub_fsgates);

	if (scrub_fsgates & XCHK_FSGATES_DRAIN)
		xfs_drain_wait_enable();

	sc->flags |= scrub_fsgates;
}
1235 1236

/*
1237 1238 1239
 * Decide if this is this a cached inode that's also allocated.  The caller
 * must hold a reference to an AG and the AGI buffer lock to prevent inodes
 * from being allocated or freed.
1240
 *
1241 1242 1243 1244
 * Look up an inode by number in the given file system.  If the inode number
 * is invalid, return -EINVAL.  If the inode is not in cache, return -ENODATA.
 * If the inode is being reclaimed, return -ENODATA because we know the inode
 * cache cannot be updating the ondisk metadata.
1245
 *
1246 1247 1248 1249 1250
 * Otherwise, the incore inode is the one we want, and it is either live,
 * somewhere in the inactivation machinery, or reclaimable.  The inode is
 * allocated if i_mode is nonzero.  In all three cases, the cached inode will
 * be more up to date than the ondisk inode buffer, so we must use the incore
 * i_mode.
1251 1252 1253 1254
 */
int
xchk_inode_is_allocated(
	struct xfs_scrub	*sc,
1255
	xfs_agino_t		agino,
1256 1257
	bool			*inuse)
{
1258 1259 1260
	struct xfs_mount	*mp = sc->mp;
	struct xfs_perag	*pag = sc->sa.pag;
	xfs_ino_t		ino;
1261 1262 1263
	struct xfs_inode	*ip;
	int			error;

1264 1265 1266 1267 1268
	/* caller must hold perag reference */
	if (pag == NULL) {
		ASSERT(pag != NULL);
		return -EINVAL;
	}
1269

1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350 1351 1352 1353 1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364 1365 1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385
	/* caller must have AGI buffer */
	if (sc->sa.agi_bp == NULL) {
		ASSERT(sc->sa.agi_bp != NULL);
		return -EINVAL;
	}

	/* reject inode numbers outside existing AGs */
	ino = XFS_AGINO_TO_INO(sc->mp, pag->pag_agno, agino);
	if (!xfs_verify_ino(mp, ino))
		return -EINVAL;

	error = -ENODATA;
	rcu_read_lock();
	ip = radix_tree_lookup(&pag->pag_ici_root, agino);
	if (!ip) {
		/* cache miss */
		goto out_rcu;
	}

	/*
	 * If the inode number doesn't match, the incore inode got reused
	 * during an RCU grace period and the radix tree hasn't been updated.
	 * This isn't the inode we want.
	 */
	spin_lock(&ip->i_flags_lock);
	if (ip->i_ino != ino)
		goto out_skip;

	trace_xchk_inode_is_allocated(ip);

	/*
	 * We have an incore inode that matches the inode we want, and the
	 * caller holds the perag structure and the AGI buffer.  Let's check
	 * our assumptions below:
	 */

#ifdef DEBUG
	/*
	 * (1) If the incore inode is live (i.e. referenced from the dcache),
	 * it will not be INEW, nor will it be in the inactivation or reclaim
	 * machinery.  The ondisk inode had better be allocated.  This is the
	 * most trivial case.
	 */
	if (!(ip->i_flags & (XFS_NEED_INACTIVE | XFS_INEW | XFS_IRECLAIMABLE |
			     XFS_INACTIVATING))) {
		/* live inode */
		ASSERT(VFS_I(ip)->i_mode != 0);
	}

	/*
	 * If the incore inode is INEW, there are several possibilities:
	 *
	 * (2) For a file that is being created, note that we allocate the
	 * ondisk inode before allocating, initializing, and adding the incore
	 * inode to the radix tree.
	 *
	 * (3) If the incore inode is being recycled, the inode has to be
	 * allocated because we don't allow freed inodes to be recycled.
	 * Recycling doesn't touch i_mode.
	 */
	if (ip->i_flags & XFS_INEW) {
		/* created on disk already or recycling */
		ASSERT(VFS_I(ip)->i_mode != 0);
	}

	/*
	 * (4) If the inode is queued for inactivation (NEED_INACTIVE) but
	 * inactivation has not started (!INACTIVATING), it is still allocated.
	 */
	if ((ip->i_flags & XFS_NEED_INACTIVE) &&
	    !(ip->i_flags & XFS_INACTIVATING)) {
		/* definitely before difree */
		ASSERT(VFS_I(ip)->i_mode != 0);
	}
#endif

	/*
	 * If the incore inode is undergoing inactivation (INACTIVATING), there
	 * are two possibilities:
	 *
	 * (5) It is before the point where it would get freed ondisk, in which
	 * case i_mode is still nonzero.
	 *
	 * (6) It has already been freed, in which case i_mode is zero.
	 *
	 * We don't take the ILOCK here, but difree and dialloc update the AGI,
	 * and we've taken the AGI buffer lock, which prevents that from
	 * happening.
	 */

	/*
	 * (7) Inodes undergoing inactivation (INACTIVATING) or queued for
	 * reclaim (IRECLAIMABLE) could be allocated or free.  i_mode still
	 * reflects the ondisk state.
	 */

	/*
	 * (8) If the inode is in IFLUSHING, it's safe to query i_mode because
	 * the flush code uses i_mode to format the ondisk inode.
	 */

	/*
	 * (9) If the inode is in IRECLAIM and was reachable via the radix
	 * tree, it still has the same i_mode as it did before it entered
	 * reclaim.  The inode object is still alive because we hold the RCU
	 * read lock.
	 */

	*inuse = VFS_I(ip)->i_mode != 0;
	error = 0;

out_skip:
	spin_unlock(&ip->i_flags_lock);
out_rcu:
	rcu_read_unlock();
	return error;
1386
}