path: root/fs/xfs/scrub/quotacheck.c

// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * Copyright (C) 2021 Oracle.  All Rights Reserved.
 * Author: Darrick J. Wong <djwong@kernel.org>
 */
#include "xfs.h"
#include "xfs_fs.h"
#include "xfs_shared.h"
#include "xfs_format.h"
#include "xfs_trans_resv.h"
#include "xfs_mount.h"
#include "xfs_log_format.h"
#include "xfs_trans.h"
#include "xfs_inode.h"
#include "xfs_quota.h"
#include "xfs_qm.h"
#include "xfs_icache.h"
#include "xfs_bmap_util.h"
#include "xfs_ialloc.h"
#include "xfs_ag.h"
#include "scrub/scrub.h"
#include "scrub/common.h"
#include "scrub/repair.h"
#include "scrub/xfarray.h"
#include "scrub/iscan.h"
#include "scrub/quotacheck.h"
#include "scrub/trace.h"

/*
 * Live Quotacheck
 * ===============
 *
 * Quota counters are "summary" metadata, in the sense that they are computed
 * as the summation of the block usage counts for every file on the filesystem.
 * Therefore, we compute the correct icount, bcount, and rtbcount values by
 * creating a shadow quota counter structure and walking every inode.
 */

/* Set us up to scrub quota counters. */
int
xchk_setup_quotacheck(
	struct xfs_scrub	*sc)
{
	/* Not ready for general consumption yet. */
	return -EOPNOTSUPP;

	if (!XFS_IS_QUOTA_ON(sc->mp))
		return -ENOENT;

	sc->buf = kmem_zalloc(sizeof(struct xqcheck), KM_NOFS | KM_MAYFAIL);
	if (!sc->buf)
		return -ENOMEM;

	return xchk_setup_fs(sc);
}

/* Update an incore dquot counter information from a live update. */
static int
xqcheck_update_incore_counts(
	struct xqcheck		*xqc,
	struct xfarray		*counts,
	xfs_dqid_t		id,
	int64_t			inodes,
	int64_t			nblks,
	int64_t			rtblks)
{
	struct xqcheck_dquot	xcdq;
	int			error;

	error = xfarray_load_sparse(counts, id, &xcdq);
	if (error)
		return error;

	xcdq.icount += inodes;
	xcdq.bcount += nblks;
	xcdq.rtbcount += rtblks;

	error = xfarray_store(counts, id, &xcdq);
	if (error == -EFBIG) {
		/*
		 * EFBIG means we tried to store data at too high a byte offset
		 * in the sparse array.  IOWs, we cannot complete the check and
		 * must notify userspace that the check was incomplete.
		 */
		xchk_set_incomplete(xqc->sc);
		error = -ECANCELED;
	}
	return error;
}

/* Record this inode's quota usage in our shadow quota counter data. */
STATIC int
xqcheck_inode(
	struct xqcheck		*xqc,
	struct xfs_inode	*ip)
{
	struct xfs_trans	*tp = xqc->sc->tp;
	xfs_filblks_t		nblks, rtblks;
	uint			ilock_flags = 0;
	xfs_dqid_t		id;
	int			error;

	if (xfs_is_quota_inode(&tp->t_mountp->m_sb, ip->i_ino)) {
		/*
		 * Quota inode blocks are never counted towards quota, so we
		 * do not need to take the lock.
		 */
		xchk_iscan_mark_visited(&xqc->iscan, ip);
		return 0;
	}

	/* Figure out the data / rt device block counts. */
	xfs_ilock(ip, XFS_IOLOCK_SHARED | XFS_MMAPLOCK_SHARED);
	ilock_flags = xfs_ilock_data_map_shared(ip);
	if (XFS_IS_REALTIME_INODE(ip)) {
		error = xfs_iread_extents(tp, ip, XFS_DATA_FORK);
		if (error)
			goto out_ilock;
	}
	xfs_inode_count_blocks(tp, ip, &nblks, &rtblks);

	/* Update the shadow dquot counters. */
	mutex_lock(&xqc->lock);
	id = xfs_qm_id_for_quotatype(ip, XFS_DQTYPE_USER);
	if (xqc->ucounts) {
		error = xqcheck_update_incore_counts(xqc, xqc->ucounts, id, 1,
				nblks, rtblks);
		if (error)
			goto out_incomplete;
	}

	id = xfs_qm_id_for_quotatype(ip, XFS_DQTYPE_GROUP);
	if (xqc->gcounts) {
		error = xqcheck_update_incore_counts(xqc, xqc->gcounts, id, 1,
				nblks, rtblks);
		if (error)
			goto out_incomplete;
	}

	id = xfs_qm_id_for_quotatype(ip, XFS_DQTYPE_PROJ);
	if (xqc->pcounts) {
		error = xqcheck_update_incore_counts(xqc, xqc->pcounts, id, 1,
				nblks, rtblks);
		if (error)
			goto out_incomplete;
	}
	mutex_unlock(&xqc->lock);

	xchk_iscan_mark_visited(&xqc->iscan, ip);
	goto out_ilock;

out_incomplete:
	mutex_unlock(&xqc->lock);
	xchk_set_incomplete(xqc->sc);
out_ilock:
	xfs_iunlock(ip, XFS_IOLOCK_SHARED | XFS_MMAPLOCK_SHARED | ilock_flags);
	return error;
}

/* Walk all the allocated inodes and run a quota scan on them. */
STATIC int
xqcheck_collect_counts(
	struct xqcheck		*xqc)
{
	struct xfs_scrub	*sc = xqc->sc;
	struct xchk_iscan	*iscan = &xqc->iscan;
	int			error;

	/*
	 * Set up for a potentially lengthy filesystem scan by reducing our
	 * transaction resource usage for the duration.  Specifically:
	 *
	 * Cancel the transaction to release the log grant space while we scan
	 * the filesystem.
	 *
	 * Create a new empty transaction to eliminate the possibility of the
	 * inode scan deadlocking on cyclical metadata.
	 *
	 * We pass the empty transaction to the file scanning function to avoid
	 * repeatedly cycling empty transactions.  This can be done without
	 * risk of deadlock between sb_internal and the IOLOCK (we take the
	 * IOLOCK to quiesce the file before scanning) because empty
	 * transactions do not take sb_internal.
	 */
	xchk_trans_cancel(sc);
	error = xchk_trans_alloc_empty(sc);
	if (error)
		return error;

	while ((error = xchk_iscan_advance(sc, iscan)) == 1) {
		struct xfs_inode	*ip;

		error = xchk_iscan_iget(sc, iscan, &ip);
		if (error == -EAGAIN)
			continue;
		if (error)
			break;

		error = xqcheck_inode(xqc, ip);
		xfs_irele(ip);
		if (error)
			break;

		if (xchk_should_terminate(sc, &error))
			break;
	}

	if (error == -ECANCELED)
		xchk_set_incomplete(sc);
	if (error)
		return error;

	/*
	 * Switch out for a real transaction in preparation for building a new
	 * tree.
	 */
	xchk_trans_cancel(sc);
	return xchk_setup_fs(sc);
}

/*
 * Check the dquot data against what we observed.  Caller must hold the dquot
 * lock.
 */
STATIC int
xqcheck_compare_dquot(
	struct xfs_dquot	*dqp,
	xfs_dqtype_t		dqtype,
	void			*priv)
{
	struct xqcheck_dquot	xcdq;
	struct xqcheck		*xqc = priv;
	struct xfarray		*counts = xqcheck_counters_for(xqc, dqtype);
	int			error;

	mutex_lock(&xqc->lock);
	error = xfarray_load_sparse(counts, dqp->q_id, &xcdq);
	if (error)
		goto out_unlock;

	if (xcdq.icount != dqp->q_ino.count)
		xchk_qcheck_set_corrupt(xqc->sc, dqtype, dqp->q_id);

	if (xcdq.bcount != dqp->q_blk.count)
		xchk_qcheck_set_corrupt(xqc->sc, dqtype, dqp->q_id);

	if (xcdq.rtbcount != dqp->q_rtb.count)
		xchk_qcheck_set_corrupt(xqc->sc, dqtype, dqp->q_id);

	xcdq.flags |= XQCHECK_DQUOT_COMPARE_SCANNED;
	error = xfarray_store(counts, dqp->q_id, &xcdq);
	if (error == -EFBIG) {
		/*
		 * EFBIG means we tried to store data at too high a byte offset
		 * in the sparse array.  IOWs, we cannot complete the check and
		 * must notify userspace that the check was incomplete.
		 */
		xchk_set_incomplete(xqc->sc);
		error = -ECANCELED;
	}
	mutex_unlock(&xqc->lock);
	if (error)
		return error;

	if (xqc->sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
		return -ECANCELED;

	return 0;

out_unlock:
	mutex_unlock(&xqc->lock);
	return error;
}

/*
 * Walk all the observed dquots, and make sure there's a matching incore
 * dquot and that its counts match ours.
 */
STATIC int
xqcheck_walk_observations(
	struct xqcheck		*xqc,
	xfs_dqtype_t		dqtype)
{
	struct xqcheck_dquot	xcdq;
	struct xfs_dquot	*dqp;
	struct xfarray		*counts = xqcheck_counters_for(xqc, dqtype);
	uint64_t		nr = 0;
	int			error;

	mutex_lock(&xqc->lock);
	while ((error = xfarray_iter(counts, &nr, &xcdq)) == 1) {
		xfs_dqid_t	id = nr - 1;

		if (xcdq.flags & XQCHECK_DQUOT_COMPARE_SCANNED)
			continue;

		mutex_unlock(&xqc->lock);

		error = xfs_qm_dqget(xqc->sc->mp, id, dqtype, false, &dqp);
		if (error == -ENOENT) {
			xchk_qcheck_set_corrupt(xqc->sc, dqtype, id);
			return 0;
		}
		if (error)
			return error;

		error = xqcheck_compare_dquot(dqp, dqtype, xqc);
		xfs_qm_dqput(dqp);
		if (error)
			return error;

		if (xchk_should_terminate(xqc->sc, &error))
			return error;

		mutex_lock(&xqc->lock);
	}
	mutex_unlock(&xqc->lock);

	return error;
}

/* Compare the quota counters we observed against the live dquots. */
STATIC int
xqcheck_compare_dqtype(
	struct xqcheck		*xqc,
	xfs_dqtype_t		dqtype)
{
	struct xfs_scrub	*sc = xqc->sc;
	int			error;

	if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
		return 0;

	/* If the quota CHKD flag is cleared, we need to repair this quota. */
	if (!(xfs_quota_chkd_flag(dqtype) & sc->mp->m_qflags)) {
		xchk_qcheck_set_corrupt(xqc->sc, dqtype, 0);
		return 0;
	}

	/* Compare what we observed against the actual dquots. */
	error = xfs_qm_dqiterate(sc->mp, dqtype, xqcheck_compare_dquot, xqc);
	if (error)
		return error;

	/* Walk all the observed dquots and compare to the incore ones. */
	return xqcheck_walk_observations(xqc, dqtype);
}

/* Tear down everything associated with a quotacheck. */
static void
xqcheck_teardown_scan(
	struct xqcheck		*xqc)
{
	if (xqc->pcounts) {
		xfarray_destroy(xqc->pcounts);
		xqc->pcounts = NULL;
	}

	if (xqc->gcounts) {
		xfarray_destroy(xqc->gcounts);
		xqc->gcounts = NULL;
	}

	if (xqc->ucounts) {
		xfarray_destroy(xqc->ucounts);
		xqc->ucounts = NULL;
	}

	xchk_iscan_finish(&xqc->iscan);
	mutex_destroy(&xqc->lock);
	xqc->sc = NULL;
}

/*
 * Scan all inodes in the entire filesystem to generate quota counter data.
 * If the scan is successful, the quota data will be left alive for a repair.
 * If any error occurs, we'll tear everything down.
 */
STATIC int
xqcheck_setup_scan(
	struct xfs_scrub	*sc,
	struct xqcheck		*xqc)
{
	int			error;

	ASSERT(xqc->sc == NULL);
	xqc->sc = sc;

	mutex_init(&xqc->lock);
	xqc->iscan.iget_tries = 20;
	xqc->iscan.iget_retry_delay = HZ / 10;
	xchk_iscan_start(&xqc->iscan);

	error = -ENOMEM;
	if (xfs_this_quota_on(sc->mp, XFS_DQTYPE_USER)) {
		error = xfarray_create(sc->mp, "user dquots",
				sizeof(struct xqcheck_dquot), &xqc->ucounts);
		if (error)
			goto out_teardown;
	}

	if (xfs_this_quota_on(sc->mp, XFS_DQTYPE_GROUP)) {
		error = xfarray_create(sc->mp, "group dquots",
				sizeof(struct xqcheck_dquot), &xqc->gcounts);
		if (error)
			goto out_teardown;
	}

	if (xfs_this_quota_on(sc->mp, XFS_DQTYPE_PROJ)) {
		error = xfarray_create(sc->mp, "project dquots",
				sizeof(struct xqcheck_dquot), &xqc->pcounts);
		if (error)
			goto out_teardown;
	}

	/* Use deferred cleanup to pass the quota count data to repair. */
	sc->buf_cleanup = (void (*)(void *))xqcheck_teardown_scan;
	return 0;

out_teardown:
	xqcheck_teardown_scan(xqc);
	return error;
}

/* Scrub all counters for a given quota type. */
int
xchk_quotacheck(
	struct xfs_scrub	*sc)
{
	struct xqcheck		*xqc = sc->buf;
	int			error = 0;

	/* Check quota counters on the live filesystem. */
	error = xqcheck_setup_scan(sc, xqc);
	if (error)
		return error;

	/* Walk all inodes, picking up quota information. */
	error = xqcheck_collect_counts(xqc);
	if (!xchk_xref_process_error(sc, 0, 0, &error))
		return error;

	/* Compare quota counters. */
	if (xqc->ucounts) {
		error = xqcheck_compare_dqtype(xqc, XFS_DQTYPE_USER);
		if (!xchk_xref_process_error(sc, 0, 0, &error))
			return error;
	}
	if (xqc->gcounts) {
		error = xqcheck_compare_dqtype(xqc, XFS_DQTYPE_GROUP);
		if (!xchk_xref_process_error(sc, 0, 0, &error))
			return error;
	}
	if (xqc->pcounts) {
		error = xqcheck_compare_dqtype(xqc, XFS_DQTYPE_PROJ);
		if (!xchk_xref_process_error(sc, 0, 0, &error))
			return error;
	}

	return 0;
}