[PATCH 42/48] xfs: validate logged metadata btree fork roots during recovery

[Dave Chinner <dgc@kernel.org>]

A metadata btree format data fork holds an rt rmap or rt refcount btree root,
logged as the expanded in-core btree root like a bmap btree root. Recovery
copied this root into the inode without inspecting it, so a corrupt root was
replayed as it stood.

Validate the logged metadata btree root once the fork has been verified against
the core. The root is checked as a short btree root block whose record count
fills the fork region exactly, and its node pointers are checked to be in range.
The record and key contents are relative to a realtime group, which is not set up
until after log recovery, so their validation is left to the first runtime access
to the root block.

Assisted-by: LLM
Signed-off-by: Dave Chinner <dgc@kernel.org>
---
 fs/xfs/xfs_inode_item_recover.c | 129 +++++++++++++++++++++++++++++++-
 1 file changed, 128 insertions(+), 1 deletion(-)

diff --git a/fs/xfs/xfs_inode_item_recover.c b/fs/xfs/xfs_inode_item_recover.c
index b979e922e5e9..09107322ce18 100644
--- a/fs/xfs/xfs_inode_item_recover.c
+++ b/fs/xfs/xfs_inode_item_recover.c
@@ -524,6 +524,132 @@ xlog_dinode_verify_bmbt_root(
 	return NULL;
 }
 
+/*
+ * Verify a logged rt rmap btree root, as for the bmap btree root. The node
+ * pointers are filesystem block numbers and are checked here.
+ */
+static xfs_failaddr_t
+xlog_dinode_verify_rtrmap_root(
+	struct xfs_mount		*mp,
+	struct xfs_log_dinode		*ldip,
+	void				*src,
+	unsigned int			size)
+{
+	struct xfs_btree_block		*block = src;
+	xfs_failaddr_t			fa;
+	unsigned int			level;
+	unsigned int			numrecs;
+	unsigned int			i;
+
+	if (size < XFS_RTRMAP_BLOCK_LEN)
+		return __this_address;
+
+	fa = xfs_btree_check_fsblock_root_hdr(mp, XFS_RTRMAP_CRC_MAGIC,
+			xfs_rtrmapbt_maxrecs(mp, size,
+				be16_to_cpu(block->bb_level) == 0),
+			block, 0, mp->m_rtrmap_maxlevels);
+	if (fa)
+		return fa;
+
+	level = be16_to_cpu(block->bb_level);
+	numrecs = be16_to_cpu(block->bb_numrecs);
+	if (numrecs == 0 ||
+	    size != xfs_rtrmap_broot_space_calc(level, numrecs))
+		return __this_address;
+
+	/*
+	 * A leaf root holds records whose bounds are relative to a realtime
+	 * group. The realtime groups are not set up until long after log
+	 * recovery runs, so the leaf contents cannot be validated here. That is
+	 * deferred to the first runtime access to the root block.
+	 */
+	if (level == 0)
+		return NULL;
+
+	for (i = 1; i <= numrecs; i++) {
+		xfs_rtrmap_ptr_t	*ptr = xfs_rtrmap_broot_ptr_addr(mp,
+						block, i, size);
+
+		if (!xfs_verify_fsbno(mp, be64_to_cpu(*ptr)))
+			return __this_address;
+	}
+
+	return NULL;
+}
+
+/*
+ * Verify a logged rt refcount btree root, as for the rt rmap btree root.
+ */
+static xfs_failaddr_t
+xlog_dinode_verify_rtrefcount_root(
+	struct xfs_mount		*mp,
+	struct xfs_log_dinode		*ldip,
+	void				*src,
+	unsigned int			size)
+{
+	struct xfs_btree_block		*block = src;
+	xfs_failaddr_t			fa;
+	unsigned int			level;
+	unsigned int			numrecs;
+	unsigned int			i;
+
+	if (size < XFS_RTREFCOUNT_BLOCK_LEN)
+		return __this_address;
+
+	fa = xfs_btree_check_fsblock_root_hdr(mp, XFS_RTREFC_CRC_MAGIC,
+			xfs_rtrefcountbt_maxrecs(mp, size,
+				be16_to_cpu(block->bb_level) == 0),
+			block, 0, mp->m_rtrefc_maxlevels - 1);
+	if (fa)
+		return fa;
+
+	level = be16_to_cpu(block->bb_level);
+	numrecs = be16_to_cpu(block->bb_numrecs);
+	if (numrecs == 0 ||
+	    size != xfs_rtrefcount_broot_space_calc(level, numrecs))
+		return __this_address;
+
+	/*
+	 * A leaf root holds records whose bounds are relative to a realtime
+	 * group. The realtime groups are not set up until long after log
+	 * recovery runs, so the leaf contents cannot be validated here. That is
+	 * deferred to the first runtime access to the root block.
+	 */
+	if (level == 0)
+		return NULL;
+
+	for (i = 1; i <= numrecs; i++) {
+		xfs_rtrefcount_ptr_t	*ptr = xfs_rtrefcount_broot_ptr_addr(mp,
+						block, i, size);
+
+		if (!xfs_verify_fsbno(mp, be64_to_cpu(*ptr)))
+			return __this_address;
+	}
+
+	return NULL;
+}
+
+/*
+ * Verify a logged metadata btree root. The metadata btree type is fixed by the
+ * inode, so it is chosen from the log dinode metadata type.
+ */
+static xfs_failaddr_t
+xlog_dinode_verify_metabtree_root(
+	struct xfs_mount		*mp,
+	struct xfs_log_dinode		*ldip,
+	void				*src,
+	unsigned int			size)
+{
+	switch (ldip->di_metatype) {
+	case XFS_METAFILE_RTRMAP:
+		return xlog_dinode_verify_rtrmap_root(mp, ldip, src, size);
+	case XFS_METAFILE_RTREFCOUNT:
+		return xlog_dinode_verify_rtrefcount_root(mp, ldip, src, size);
+	default:
+		return __this_address;
+	}
+}
+
 /*
  * Verify a logged shortform symlink target. The logged target is the on-disk
  * form, which is not null terminated, so this cannot use
@@ -629,7 +755,8 @@ xlog_dinode_verify_dfork(
 	case XFS_DINODE_FMT_META_BTREE:
 		if (field != XFS_ILOG_DBROOT)
 			return __this_address;
-		break;
+		return xlog_dinode_verify_metabtree_root(mp, ldip,
+				item->ri_buf[2].iov_base, ilfp->ilf_dsize);
 	}
 
 	return NULL;
-- 
2.55.0