Re: [PATCH 3/6] xfs_repair: enforce that inode btree chunks can't point to AG headers

Brian Foster
2019-12-06T16:00:50Z

On Thu, Dec 05, 2019 at 08:28:18AM -0800, Darrick J. Wong wrote:
> On Thu, Dec 05, 2019 at 09:37:27AM -0500, Brian Foster wrote:
> > On Wed, Dec 04, 2019 at 09:04:43AM -0800, Darrick J. Wong wrote:
> > > From: Darrick J. Wong <darrick.wong@oracle.com>
> > >
> > > xfs_repair has a very old check that evidently excuses the AG 0 inode
> > > btrees pointing to blocks that are already marked XR_E_INUSE_FS* (e.g.
> > > AG headers). mkfs never formats filesystems that way and it looks like
> > > an error, so purge the check. After this, we always complain if inodes
> > > overlap with AG headers because that should never happen.
> > >
> > > Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> > > ---
> >
> > Strange.. This seems reasonable to me, but any idea on how this might
> > have been used in the past?
>
> I don't have a clue -- this code has been there since the start of the
> xfsprogs git repo and I don't have the pre-git history. Dave said
> "hysterical raisins".
>

Heh, Ok.

> > The only thing I can see so far is that
> > perhaps if the superblock (blocksize/sectorsize) is corrupted, the
> > in-core state trees could be badly initialized such that the inode falls
> > into the "in use" state. Of course if that were the case the fs probably
> > has bigger problems..
>
> Yeah. These days if all those things collide (or look like they
> collide) then chances are the filesystem is already toast.
>

I guess I'm curious if/how this could change behavior in some way. It
kind of looks like this could be some kind of override to try and
preserve/prioritize the root inode if something else happens to be
corrupted and conflict. E.g., what happens if a stray rmapbt record
(incorrectly) categorizes this range as something other than inodes
before the inode scan gets to it? Would this change recovery behavior
from something that treats that as a broken rmapbt to something broader,
or is the outcome generally the same?

It looks to me it _could_ change behavior, but that's also considering a
very targeted corruption vs. something more likely to manifest in the
wild. This code clearly predates rmapbt, so that's obviously not the
original intent. I do also find it odd the hysterical code doesn't warn
if this condition occurs..

Brian

> --D
>
> > Brian
> >
> > > repair/globals.c | 1 -
> > > repair/globals.h | 1 -
> > > repair/scan.c | 19 -------------------
> > > repair/xfs_repair.c | 7 -------
> > > 4 files changed, 28 deletions(-)
> > >
> > >
> > > diff --git a/repair/globals.c b/repair/globals.c
> > > index dcd79ea4..8a60e706 100644
> > > --- a/repair/globals.c
> > > +++ b/repair/globals.c
> > > @@ -73,7 +73,6 @@ int lost_gquotino;
> > > int lost_pquotino;
> > >
> > > xfs_agino_t first_prealloc_ino;
> > > -xfs_agino_t last_prealloc_ino;
> > > xfs_agblock_t bnobt_root;
> > > xfs_agblock_t bcntbt_root;
> > > xfs_agblock_t inobt_root;
> > > diff --git a/repair/globals.h b/repair/globals.h
> > > index 008bdd90..2ed5c894 100644
> > > --- a/repair/globals.h
> > > +++ b/repair/globals.h
> > > @@ -114,7 +114,6 @@ extern int lost_gquotino;
> > > extern int lost_pquotino;
> > >
> > > extern xfs_agino_t first_prealloc_ino;
> > > -extern xfs_agino_t last_prealloc_ino;
> > > extern xfs_agblock_t bnobt_root;
> > > extern xfs_agblock_t bcntbt_root;
> > > extern xfs_agblock_t inobt_root;
> > > diff --git a/repair/scan.c b/repair/scan.c
> > > index c383f3aa..05707dd2 100644
> > > --- a/repair/scan.c
> > > +++ b/repair/scan.c
> > > @@ -1645,13 +1645,6 @@ scan_single_ino_chunk(
> > > break;
> > > case XR_E_INUSE_FS:
> > > case XR_E_INUSE_FS1:
> > > - if (agno == 0 &&
> > > - ino + j >= first_prealloc_ino &&
> > > - ino + j < last_prealloc_ino) {
> > > - set_bmap(agno, agbno, XR_E_INO);
> > > - break;
> > > - }
> > > - /* fall through */
> > > default:
> > > /* XXX - maybe should mark block a duplicate */
> > > do_warn(
> > > @@ -1782,18 +1775,6 @@ _("inode chunk claims untracked block, finobt block - agno %d, bno %d, inopb %d\
> > > break;
> > > case XR_E_INUSE_FS:
> > > case XR_E_INUSE_FS1:
> > > - if (agno == 0 &&
> > > - ino + j >= first_prealloc_ino &&
> > > - ino + j < last_prealloc_ino) {
> > > - do_warn(
> > > -_("inode chunk claims untracked block, finobt block - agno %d, bno %d, inopb %d\n"),
> > > - agno, agbno, mp->m_sb.sb_inopblock);
> > > -
> > > - set_bmap(agno, agbno, XR_E_INO);
> > > - suspect++;
> > > - break;
> > > - }
> > > - /* fall through */
> > > default:
> > > do_warn(
> > > _("inode chunk claims used block, finobt block - agno %d, bno %d, inopb %d\n"),
> > > diff --git a/repair/xfs_repair.c b/repair/xfs_repair.c
> > > index 9295673d..3e9059f3 100644
> > > --- a/repair/xfs_repair.c
> > > +++ b/repair/xfs_repair.c
> > > @@ -460,13 +460,6 @@ calc_mkfs(xfs_mount_t *mp)
> > > first_prealloc_ino = XFS_AGB_TO_AGINO(mp, fino_bno);
> > > }
> > >
> > > - ASSERT(M_IGEO(mp)->ialloc_blks > 0);
> > > -
> > > - if (M_IGEO(mp)->ialloc_blks > 1)
> > > - last_prealloc_ino = first_prealloc_ino + XFS_INODES_PER_CHUNK;
> > > - else
> > > - last_prealloc_ino = XFS_AGB_TO_AGINO(mp, fino_bno + 1);
> > > -
> > > /*
> > > * now the first 3 inodes in the system
> > > */
> > >
> >
>