[PATCH v2] xfs: introduce protection for drop nlink

[PATCH v2] xfs: introduce protection for drop nlink

[cheng.lin130]

From: Cheng Lin <cheng.lin130@zte.com.cn>

When abnormal drop_nlink are detected on the inode,
shutdown filesystem, to avoid corruption propagation.

Signed-off-by: Cheng Lin <cheng.lin130@zte.com.cn>
---
 fs/xfs/xfs_fsops.c | 3 +++
 fs/xfs/xfs_inode.c | 9 +++++++++
 fs/xfs/xfs_mount.h | 1 +
 3 files changed, 13 insertions(+)

diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
index 7cb75cb6b..6fc1cfe83 100644
--- a/fs/xfs/xfs_fsops.c
+++ b/fs/xfs/xfs_fsops.c
@@ -543,6 +543,9 @@ xfs_do_force_shutdown(
 	} else if (flags & SHUTDOWN_CORRUPT_ONDISK) {
 		tag = XFS_PTAG_SHUTDOWN_CORRUPT;
 		why = "Corruption of on-disk metadata";
+	} else if (flags & SHUTDOWN_CORRRUPT_ABN) {
+		tag = XFS_PTAG_SHUTDOWN_CORRUPT;
+		why = "Corruption of Abnormal conditions";
 	} else if (flags & SHUTDOWN_DEVICE_REMOVED) {
 		tag = XFS_PTAG_SHUTDOWN_IOERROR;
 		why = "Block device removal";
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index 9e62cc500..2d41f2461 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -919,6 +919,15 @@ xfs_droplink(
 	xfs_trans_t *tp,
 	xfs_inode_t *ip)
 {
+
+	if (VFS_I(ip)->i_nlink == 0) {
+		xfs_alert(ip->i_mount,
+			  "%s: Deleting inode %llu with no links.",
+			  __func__, ip->i_ino);
+		xfs_force_shutdown(ip->i_mount, SHUTDOWN_CORRRUPT_ABN);
+		return -EFSCORRUPTED;
+	}
+
 	xfs_trans_ichgtime(tp, ip, XFS_ICHGTIME_CHG);

 	drop_nlink(VFS_I(ip));
diff --git a/fs/xfs/xfs_mount.h b/fs/xfs/xfs_mount.h
index e2866e7fa..dbf36b048 100644
--- a/fs/xfs/xfs_mount.h
+++ b/fs/xfs/xfs_mount.h
@@ -459,6 +459,7 @@ void xfs_do_force_shutdown(struct xfs_mount *mp, uint32_t flags, char *fname,
 #define SHUTDOWN_CORRUPT_INCORE	(1u << 3) /* corrupt in-memory structures */
 #define SHUTDOWN_CORRUPT_ONDISK	(1u << 4)  /* corrupt metadata on device */
 #define SHUTDOWN_DEVICE_REMOVED	(1u << 5) /* device removed underneath us */
+#define SHUTDOWN_CORRRUPT_ABN	(1u << 6) /* shutdown from abnormal conditions */

 #define XFS_SHUTDOWN_STRINGS \
 	{ SHUTDOWN_META_IO_ERROR,	"metadata_io" }, \
-- 
2.18.1

Re: [PATCH v2] xfs: introduce protection for drop nlink

[Dave Chinner]

On Mon, Sep 11, 2023 at 04:12:56PM +0800, cheng.lin130@zte.com.cn wrote:
> From: Cheng Lin <cheng.lin130@zte.com.cn>
> 
> When abnormal drop_nlink are detected on the inode,
> shutdown filesystem, to avoid corruption propagation.
> 
> Signed-off-by: Cheng Lin <cheng.lin130@zte.com.cn>
> ---
>  fs/xfs/xfs_fsops.c | 3 +++
>  fs/xfs/xfs_inode.c | 9 +++++++++
>  fs/xfs/xfs_mount.h | 1 +
>  3 files changed, 13 insertions(+)
> 
> diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
> index 7cb75cb6b..6fc1cfe83 100644
> --- a/fs/xfs/xfs_fsops.c
> +++ b/fs/xfs/xfs_fsops.c
> @@ -543,6 +543,9 @@ xfs_do_force_shutdown(
>  	} else if (flags & SHUTDOWN_CORRUPT_ONDISK) {
>  		tag = XFS_PTAG_SHUTDOWN_CORRUPT;
>  		why = "Corruption of on-disk metadata";
> +	} else if (flags & SHUTDOWN_CORRRUPT_ABN) {
> +		tag = XFS_PTAG_SHUTDOWN_CORRUPT;
> +		why = "Corruption of Abnormal conditions";

We don't need a new shutdown tag. We can consider this in-memory
corruption because we detected it in memory before it went to disk
(SHUTDOWN_CORRUPT_INCORE) or even on-disk corruption because the
reference count on disk is likely wrong at this point......

>  	} else if (flags & SHUTDOWN_DEVICE_REMOVED) {
>  		tag = XFS_PTAG_SHUTDOWN_IOERROR;
>  		why = "Block device removal";
> diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
> index 9e62cc500..2d41f2461 100644
> --- a/fs/xfs/xfs_inode.c
> +++ b/fs/xfs/xfs_inode.c
> @@ -919,6 +919,15 @@ xfs_droplink(
>  	xfs_trans_t *tp,
>  	xfs_inode_t *ip)
>  {
> +
> +	if (VFS_I(ip)->i_nlink == 0) {
> +		xfs_alert(ip->i_mount,
> +			  "%s: Deleting inode %llu with no links.",
> +			  __func__, ip->i_ino);
> +		xfs_force_shutdown(ip->i_mount, SHUTDOWN_CORRRUPT_ABN);
> +		return -EFSCORRUPTED;
> +	}
> +
>  	xfs_trans_ichgtime(tp, ip, XFS_ICHGTIME_CHG);
> 
>  	drop_nlink(VFS_I(ip));

I'd kind of prefer that drop_nlink() be made to return an error on
underrun - if it's important enough to drop a warning in the log and
potentially panic the kernel, it's important enough to tell the
filesystem an underrun has occurred.  But that opens a whole new can
of worms, so I think this will be fine.

Note that we don't actually need a call to shut the filesystem down.
Simply returning -EFSCORRUPTED will result in the filesystem being
shut down if the transaction is dirty when it gets cancelled due to
the droplink error.

Cheers,

Dave.
-- 
Dave Chinner
david@fromorbit.com

Re: [PATCH v2] xfs: introduce protection for drop nlink

[cheng.lin130]

> On Mon, Sep 11, 2023 at 04:12:56PM +0800, cheng.lin130@zte.com.cn wrote:
> > From: Cheng Lin <cheng.lin130@zte.com.cn>
> >
> > When abnormal drop_nlink are detected on the inode,
> > shutdown filesystem, to avoid corruption propagation.
> >
> > Signed-off-by: Cheng Lin <cheng.lin130@zte.com.cn>
> > ---
> >  fs/xfs/xfs_fsops.c | 3 +++
> >  fs/xfs/xfs_inode.c | 9 +++++++++
> >  fs/xfs/xfs_mount.h | 1 +
> >  3 files changed, 13 insertions(+)
> >
> > diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
> > index 7cb75cb6b..6fc1cfe83 100644
> > --- a/fs/xfs/xfs_fsops.c
> > +++ b/fs/xfs/xfs_fsops.c
> > @@ -543,6 +543,9 @@ xfs_do_force_shutdown(
> >      } else if (flags & SHUTDOWN_CORRUPT_ONDISK) {
> >          tag = XFS_PTAG_SHUTDOWN_CORRUPT;
> >          why = "Corruption of on-disk metadata";
> > +    } else if (flags & SHUTDOWN_CORRRUPT_ABN) {
> > +        tag = XFS_PTAG_SHUTDOWN_CORRUPT;
> > +        why = "Corruption of Abnormal conditions";
> We don't need a new shutdown tag. We can consider this in-memory
> corruption because we detected it in memory before it went to disk
> (SHUTDOWN_CORRUPT_INCORE) or even on-disk corruption because the
> reference count on disk is likely wrong at this point......
> >      } else if (flags & SHUTDOWN_DEVICE_REMOVED) {
> >          tag = XFS_PTAG_SHUTDOWN_IOERROR;
> >          why = "Block device removal";
> > diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
> > index 9e62cc500..2d41f2461 100644
> > --- a/fs/xfs/xfs_inode.c
> > +++ b/fs/xfs/xfs_inode.c
> > @@ -919,6 +919,15 @@ xfs_droplink(
> >      xfs_trans_t *tp,
> >      xfs_inode_t *ip)
> >  {
> > +
> > +    if (VFS_I(ip)->i_nlink == 0) {
> > +        xfs_alert(ip->i_mount,
> > +              "%s: Deleting inode %llu with no links.",
> > +              __func__, ip->i_ino);
> > +        xfs_force_shutdown(ip->i_mount, SHUTDOWN_CORRRUPT_ABN);
> > +        return -EFSCORRUPTED;
> > +    }
> > +
> >      xfs_trans_ichgtime(tp, ip, XFS_ICHGTIME_CHG);
> >
> >      drop_nlink(VFS_I(ip));
> I'd kind of prefer that drop_nlink() be made to return an error on
> underrun - if it's important enough to drop a warning in the log and
> potentially panic the kernel, it's important enough to tell the
> filesystem an underrun has occurred.  But that opens a whole new can
> of worms, so I think this will be fine.
In VFS, (drop\clear\set\inc)_nlink() all return void. 
Is it appropriate, if let them return an error instead of WARN_ON?
> Note that we don't actually need a call to shut the filesystem down.
> Simply returning -EFSCORRUPTED will result in the filesystem being
> shut down if the transaction is dirty when it gets cancelled due to
> the droplink error.
> Cheers,
> Dave.
> --
> Dave Chinner
> david@fromorbit.com