[PATCH 35/48] xfs: validate the inode item format header during recovery

[Dave Chinner <dgc@kernel.org>]

The inode item format header describes how many regions the item has and where
the inode lives on disk. Recovery trusted these values, guarding only a few of
them with asserts in the commit handler while walking the regions and reading
the inode buffer.

Validate the format header as the item is decoded, so the rest of recovery can
trust the region count and buffer location it describes. The header is
self-consistent with the fields it logs, and the buffer location is fixed by the
inode number, so both are checked here. Deriving the location uses xfs_imap()
with XFS_IMAP_NO_LOOKUP so recovery never issues an inode btree lookup.

The host format conversion is split into its own helper so validation always
runs against a host format header.

Assisted-by: LLM
Signed-off-by: Dave Chinner <dgc@kernel.org>
---
 fs/xfs/xfs_inode_item_recover.c | 123 ++++++++++++++++++++++++++++++--
 1 file changed, 116 insertions(+), 7 deletions(-)

diff --git a/fs/xfs/xfs_inode_item_recover.c b/fs/xfs/xfs_inode_item_recover.c
index 48acb0aa3b6c..8de41ed0bc2f 100644
--- a/fs/xfs/xfs_inode_item_recover.c
+++ b/fs/xfs/xfs_inode_item_recover.c
@@ -21,6 +21,8 @@
 #include "xfs_log_priv.h"
 #include "xfs_log_recover.h"
 #include "xfs_icache.h"
+#include "xfs_ialloc.h"
+#include "xfs_ag.h"
 #include "xfs_bmap_btree.h"
 #include "xfs_rtrmap_btree.h"
 #include "xfs_rtrefcount_btree.h"
@@ -343,29 +345,136 @@ xlog_recover_inode_validate_region(
  * format. A header already in host format is left in place.
  */
 static int
-xlog_recover_inode_validate_item(
-	struct xlog			*log,
+xlog_recover_inode_convert_format(
 	struct xlog_recover_item	*item)
 {
-	struct xfs_inode_log_format	*in_f;
+	struct xfs_inode_log_format	*ilfp;
 	int				error;
 
 	if (item->ri_buf[0].iov_len == sizeof(struct xfs_inode_log_format))
 		return 0;
 
-	in_f = kmalloc_obj(struct xfs_inode_log_format, GFP_KERNEL | __GFP_NOFAIL);
-	error = xfs_inode_item_format_convert(&item->ri_buf[0], in_f);
+	ilfp = kmalloc_obj(struct xfs_inode_log_format, GFP_KERNEL | __GFP_NOFAIL);
+	error = xfs_inode_item_format_convert(&item->ri_buf[0], ilfp);
 	if (error) {
-		kfree(in_f);
+		kfree(ilfp);
 		return error;
 	}
 
 	kvfree(item->ri_buf[0].iov_base);
-	item->ri_buf[0].iov_base = in_f;
+	item->ri_buf[0].iov_base = ilfp;
 	item->ri_buf[0].iov_len = sizeof(struct xfs_inode_log_format);
 	return 0;
 }
 
+/*
+ * The buffer location logged in the format header is fixed by the inode number,
+ * so derive it and check the header matches. The inode cluster geometry is not
+ * always resolvable by arithmetic, and a btree lookup cannot be run this early
+ * in recovery, so an unresolvable geometry only checks the buffer length.
+ */
+static int
+xlog_recover_inode_check_location(
+	struct xlog			*log,
+	struct xfs_inode_log_format	*ilfp)
+{
+	struct xfs_mount		*mp = log->l_mp;
+	struct xfs_perag		*pag;
+	struct xfs_imap			imap;
+	xfs_daddr_t			blkno;
+	int				len;
+	int				error;
+
+	len = XFS_FSB_TO_BB(mp, M_IGEO(mp)->blocks_per_cluster);
+	if (ilfp->ilf_len != len) {
+		xfs_warn(mp,
+			"INODE: inode 0x%llx buffer length 0x%x does not match expected 0x%x recovered.",
+			ilfp->ilf_ino, ilfp->ilf_len, len);
+		return -EFSCORRUPTED;
+	}
+
+	pag = xfs_perag_get(mp, XFS_INO_TO_AGNO(mp, ilfp->ilf_ino));
+	error = xfs_imap(pag, NULL, ilfp->ilf_ino, &imap, XFS_IMAP_NO_LOOKUP);
+	xfs_perag_put(pag);
+	if (error == -EAGAIN)
+		return 0;
+	if (error)
+		return error;
+
+	blkno = XFS_AGB_TO_DADDR(mp, XFS_INO_TO_AGNO(mp, ilfp->ilf_ino),
+			imap.im_agbno);
+	if (ilfp->ilf_blkno != blkno) {
+		xfs_warn(mp,
+			"INODE: inode 0x%llx buffer block 0x%llx does not match expected 0x%llx recovered.",
+			ilfp->ilf_ino, ilfp->ilf_blkno, blkno);
+		return -EFSCORRUPTED;
+	}
+	if (ilfp->ilf_boffset != imap.im_boffset) {
+		xfs_warn(mp,
+			"INODE: inode 0x%llx buffer offset 0x%x does not match expected 0x%x recovered.",
+			ilfp->ilf_ino, ilfp->ilf_boffset, imap.im_boffset);
+		return -EFSCORRUPTED;
+	}
+
+	return 0;
+}
+
+/*
+ * Validate the format header once it is in host format. The item size records
+ * how many regions the item should have, the set of logged fields fixes what
+ * that count must be, and the inode number fixes the buffer location, so all of
+ * these are checked against the header here.
+ */
+static int
+xlog_recover_inode_validate_item(
+	struct xlog			*log,
+	struct xlog_recover_item	*item)
+{
+	struct xfs_inode_log_format	*ilfp;
+	unsigned int			nregions;
+	int				error;
+
+	error = xlog_recover_inode_convert_format(item);
+	if (error)
+		return error;
+	ilfp = item->ri_buf[0].iov_base;
+
+	if (!xfs_verify_ino(log->l_mp, ilfp->ilf_ino)) {
+		xfs_warn(log->l_mp, "INODE: bad inode number 0x%llx recovered.",
+				ilfp->ilf_ino);
+		return -EFSCORRUPTED;
+	}
+
+	if (!(ilfp->ilf_fields & XFS_ILOG_CORE)) {
+		xfs_warn(log->l_mp,
+			"INODE: inode 0x%llx has no core logged, fields 0x%x recovered.",
+			ilfp->ilf_ino, ilfp->ilf_fields);
+		return -EFSCORRUPTED;
+	}
+
+	if (ilfp->ilf_size != item->ri_total) {
+		xfs_warn(log->l_mp,
+			"INODE: inode 0x%llx item size %u does not match region count %u recovered.",
+			ilfp->ilf_ino, ilfp->ilf_size, item->ri_total);
+		return -EFSCORRUPTED;
+	}
+
+	nregions = 2;
+	if (ilfp->ilf_fields & XFS_ILOG_DFORK)
+		nregions++;
+	if (ilfp->ilf_fields & XFS_ILOG_AFORK)
+		nregions++;
+	if (ilfp->ilf_size != nregions) {
+		xfs_warn(log->l_mp,
+			"INODE: inode 0x%llx item size %u does not match region count %u the fields 0x%x define.",
+			ilfp->ilf_ino, ilfp->ilf_size, nregions,
+			ilfp->ilf_fields);
+		return -EFSCORRUPTED;
+	}
+
+	return xlog_recover_inode_check_location(log, ilfp);
+}
+
 STATIC int
 xlog_recover_inode_commit_pass2(
 	struct xlog			*log,
-- 
2.55.0