mirror of
https://kernel.googlesource.com/pub/scm/linux/kernel/git/stable/linux-stable.git
synced 2025-09-24 16:40:40 +10:00
[ Upstream commita509a55f8e
] As syzbot [1] reported as below: R10: 0000000000000100 R11: 0000000000000206 R12: 00007ffe17473450 R13: 00007f28b1c10854 R14: 000000000000dae5 R15: 00007ffe17474520 </TASK> ---[ end trace 0000000000000000 ]--- ================================================================== BUG: KASAN: use-after-free in __list_del_entry_valid+0xa6/0x130 lib/list_debug.c:62 Read of size 8 at addr ffff88812d962278 by task syz-executor/564 CPU: 1 PID: 564 Comm: syz-executor Tainted: G W 6.1.129-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call Trace: <TASK> __dump_stack+0x21/0x24 lib/dump_stack.c:88 dump_stack_lvl+0xee/0x158 lib/dump_stack.c:106 print_address_description+0x71/0x210 mm/kasan/report.c:316 print_report+0x4a/0x60 mm/kasan/report.c:427 kasan_report+0x122/0x150 mm/kasan/report.c:531 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:351 __list_del_entry_valid+0xa6/0x130 lib/list_debug.c:62 __list_del_entry include/linux/list.h:134 [inline] list_del_init include/linux/list.h:206 [inline] f2fs_inode_synced+0xf7/0x2e0 fs/f2fs/super.c:1531 f2fs_update_inode+0x74/0x1c40 fs/f2fs/inode.c:585 f2fs_update_inode_page+0x137/0x170 fs/f2fs/inode.c:703 f2fs_write_inode+0x4ec/0x770 fs/f2fs/inode.c:731 write_inode fs/fs-writeback.c:1460 [inline] __writeback_single_inode+0x4a0/0xab0 fs/fs-writeback.c:1677 writeback_single_inode+0x221/0x8b0 fs/fs-writeback.c:1733 sync_inode_metadata+0xb6/0x110 fs/fs-writeback.c:2789 f2fs_sync_inode_meta+0x16d/0x2a0 fs/f2fs/checkpoint.c:1159 block_operations fs/f2fs/checkpoint.c:1269 [inline] f2fs_write_checkpoint+0xca3/0x2100 fs/f2fs/checkpoint.c:1658 kill_f2fs_super+0x231/0x390 fs/f2fs/super.c:4668 deactivate_locked_super+0x98/0x100 fs/super.c:332 deactivate_super+0xaf/0xe0 fs/super.c:363 cleanup_mnt+0x45f/0x4e0 fs/namespace.c:1186 __cleanup_mnt+0x19/0x20 fs/namespace.c:1193 task_work_run+0x1c6/0x230 kernel/task_work.c:203 exit_task_work include/linux/task_work.h:39 [inline] do_exit+0x9fb/0x2410 kernel/exit.c:871 do_group_exit+0x210/0x2d0 kernel/exit.c:1021 __do_sys_exit_group kernel/exit.c:1032 [inline] __se_sys_exit_group kernel/exit.c:1030 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1030 x64_sys_call+0x7b4/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f28b1b8e169 Code: Unable to access opcode bytes at 0x7f28b1b8e13f. RSP: 002b:00007ffe174710a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 00007f28b1c10879 RCX: 00007f28b1b8e169 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 RBP: 0000000000000002 R08: 00007ffe1746ee47 R09: 00007ffe17472360 R10: 0000000000000009 R11: 0000000000000246 R12: 00007ffe17472360 R13: 00007f28b1c10854 R14: 000000000000dae5 R15: 00007ffe17474520 </TASK> Allocated by task 569: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:52 kasan_save_alloc_info+0x25/0x30 mm/kasan/generic.c:505 __kasan_slab_alloc+0x72/0x80 mm/kasan/common.c:328 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook+0x4f/0x2c0 mm/slab.h:737 slab_alloc_node mm/slub.c:3398 [inline] slab_alloc mm/slub.c:3406 [inline] __kmem_cache_alloc_lru mm/slub.c:3413 [inline] kmem_cache_alloc_lru+0x104/0x220 mm/slub.c:3429 alloc_inode_sb include/linux/fs.h:3245 [inline] f2fs_alloc_inode+0x2d/0x340 fs/f2fs/super.c:1419 alloc_inode fs/inode.c:261 [inline] iget_locked+0x186/0x880 fs/inode.c:1373 f2fs_iget+0x55/0x4c60 fs/f2fs/inode.c:483 f2fs_lookup+0x366/0xab0 fs/f2fs/namei.c:487 __lookup_slow+0x2a3/0x3d0 fs/namei.c:1690 lookup_slow+0x57/0x70 fs/namei.c:1707 walk_component+0x2e6/0x410 fs/namei.c:1998 lookup_last fs/namei.c:2455 [inline] path_lookupat+0x180/0x490 fs/namei.c:2479 filename_lookup+0x1f0/0x500 fs/namei.c:2508 vfs_statx+0x10b/0x660 fs/stat.c:229 vfs_fstatat fs/stat.c:267 [inline] vfs_lstat include/linux/fs.h:3424 [inline] __do_sys_newlstat fs/stat.c:423 [inline] __se_sys_newlstat+0xd5/0x350 fs/stat.c:417 __x64_sys_newlstat+0x5b/0x70 fs/stat.c:417 x64_sys_call+0x393/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:7 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Freed by task 13: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:52 kasan_save_free_info+0x31/0x50 mm/kasan/generic.c:516 ____kasan_slab_free+0x132/0x180 mm/kasan/common.c:236 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:244 kasan_slab_free include/linux/kasan.h:177 [inline] slab_free_hook mm/slub.c:1724 [inline] slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1750 slab_free mm/slub.c:3661 [inline] kmem_cache_free+0x12d/0x2a0 mm/slub.c:3683 f2fs_free_inode+0x24/0x30 fs/f2fs/super.c:1562 i_callback+0x4c/0x70 fs/inode.c:250 rcu_do_batch+0x503/0xb80 kernel/rcu/tree.c:2297 rcu_core+0x5a2/0xe70 kernel/rcu/tree.c:2557 rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2574 handle_softirqs+0x178/0x500 kernel/softirq.c:578 run_ksoftirqd+0x28/0x30 kernel/softirq.c:945 smpboot_thread_fn+0x45a/0x8c0 kernel/smpboot.c:164 kthread+0x270/0x310 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Last potentially related work creation: kasan_save_stack+0x3a/0x60 mm/kasan/common.c:45 __kasan_record_aux_stack+0xb6/0xc0 mm/kasan/generic.c:486 kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:496 call_rcu+0xd4/0xf70 kernel/rcu/tree.c:2845 destroy_inode fs/inode.c:316 [inline] evict+0x7da/0x870 fs/inode.c:720 iput_final fs/inode.c:1834 [inline] iput+0x62b/0x830 fs/inode.c:1860 do_unlinkat+0x356/0x540 fs/namei.c:4397 __do_sys_unlink fs/namei.c:4438 [inline] __se_sys_unlink fs/namei.c:4436 [inline] __x64_sys_unlink+0x49/0x50 fs/namei.c:4436 x64_sys_call+0x958/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:88 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 The buggy address belongs to the object at ffff88812d961f20 which belongs to the cache f2fs_inode_cache of size 1200 The buggy address is located 856 bytes inside of 1200-byte region [ffff88812d961f20, ffff88812d9623d0) The buggy address belongs to the physical page: page:ffffea0004b65800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12d960 head:ffffea0004b65800 order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head|zone=1) raw: 4000000000010200 0000000000000000 dead000000000122 ffff88810a94c500 raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Reclaimable, gfp_mask 0x1d2050(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 569, tgid 568 (syz.2.16), ts 55943246141, free_ts 0 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1d0/0x1f0 mm/page_alloc.c:2532 prep_new_page mm/page_alloc.c:2539 [inline] get_page_from_freelist+0x2e63/0x2ef0 mm/page_alloc.c:4328 __alloc_pages+0x235/0x4b0 mm/page_alloc.c:5605 alloc_slab_page include/linux/gfp.h:-1 [inline] allocate_slab mm/slub.c:1939 [inline] new_slab+0xec/0x4b0 mm/slub.c:1992 ___slab_alloc+0x6f6/0xb50 mm/slub.c:3180 __slab_alloc+0x5e/0xa0 mm/slub.c:3279 slab_alloc_node mm/slub.c:3364 [inline] slab_alloc mm/slub.c:3406 [inline] __kmem_cache_alloc_lru mm/slub.c:3413 [inline] kmem_cache_alloc_lru+0x13f/0x220 mm/slub.c:3429 alloc_inode_sb include/linux/fs.h:3245 [inline] f2fs_alloc_inode+0x2d/0x340 fs/f2fs/super.c:1419 alloc_inode fs/inode.c:261 [inline] iget_locked+0x186/0x880 fs/inode.c:1373 f2fs_iget+0x55/0x4c60 fs/f2fs/inode.c:483 f2fs_fill_super+0x3ad7/0x6bb0 fs/f2fs/super.c:4293 mount_bdev+0x2ae/0x3e0 fs/super.c:1443 f2fs_mount+0x34/0x40 fs/f2fs/super.c:4642 legacy_get_tree+0xea/0x190 fs/fs_context.c:632 vfs_get_tree+0x89/0x260 fs/super.c:1573 do_new_mount+0x25a/0xa20 fs/namespace.c:3056 page_owner free stack trace missing Memory state around the buggy address: ffff88812d962100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88812d962180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88812d962200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88812d962280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88812d962300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== [1] https://syzkaller.appspot.com/x/report.txt?x=13448368580000 This bug can be reproduced w/ the reproducer [2], once we enable CONFIG_F2FS_CHECK_FS config, the reproducer will trigger panic as below, so the direct reason of this bug is the same as the one below patch [3] fixed. kernel BUG at fs/f2fs/inode.c:857! RIP: 0010:f2fs_evict_inode+0x1204/0x1a20 Call Trace: <TASK> evict+0x32a/0x7a0 do_unlinkat+0x37b/0x5b0 __x64_sys_unlink+0xad/0x100 do_syscall_64+0x5a/0xb0 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 RIP: 0010:f2fs_evict_inode+0x1204/0x1a20 [2] https://syzkaller.appspot.com/x/repro.c?x=17495ccc580000 [3] https://lore.kernel.org/linux-f2fs-devel/20250702120321.1080759-1-chao@kernel.org Tracepoints before panic: f2fs_unlink_enter: dev = (7,0), dir ino = 3, i_size = 4096, i_blocks = 8, name = file1 f2fs_unlink_exit: dev = (7,0), ino = 7, ret = 0 f2fs_evict_inode: dev = (7,0), ino = 7, pino = 3, i_mode = 0x81ed, i_size = 10, i_nlink = 0, i_blocks = 0, i_advise = 0x0 f2fs_truncate_node: dev = (7,0), ino = 7, nid = 8, block_address = 0x3c05 f2fs_unlink_enter: dev = (7,0), dir ino = 3, i_size = 4096, i_blocks = 8, name = file3 f2fs_unlink_exit: dev = (7,0), ino = 8, ret = 0 f2fs_evict_inode: dev = (7,0), ino = 8, pino = 3, i_mode = 0x81ed, i_size = 9000, i_nlink = 0, i_blocks = 24, i_advise = 0x4 f2fs_truncate: dev = (7,0), ino = 8, pino = 3, i_mode = 0x81ed, i_size = 0, i_nlink = 0, i_blocks = 24, i_advise = 0x4 f2fs_truncate_blocks_enter: dev = (7,0), ino = 8, i_size = 0, i_blocks = 24, start file offset = 0 f2fs_truncate_blocks_exit: dev = (7,0), ino = 8, ret = -2 The root cause is: in the fuzzed image, dnode #8 belongs to inode #7, after inode #7 eviction, dnode #8 was dropped. However there is dirent that has ino #8, so, once we unlink file3, in f2fs_evict_inode(), both f2fs_truncate() and f2fs_update_inode_page() will fail due to we can not load node #8, result in we missed to call f2fs_inode_synced() to clear inode dirty status. Let's fix this by calling f2fs_inode_synced() in error path of f2fs_evict_inode(). PS: As I verified, the reproducer [2] can trigger this bug in v6.1.129, but it failed in v6.16-rc4, this is because the testcase will stop due to other corruption has been detected by f2fs: F2FS-fs (loop0): inconsistent node block, node_type:2, nid:8, node_footer[nid:8,ino:8,ofs:0,cpver:5013063228981249506,blkaddr:15366] F2FS-fs (loop0): f2fs_lookup: inode (ino=9) has zero i_nlink Fixes:0f18b462b2
("f2fs: flush inode metadata when checkpoint is doing") Closes: https://syzkaller.appspot.com/x/report.txt?x=13448368580000 Signed-off-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
1024 lines
28 KiB
C
1024 lines
28 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/*
|
|
* fs/f2fs/inode.c
|
|
*
|
|
* Copyright (c) 2012 Samsung Electronics Co., Ltd.
|
|
* http://www.samsung.com/
|
|
*/
|
|
#include <linux/fs.h>
|
|
#include <linux/f2fs_fs.h>
|
|
#include <linux/writeback.h>
|
|
#include <linux/sched/mm.h>
|
|
#include <linux/lz4.h>
|
|
#include <linux/zstd.h>
|
|
|
|
#include "f2fs.h"
|
|
#include "node.h"
|
|
#include "segment.h"
|
|
#include "xattr.h"
|
|
|
|
#include <trace/events/f2fs.h>
|
|
|
|
#ifdef CONFIG_F2FS_FS_COMPRESSION
|
|
extern const struct address_space_operations f2fs_compress_aops;
|
|
#endif
|
|
|
|
void f2fs_mark_inode_dirty_sync(struct inode *inode, bool sync)
|
|
{
|
|
if (is_inode_flag_set(inode, FI_NEW_INODE))
|
|
return;
|
|
|
|
if (f2fs_readonly(F2FS_I_SB(inode)->sb))
|
|
return;
|
|
|
|
if (f2fs_inode_dirtied(inode, sync))
|
|
return;
|
|
|
|
/* only atomic file w/ FI_ATOMIC_COMMITTED can be set vfs dirty */
|
|
if (f2fs_is_atomic_file(inode) &&
|
|
!is_inode_flag_set(inode, FI_ATOMIC_COMMITTED))
|
|
return;
|
|
|
|
mark_inode_dirty_sync(inode);
|
|
}
|
|
|
|
void f2fs_set_inode_flags(struct inode *inode)
|
|
{
|
|
unsigned int flags = F2FS_I(inode)->i_flags;
|
|
unsigned int new_fl = 0;
|
|
|
|
if (flags & F2FS_SYNC_FL)
|
|
new_fl |= S_SYNC;
|
|
if (flags & F2FS_APPEND_FL)
|
|
new_fl |= S_APPEND;
|
|
if (flags & F2FS_IMMUTABLE_FL)
|
|
new_fl |= S_IMMUTABLE;
|
|
if (flags & F2FS_NOATIME_FL)
|
|
new_fl |= S_NOATIME;
|
|
if (flags & F2FS_DIRSYNC_FL)
|
|
new_fl |= S_DIRSYNC;
|
|
if (file_is_encrypt(inode))
|
|
new_fl |= S_ENCRYPTED;
|
|
if (file_is_verity(inode))
|
|
new_fl |= S_VERITY;
|
|
if (flags & F2FS_CASEFOLD_FL)
|
|
new_fl |= S_CASEFOLD;
|
|
inode_set_flags(inode, new_fl,
|
|
S_SYNC|S_APPEND|S_IMMUTABLE|S_NOATIME|S_DIRSYNC|
|
|
S_ENCRYPTED|S_VERITY|S_CASEFOLD);
|
|
}
|
|
|
|
static void __get_inode_rdev(struct inode *inode, struct page *node_page)
|
|
{
|
|
__le32 *addr = get_dnode_addr(inode, node_page);
|
|
|
|
if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode) ||
|
|
S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) {
|
|
if (addr[0])
|
|
inode->i_rdev = old_decode_dev(le32_to_cpu(addr[0]));
|
|
else
|
|
inode->i_rdev = new_decode_dev(le32_to_cpu(addr[1]));
|
|
}
|
|
}
|
|
|
|
static void __set_inode_rdev(struct inode *inode, struct page *node_page)
|
|
{
|
|
__le32 *addr = get_dnode_addr(inode, node_page);
|
|
|
|
if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode)) {
|
|
if (old_valid_dev(inode->i_rdev)) {
|
|
addr[0] = cpu_to_le32(old_encode_dev(inode->i_rdev));
|
|
addr[1] = 0;
|
|
} else {
|
|
addr[0] = 0;
|
|
addr[1] = cpu_to_le32(new_encode_dev(inode->i_rdev));
|
|
addr[2] = 0;
|
|
}
|
|
}
|
|
}
|
|
|
|
static void __recover_inline_status(struct inode *inode, struct page *ipage)
|
|
{
|
|
void *inline_data = inline_data_addr(inode, ipage);
|
|
__le32 *start = inline_data;
|
|
__le32 *end = start + MAX_INLINE_DATA(inode) / sizeof(__le32);
|
|
|
|
while (start < end) {
|
|
if (*start++) {
|
|
f2fs_wait_on_page_writeback(ipage, NODE, true, true);
|
|
|
|
set_inode_flag(inode, FI_DATA_EXIST);
|
|
set_raw_inline(inode, F2FS_INODE(ipage));
|
|
set_page_dirty(ipage);
|
|
return;
|
|
}
|
|
}
|
|
return;
|
|
}
|
|
|
|
static bool f2fs_enable_inode_chksum(struct f2fs_sb_info *sbi, struct page *page)
|
|
{
|
|
struct f2fs_inode *ri = &F2FS_NODE(page)->i;
|
|
|
|
if (!f2fs_sb_has_inode_chksum(sbi))
|
|
return false;
|
|
|
|
if (!IS_INODE(page) || !(ri->i_inline & F2FS_EXTRA_ATTR))
|
|
return false;
|
|
|
|
if (!F2FS_FITS_IN_INODE(ri, le16_to_cpu(ri->i_extra_isize),
|
|
i_inode_checksum))
|
|
return false;
|
|
|
|
return true;
|
|
}
|
|
|
|
static __u32 f2fs_inode_chksum(struct f2fs_sb_info *sbi, struct page *page)
|
|
{
|
|
struct f2fs_node *node = F2FS_NODE(page);
|
|
struct f2fs_inode *ri = &node->i;
|
|
__le32 ino = node->footer.ino;
|
|
__le32 gen = ri->i_generation;
|
|
__u32 chksum, chksum_seed;
|
|
__u32 dummy_cs = 0;
|
|
unsigned int offset = offsetof(struct f2fs_inode, i_inode_checksum);
|
|
unsigned int cs_size = sizeof(dummy_cs);
|
|
|
|
chksum = f2fs_chksum(sbi, sbi->s_chksum_seed, (__u8 *)&ino,
|
|
sizeof(ino));
|
|
chksum_seed = f2fs_chksum(sbi, chksum, (__u8 *)&gen, sizeof(gen));
|
|
|
|
chksum = f2fs_chksum(sbi, chksum_seed, (__u8 *)ri, offset);
|
|
chksum = f2fs_chksum(sbi, chksum, (__u8 *)&dummy_cs, cs_size);
|
|
offset += cs_size;
|
|
chksum = f2fs_chksum(sbi, chksum, (__u8 *)ri + offset,
|
|
F2FS_BLKSIZE - offset);
|
|
return chksum;
|
|
}
|
|
|
|
bool f2fs_inode_chksum_verify(struct f2fs_sb_info *sbi, struct page *page)
|
|
{
|
|
struct f2fs_inode *ri;
|
|
__u32 provided, calculated;
|
|
|
|
if (unlikely(is_sbi_flag_set(sbi, SBI_IS_SHUTDOWN)))
|
|
return true;
|
|
|
|
#ifdef CONFIG_F2FS_CHECK_FS
|
|
if (!f2fs_enable_inode_chksum(sbi, page))
|
|
#else
|
|
if (!f2fs_enable_inode_chksum(sbi, page) ||
|
|
PageDirty(page) ||
|
|
folio_test_writeback(page_folio(page)))
|
|
#endif
|
|
return true;
|
|
|
|
ri = &F2FS_NODE(page)->i;
|
|
provided = le32_to_cpu(ri->i_inode_checksum);
|
|
calculated = f2fs_inode_chksum(sbi, page);
|
|
|
|
if (provided != calculated)
|
|
f2fs_warn(sbi, "checksum invalid, nid = %lu, ino_of_node = %x, %x vs. %x",
|
|
page_folio(page)->index, ino_of_node(page),
|
|
provided, calculated);
|
|
|
|
return provided == calculated;
|
|
}
|
|
|
|
void f2fs_inode_chksum_set(struct f2fs_sb_info *sbi, struct page *page)
|
|
{
|
|
struct f2fs_inode *ri = &F2FS_NODE(page)->i;
|
|
|
|
if (!f2fs_enable_inode_chksum(sbi, page))
|
|
return;
|
|
|
|
ri->i_inode_checksum = cpu_to_le32(f2fs_inode_chksum(sbi, page));
|
|
}
|
|
|
|
static bool sanity_check_compress_inode(struct inode *inode,
|
|
struct f2fs_inode *ri)
|
|
{
|
|
struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
|
|
unsigned char clevel;
|
|
|
|
if (ri->i_compress_algorithm >= COMPRESS_MAX) {
|
|
f2fs_warn(sbi,
|
|
"%s: inode (ino=%lx) has unsupported compress algorithm: %u, run fsck to fix",
|
|
__func__, inode->i_ino, ri->i_compress_algorithm);
|
|
return false;
|
|
}
|
|
if (le64_to_cpu(ri->i_compr_blocks) >
|
|
SECTOR_TO_BLOCK(inode->i_blocks)) {
|
|
f2fs_warn(sbi,
|
|
"%s: inode (ino=%lx) has inconsistent i_compr_blocks:%llu, i_blocks:%llu, run fsck to fix",
|
|
__func__, inode->i_ino, le64_to_cpu(ri->i_compr_blocks),
|
|
SECTOR_TO_BLOCK(inode->i_blocks));
|
|
return false;
|
|
}
|
|
if (ri->i_log_cluster_size < MIN_COMPRESS_LOG_SIZE ||
|
|
ri->i_log_cluster_size > MAX_COMPRESS_LOG_SIZE) {
|
|
f2fs_warn(sbi,
|
|
"%s: inode (ino=%lx) has unsupported log cluster size: %u, run fsck to fix",
|
|
__func__, inode->i_ino, ri->i_log_cluster_size);
|
|
return false;
|
|
}
|
|
|
|
clevel = le16_to_cpu(ri->i_compress_flag) >>
|
|
COMPRESS_LEVEL_OFFSET;
|
|
switch (ri->i_compress_algorithm) {
|
|
case COMPRESS_LZO:
|
|
#ifdef CONFIG_F2FS_FS_LZO
|
|
if (clevel)
|
|
goto err_level;
|
|
#endif
|
|
break;
|
|
case COMPRESS_LZORLE:
|
|
#ifdef CONFIG_F2FS_FS_LZORLE
|
|
if (clevel)
|
|
goto err_level;
|
|
#endif
|
|
break;
|
|
case COMPRESS_LZ4:
|
|
#ifdef CONFIG_F2FS_FS_LZ4
|
|
#ifdef CONFIG_F2FS_FS_LZ4HC
|
|
if (clevel &&
|
|
(clevel < LZ4HC_MIN_CLEVEL || clevel > LZ4HC_MAX_CLEVEL))
|
|
goto err_level;
|
|
#else
|
|
if (clevel)
|
|
goto err_level;
|
|
#endif
|
|
#endif
|
|
break;
|
|
case COMPRESS_ZSTD:
|
|
#ifdef CONFIG_F2FS_FS_ZSTD
|
|
if (clevel < zstd_min_clevel() || clevel > zstd_max_clevel())
|
|
goto err_level;
|
|
#endif
|
|
break;
|
|
default:
|
|
goto err_level;
|
|
}
|
|
|
|
return true;
|
|
err_level:
|
|
f2fs_warn(sbi, "%s: inode (ino=%lx) has unsupported compress level: %u, run fsck to fix",
|
|
__func__, inode->i_ino, clevel);
|
|
return false;
|
|
}
|
|
|
|
static bool sanity_check_inode(struct inode *inode, struct page *node_page)
|
|
{
|
|
struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
|
|
struct f2fs_inode_info *fi = F2FS_I(inode);
|
|
struct f2fs_inode *ri = F2FS_INODE(node_page);
|
|
unsigned long long iblocks;
|
|
|
|
iblocks = le64_to_cpu(F2FS_INODE(node_page)->i_blocks);
|
|
if (!iblocks) {
|
|
f2fs_warn(sbi, "%s: corrupted inode i_blocks i_ino=%lx iblocks=%llu, run fsck to fix.",
|
|
__func__, inode->i_ino, iblocks);
|
|
return false;
|
|
}
|
|
|
|
if (ino_of_node(node_page) != nid_of_node(node_page)) {
|
|
f2fs_warn(sbi, "%s: corrupted inode footer i_ino=%lx, ino,nid: [%u, %u] run fsck to fix.",
|
|
__func__, inode->i_ino,
|
|
ino_of_node(node_page), nid_of_node(node_page));
|
|
return false;
|
|
}
|
|
|
|
if (ino_of_node(node_page) == fi->i_xattr_nid) {
|
|
f2fs_warn(sbi, "%s: corrupted inode i_ino=%lx, xnid=%x, run fsck to fix.",
|
|
__func__, inode->i_ino, fi->i_xattr_nid);
|
|
return false;
|
|
}
|
|
|
|
if (f2fs_has_extra_attr(inode)) {
|
|
if (!f2fs_sb_has_extra_attr(sbi)) {
|
|
f2fs_warn(sbi, "%s: inode (ino=%lx) is with extra_attr, but extra_attr feature is off",
|
|
__func__, inode->i_ino);
|
|
return false;
|
|
}
|
|
if (fi->i_extra_isize > F2FS_TOTAL_EXTRA_ATTR_SIZE ||
|
|
fi->i_extra_isize < F2FS_MIN_EXTRA_ATTR_SIZE ||
|
|
fi->i_extra_isize % sizeof(__le32)) {
|
|
f2fs_warn(sbi, "%s: inode (ino=%lx) has corrupted i_extra_isize: %d, max: %zu",
|
|
__func__, inode->i_ino, fi->i_extra_isize,
|
|
F2FS_TOTAL_EXTRA_ATTR_SIZE);
|
|
return false;
|
|
}
|
|
if (f2fs_sb_has_flexible_inline_xattr(sbi) &&
|
|
f2fs_has_inline_xattr(inode) &&
|
|
(!fi->i_inline_xattr_size ||
|
|
fi->i_inline_xattr_size > MAX_INLINE_XATTR_SIZE)) {
|
|
f2fs_warn(sbi, "%s: inode (ino=%lx) has corrupted i_inline_xattr_size: %d, max: %lu",
|
|
__func__, inode->i_ino, fi->i_inline_xattr_size,
|
|
MAX_INLINE_XATTR_SIZE);
|
|
return false;
|
|
}
|
|
if (f2fs_sb_has_compression(sbi) &&
|
|
fi->i_flags & F2FS_COMPR_FL &&
|
|
F2FS_FITS_IN_INODE(ri, fi->i_extra_isize,
|
|
i_compress_flag)) {
|
|
if (!sanity_check_compress_inode(inode, ri))
|
|
return false;
|
|
}
|
|
}
|
|
|
|
if (!f2fs_sb_has_extra_attr(sbi)) {
|
|
if (f2fs_sb_has_project_quota(sbi)) {
|
|
f2fs_warn(sbi, "%s: corrupted inode ino=%lx, wrong feature flag: %u, run fsck to fix.",
|
|
__func__, inode->i_ino, F2FS_FEATURE_PRJQUOTA);
|
|
return false;
|
|
}
|
|
if (f2fs_sb_has_inode_chksum(sbi)) {
|
|
f2fs_warn(sbi, "%s: corrupted inode ino=%lx, wrong feature flag: %u, run fsck to fix.",
|
|
__func__, inode->i_ino, F2FS_FEATURE_INODE_CHKSUM);
|
|
return false;
|
|
}
|
|
if (f2fs_sb_has_flexible_inline_xattr(sbi)) {
|
|
f2fs_warn(sbi, "%s: corrupted inode ino=%lx, wrong feature flag: %u, run fsck to fix.",
|
|
__func__, inode->i_ino, F2FS_FEATURE_FLEXIBLE_INLINE_XATTR);
|
|
return false;
|
|
}
|
|
if (f2fs_sb_has_inode_crtime(sbi)) {
|
|
f2fs_warn(sbi, "%s: corrupted inode ino=%lx, wrong feature flag: %u, run fsck to fix.",
|
|
__func__, inode->i_ino, F2FS_FEATURE_INODE_CRTIME);
|
|
return false;
|
|
}
|
|
if (f2fs_sb_has_compression(sbi)) {
|
|
f2fs_warn(sbi, "%s: corrupted inode ino=%lx, wrong feature flag: %u, run fsck to fix.",
|
|
__func__, inode->i_ino, F2FS_FEATURE_COMPRESSION);
|
|
return false;
|
|
}
|
|
}
|
|
|
|
if (f2fs_sanity_check_inline_data(inode, node_page)) {
|
|
f2fs_warn(sbi, "%s: inode (ino=%lx, mode=%u) should not have inline_data, run fsck to fix",
|
|
__func__, inode->i_ino, inode->i_mode);
|
|
return false;
|
|
}
|
|
|
|
if (f2fs_has_inline_dentry(inode) && !S_ISDIR(inode->i_mode)) {
|
|
f2fs_warn(sbi, "%s: inode (ino=%lx, mode=%u) should not have inline_dentry, run fsck to fix",
|
|
__func__, inode->i_ino, inode->i_mode);
|
|
return false;
|
|
}
|
|
|
|
if ((fi->i_flags & F2FS_CASEFOLD_FL) && !f2fs_sb_has_casefold(sbi)) {
|
|
f2fs_warn(sbi, "%s: inode (ino=%lx) has casefold flag, but casefold feature is off",
|
|
__func__, inode->i_ino);
|
|
return false;
|
|
}
|
|
|
|
if (fi->i_xattr_nid && f2fs_check_nid_range(sbi, fi->i_xattr_nid)) {
|
|
f2fs_warn(sbi, "%s: inode (ino=%lx) has corrupted i_xattr_nid: %u, run fsck to fix.",
|
|
__func__, inode->i_ino, fi->i_xattr_nid);
|
|
return false;
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
static void init_idisk_time(struct inode *inode)
|
|
{
|
|
struct f2fs_inode_info *fi = F2FS_I(inode);
|
|
|
|
fi->i_disk_time[0] = inode_get_atime(inode);
|
|
fi->i_disk_time[1] = inode_get_ctime(inode);
|
|
fi->i_disk_time[2] = inode_get_mtime(inode);
|
|
}
|
|
|
|
static int do_read_inode(struct inode *inode)
|
|
{
|
|
struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
|
|
struct f2fs_inode_info *fi = F2FS_I(inode);
|
|
struct page *node_page;
|
|
struct f2fs_inode *ri;
|
|
projid_t i_projid;
|
|
|
|
/* Check if ino is within scope */
|
|
if (f2fs_check_nid_range(sbi, inode->i_ino))
|
|
return -EINVAL;
|
|
|
|
node_page = f2fs_get_node_page(sbi, inode->i_ino);
|
|
if (IS_ERR(node_page))
|
|
return PTR_ERR(node_page);
|
|
|
|
ri = F2FS_INODE(node_page);
|
|
|
|
inode->i_mode = le16_to_cpu(ri->i_mode);
|
|
i_uid_write(inode, le32_to_cpu(ri->i_uid));
|
|
i_gid_write(inode, le32_to_cpu(ri->i_gid));
|
|
set_nlink(inode, le32_to_cpu(ri->i_links));
|
|
inode->i_size = le64_to_cpu(ri->i_size);
|
|
inode->i_blocks = SECTOR_FROM_BLOCK(le64_to_cpu(ri->i_blocks) - 1);
|
|
|
|
inode_set_atime(inode, le64_to_cpu(ri->i_atime),
|
|
le32_to_cpu(ri->i_atime_nsec));
|
|
inode_set_ctime(inode, le64_to_cpu(ri->i_ctime),
|
|
le32_to_cpu(ri->i_ctime_nsec));
|
|
inode_set_mtime(inode, le64_to_cpu(ri->i_mtime),
|
|
le32_to_cpu(ri->i_mtime_nsec));
|
|
inode->i_generation = le32_to_cpu(ri->i_generation);
|
|
if (S_ISDIR(inode->i_mode))
|
|
fi->i_current_depth = le32_to_cpu(ri->i_current_depth);
|
|
else if (S_ISREG(inode->i_mode))
|
|
fi->i_gc_failures = le16_to_cpu(ri->i_gc_failures);
|
|
fi->i_xattr_nid = le32_to_cpu(ri->i_xattr_nid);
|
|
fi->i_flags = le32_to_cpu(ri->i_flags);
|
|
if (S_ISREG(inode->i_mode))
|
|
fi->i_flags &= ~F2FS_PROJINHERIT_FL;
|
|
bitmap_zero(fi->flags, FI_MAX);
|
|
fi->i_advise = ri->i_advise;
|
|
fi->i_pino = le32_to_cpu(ri->i_pino);
|
|
fi->i_dir_level = ri->i_dir_level;
|
|
|
|
get_inline_info(inode, ri);
|
|
|
|
fi->i_extra_isize = f2fs_has_extra_attr(inode) ?
|
|
le16_to_cpu(ri->i_extra_isize) : 0;
|
|
|
|
if (f2fs_sb_has_flexible_inline_xattr(sbi)) {
|
|
fi->i_inline_xattr_size = le16_to_cpu(ri->i_inline_xattr_size);
|
|
} else if (f2fs_has_inline_xattr(inode) ||
|
|
f2fs_has_inline_dentry(inode)) {
|
|
fi->i_inline_xattr_size = DEFAULT_INLINE_XATTR_ADDRS;
|
|
} else {
|
|
|
|
/*
|
|
* Previous inline data or directory always reserved 200 bytes
|
|
* in inode layout, even if inline_xattr is disabled. In order
|
|
* to keep inline_dentry's structure for backward compatibility,
|
|
* we get the space back only from inline_data.
|
|
*/
|
|
fi->i_inline_xattr_size = 0;
|
|
}
|
|
|
|
if (!sanity_check_inode(inode, node_page)) {
|
|
f2fs_put_page(node_page, 1);
|
|
set_sbi_flag(sbi, SBI_NEED_FSCK);
|
|
f2fs_handle_error(sbi, ERROR_CORRUPTED_INODE);
|
|
return -EFSCORRUPTED;
|
|
}
|
|
|
|
/* check data exist */
|
|
if (f2fs_has_inline_data(inode) && !f2fs_exist_data(inode))
|
|
__recover_inline_status(inode, node_page);
|
|
|
|
/* try to recover cold bit for non-dir inode */
|
|
if (!S_ISDIR(inode->i_mode) && !is_cold_node(node_page)) {
|
|
f2fs_wait_on_page_writeback(node_page, NODE, true, true);
|
|
set_cold_node(node_page, false);
|
|
set_page_dirty(node_page);
|
|
}
|
|
|
|
/* get rdev by using inline_info */
|
|
__get_inode_rdev(inode, node_page);
|
|
|
|
if (!f2fs_need_inode_block_update(sbi, inode->i_ino))
|
|
fi->last_disk_size = inode->i_size;
|
|
|
|
if (fi->i_flags & F2FS_PROJINHERIT_FL)
|
|
set_inode_flag(inode, FI_PROJ_INHERIT);
|
|
|
|
if (f2fs_has_extra_attr(inode) && f2fs_sb_has_project_quota(sbi) &&
|
|
F2FS_FITS_IN_INODE(ri, fi->i_extra_isize, i_projid))
|
|
i_projid = (projid_t)le32_to_cpu(ri->i_projid);
|
|
else
|
|
i_projid = F2FS_DEF_PROJID;
|
|
fi->i_projid = make_kprojid(&init_user_ns, i_projid);
|
|
|
|
if (f2fs_has_extra_attr(inode) && f2fs_sb_has_inode_crtime(sbi) &&
|
|
F2FS_FITS_IN_INODE(ri, fi->i_extra_isize, i_crtime)) {
|
|
fi->i_crtime.tv_sec = le64_to_cpu(ri->i_crtime);
|
|
fi->i_crtime.tv_nsec = le32_to_cpu(ri->i_crtime_nsec);
|
|
}
|
|
|
|
if (f2fs_has_extra_attr(inode) && f2fs_sb_has_compression(sbi) &&
|
|
(fi->i_flags & F2FS_COMPR_FL)) {
|
|
if (F2FS_FITS_IN_INODE(ri, fi->i_extra_isize,
|
|
i_compress_flag)) {
|
|
unsigned short compress_flag;
|
|
|
|
atomic_set(&fi->i_compr_blocks,
|
|
le64_to_cpu(ri->i_compr_blocks));
|
|
fi->i_compress_algorithm = ri->i_compress_algorithm;
|
|
fi->i_log_cluster_size = ri->i_log_cluster_size;
|
|
compress_flag = le16_to_cpu(ri->i_compress_flag);
|
|
fi->i_compress_level = compress_flag >>
|
|
COMPRESS_LEVEL_OFFSET;
|
|
fi->i_compress_flag = compress_flag &
|
|
GENMASK(COMPRESS_LEVEL_OFFSET - 1, 0);
|
|
fi->i_cluster_size = BIT(fi->i_log_cluster_size);
|
|
set_inode_flag(inode, FI_COMPRESSED_FILE);
|
|
}
|
|
}
|
|
|
|
init_idisk_time(inode);
|
|
|
|
if (!sanity_check_extent_cache(inode, node_page)) {
|
|
f2fs_put_page(node_page, 1);
|
|
f2fs_handle_error(sbi, ERROR_CORRUPTED_INODE);
|
|
return -EFSCORRUPTED;
|
|
}
|
|
|
|
/* Need all the flag bits */
|
|
f2fs_init_read_extent_tree(inode, node_page);
|
|
f2fs_init_age_extent_tree(inode);
|
|
|
|
f2fs_put_page(node_page, 1);
|
|
|
|
stat_inc_inline_xattr(inode);
|
|
stat_inc_inline_inode(inode);
|
|
stat_inc_inline_dir(inode);
|
|
stat_inc_compr_inode(inode);
|
|
stat_add_compr_blocks(inode, atomic_read(&fi->i_compr_blocks));
|
|
|
|
return 0;
|
|
}
|
|
|
|
static bool is_meta_ino(struct f2fs_sb_info *sbi, unsigned int ino)
|
|
{
|
|
return ino == F2FS_NODE_INO(sbi) || ino == F2FS_META_INO(sbi) ||
|
|
ino == F2FS_COMPRESS_INO(sbi);
|
|
}
|
|
|
|
struct inode *f2fs_iget(struct super_block *sb, unsigned long ino)
|
|
{
|
|
struct f2fs_sb_info *sbi = F2FS_SB(sb);
|
|
struct inode *inode;
|
|
int ret = 0;
|
|
|
|
inode = iget_locked(sb, ino);
|
|
if (!inode)
|
|
return ERR_PTR(-ENOMEM);
|
|
|
|
if (!(inode->i_state & I_NEW)) {
|
|
if (is_meta_ino(sbi, ino)) {
|
|
f2fs_err(sbi, "inaccessible inode: %lu, run fsck to repair", ino);
|
|
set_sbi_flag(sbi, SBI_NEED_FSCK);
|
|
ret = -EFSCORRUPTED;
|
|
trace_f2fs_iget_exit(inode, ret);
|
|
iput(inode);
|
|
f2fs_handle_error(sbi, ERROR_CORRUPTED_INODE);
|
|
return ERR_PTR(ret);
|
|
}
|
|
|
|
trace_f2fs_iget(inode);
|
|
return inode;
|
|
}
|
|
|
|
if (is_meta_ino(sbi, ino))
|
|
goto make_now;
|
|
|
|
ret = do_read_inode(inode);
|
|
if (ret)
|
|
goto bad_inode;
|
|
make_now:
|
|
if (ino == F2FS_NODE_INO(sbi)) {
|
|
inode->i_mapping->a_ops = &f2fs_node_aops;
|
|
mapping_set_gfp_mask(inode->i_mapping, GFP_NOFS);
|
|
} else if (ino == F2FS_META_INO(sbi)) {
|
|
inode->i_mapping->a_ops = &f2fs_meta_aops;
|
|
mapping_set_gfp_mask(inode->i_mapping, GFP_NOFS);
|
|
} else if (ino == F2FS_COMPRESS_INO(sbi)) {
|
|
#ifdef CONFIG_F2FS_FS_COMPRESSION
|
|
inode->i_mapping->a_ops = &f2fs_compress_aops;
|
|
/*
|
|
* generic_error_remove_folio only truncates pages of regular
|
|
* inode
|
|
*/
|
|
inode->i_mode |= S_IFREG;
|
|
#endif
|
|
mapping_set_gfp_mask(inode->i_mapping,
|
|
GFP_NOFS | __GFP_HIGHMEM | __GFP_MOVABLE);
|
|
} else if (S_ISREG(inode->i_mode)) {
|
|
inode->i_op = &f2fs_file_inode_operations;
|
|
inode->i_fop = &f2fs_file_operations;
|
|
inode->i_mapping->a_ops = &f2fs_dblock_aops;
|
|
} else if (S_ISDIR(inode->i_mode)) {
|
|
inode->i_op = &f2fs_dir_inode_operations;
|
|
inode->i_fop = &f2fs_dir_operations;
|
|
inode->i_mapping->a_ops = &f2fs_dblock_aops;
|
|
mapping_set_gfp_mask(inode->i_mapping, GFP_NOFS);
|
|
} else if (S_ISLNK(inode->i_mode)) {
|
|
if (file_is_encrypt(inode))
|
|
inode->i_op = &f2fs_encrypted_symlink_inode_operations;
|
|
else
|
|
inode->i_op = &f2fs_symlink_inode_operations;
|
|
inode_nohighmem(inode);
|
|
inode->i_mapping->a_ops = &f2fs_dblock_aops;
|
|
} else if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode) ||
|
|
S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) {
|
|
inode->i_op = &f2fs_special_inode_operations;
|
|
init_special_inode(inode, inode->i_mode, inode->i_rdev);
|
|
} else {
|
|
ret = -EIO;
|
|
goto bad_inode;
|
|
}
|
|
f2fs_set_inode_flags(inode);
|
|
|
|
unlock_new_inode(inode);
|
|
trace_f2fs_iget(inode);
|
|
return inode;
|
|
|
|
bad_inode:
|
|
f2fs_inode_synced(inode);
|
|
iget_failed(inode);
|
|
trace_f2fs_iget_exit(inode, ret);
|
|
return ERR_PTR(ret);
|
|
}
|
|
|
|
struct inode *f2fs_iget_retry(struct super_block *sb, unsigned long ino)
|
|
{
|
|
struct inode *inode;
|
|
retry:
|
|
inode = f2fs_iget(sb, ino);
|
|
if (IS_ERR(inode)) {
|
|
if (PTR_ERR(inode) == -ENOMEM) {
|
|
memalloc_retry_wait(GFP_NOFS);
|
|
goto retry;
|
|
}
|
|
}
|
|
return inode;
|
|
}
|
|
|
|
void f2fs_update_inode(struct inode *inode, struct page *node_page)
|
|
{
|
|
struct f2fs_inode_info *fi = F2FS_I(inode);
|
|
struct f2fs_inode *ri;
|
|
struct extent_tree *et = fi->extent_tree[EX_READ];
|
|
|
|
f2fs_wait_on_page_writeback(node_page, NODE, true, true);
|
|
set_page_dirty(node_page);
|
|
|
|
f2fs_inode_synced(inode);
|
|
|
|
ri = F2FS_INODE(node_page);
|
|
|
|
ri->i_mode = cpu_to_le16(inode->i_mode);
|
|
ri->i_advise = fi->i_advise;
|
|
ri->i_uid = cpu_to_le32(i_uid_read(inode));
|
|
ri->i_gid = cpu_to_le32(i_gid_read(inode));
|
|
ri->i_links = cpu_to_le32(inode->i_nlink);
|
|
ri->i_blocks = cpu_to_le64(SECTOR_TO_BLOCK(inode->i_blocks) + 1);
|
|
|
|
if (!f2fs_is_atomic_file(inode) ||
|
|
is_inode_flag_set(inode, FI_ATOMIC_COMMITTED))
|
|
ri->i_size = cpu_to_le64(i_size_read(inode));
|
|
|
|
if (et) {
|
|
read_lock(&et->lock);
|
|
set_raw_read_extent(&et->largest, &ri->i_ext);
|
|
read_unlock(&et->lock);
|
|
} else {
|
|
memset(&ri->i_ext, 0, sizeof(ri->i_ext));
|
|
}
|
|
set_raw_inline(inode, ri);
|
|
|
|
ri->i_atime = cpu_to_le64(inode_get_atime_sec(inode));
|
|
ri->i_ctime = cpu_to_le64(inode_get_ctime_sec(inode));
|
|
ri->i_mtime = cpu_to_le64(inode_get_mtime_sec(inode));
|
|
ri->i_atime_nsec = cpu_to_le32(inode_get_atime_nsec(inode));
|
|
ri->i_ctime_nsec = cpu_to_le32(inode_get_ctime_nsec(inode));
|
|
ri->i_mtime_nsec = cpu_to_le32(inode_get_mtime_nsec(inode));
|
|
if (S_ISDIR(inode->i_mode))
|
|
ri->i_current_depth = cpu_to_le32(fi->i_current_depth);
|
|
else if (S_ISREG(inode->i_mode))
|
|
ri->i_gc_failures = cpu_to_le16(fi->i_gc_failures);
|
|
ri->i_xattr_nid = cpu_to_le32(fi->i_xattr_nid);
|
|
ri->i_flags = cpu_to_le32(fi->i_flags);
|
|
ri->i_pino = cpu_to_le32(fi->i_pino);
|
|
ri->i_generation = cpu_to_le32(inode->i_generation);
|
|
ri->i_dir_level = fi->i_dir_level;
|
|
|
|
if (f2fs_has_extra_attr(inode)) {
|
|
ri->i_extra_isize = cpu_to_le16(fi->i_extra_isize);
|
|
|
|
if (f2fs_sb_has_flexible_inline_xattr(F2FS_I_SB(inode)))
|
|
ri->i_inline_xattr_size =
|
|
cpu_to_le16(fi->i_inline_xattr_size);
|
|
|
|
if (f2fs_sb_has_project_quota(F2FS_I_SB(inode)) &&
|
|
F2FS_FITS_IN_INODE(ri, fi->i_extra_isize, i_projid)) {
|
|
projid_t i_projid;
|
|
|
|
i_projid = from_kprojid(&init_user_ns, fi->i_projid);
|
|
ri->i_projid = cpu_to_le32(i_projid);
|
|
}
|
|
|
|
if (f2fs_sb_has_inode_crtime(F2FS_I_SB(inode)) &&
|
|
F2FS_FITS_IN_INODE(ri, fi->i_extra_isize, i_crtime)) {
|
|
ri->i_crtime = cpu_to_le64(fi->i_crtime.tv_sec);
|
|
ri->i_crtime_nsec = cpu_to_le32(fi->i_crtime.tv_nsec);
|
|
}
|
|
|
|
if (f2fs_sb_has_compression(F2FS_I_SB(inode)) &&
|
|
F2FS_FITS_IN_INODE(ri, fi->i_extra_isize,
|
|
i_compress_flag)) {
|
|
unsigned short compress_flag;
|
|
|
|
ri->i_compr_blocks = cpu_to_le64(
|
|
atomic_read(&fi->i_compr_blocks));
|
|
ri->i_compress_algorithm = fi->i_compress_algorithm;
|
|
compress_flag = fi->i_compress_flag |
|
|
fi->i_compress_level <<
|
|
COMPRESS_LEVEL_OFFSET;
|
|
ri->i_compress_flag = cpu_to_le16(compress_flag);
|
|
ri->i_log_cluster_size = fi->i_log_cluster_size;
|
|
}
|
|
}
|
|
|
|
__set_inode_rdev(inode, node_page);
|
|
|
|
/* deleted inode */
|
|
if (inode->i_nlink == 0)
|
|
clear_page_private_inline(node_page);
|
|
|
|
init_idisk_time(inode);
|
|
#ifdef CONFIG_F2FS_CHECK_FS
|
|
f2fs_inode_chksum_set(F2FS_I_SB(inode), node_page);
|
|
#endif
|
|
}
|
|
|
|
void f2fs_update_inode_page(struct inode *inode)
|
|
{
|
|
struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
|
|
struct page *node_page;
|
|
int count = 0;
|
|
retry:
|
|
node_page = f2fs_get_node_page(sbi, inode->i_ino);
|
|
if (IS_ERR(node_page)) {
|
|
int err = PTR_ERR(node_page);
|
|
|
|
/* The node block was truncated. */
|
|
if (err == -ENOENT)
|
|
return;
|
|
|
|
if (err == -EFSCORRUPTED)
|
|
goto stop_checkpoint;
|
|
|
|
if (err == -ENOMEM || ++count <= DEFAULT_RETRY_IO_COUNT)
|
|
goto retry;
|
|
stop_checkpoint:
|
|
f2fs_stop_checkpoint(sbi, false, STOP_CP_REASON_UPDATE_INODE);
|
|
return;
|
|
}
|
|
f2fs_update_inode(inode, node_page);
|
|
f2fs_put_page(node_page, 1);
|
|
}
|
|
|
|
int f2fs_write_inode(struct inode *inode, struct writeback_control *wbc)
|
|
{
|
|
struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
|
|
|
|
if (inode->i_ino == F2FS_NODE_INO(sbi) ||
|
|
inode->i_ino == F2FS_META_INO(sbi))
|
|
return 0;
|
|
|
|
/*
|
|
* atime could be updated without dirtying f2fs inode in lazytime mode
|
|
*/
|
|
if (f2fs_is_time_consistent(inode) &&
|
|
!is_inode_flag_set(inode, FI_DIRTY_INODE))
|
|
return 0;
|
|
|
|
/*
|
|
* no need to update inode page, ultimately f2fs_evict_inode() will
|
|
* clear dirty status of inode.
|
|
*/
|
|
if (f2fs_cp_error(sbi))
|
|
return -EIO;
|
|
|
|
if (!f2fs_is_checkpoint_ready(sbi)) {
|
|
f2fs_mark_inode_dirty_sync(inode, true);
|
|
return -ENOSPC;
|
|
}
|
|
|
|
/*
|
|
* We need to balance fs here to prevent from producing dirty node pages
|
|
* during the urgent cleaning time when running out of free sections.
|
|
*/
|
|
f2fs_update_inode_page(inode);
|
|
if (wbc && wbc->nr_to_write)
|
|
f2fs_balance_fs(sbi, true);
|
|
return 0;
|
|
}
|
|
|
|
/*
|
|
* Called at the last iput() if i_nlink is zero
|
|
*/
|
|
void f2fs_evict_inode(struct inode *inode)
|
|
{
|
|
struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
|
|
struct f2fs_inode_info *fi = F2FS_I(inode);
|
|
nid_t xnid = fi->i_xattr_nid;
|
|
int err = 0;
|
|
bool freeze_protected = false;
|
|
|
|
f2fs_abort_atomic_write(inode, true);
|
|
|
|
if (fi->cow_inode && f2fs_is_cow_file(fi->cow_inode)) {
|
|
clear_inode_flag(fi->cow_inode, FI_COW_FILE);
|
|
F2FS_I(fi->cow_inode)->atomic_inode = NULL;
|
|
iput(fi->cow_inode);
|
|
fi->cow_inode = NULL;
|
|
}
|
|
|
|
trace_f2fs_evict_inode(inode);
|
|
truncate_inode_pages_final(&inode->i_data);
|
|
|
|
if ((inode->i_nlink || is_bad_inode(inode)) &&
|
|
test_opt(sbi, COMPRESS_CACHE) && f2fs_compressed_file(inode))
|
|
f2fs_invalidate_compress_pages(sbi, inode->i_ino);
|
|
|
|
if (inode->i_ino == F2FS_NODE_INO(sbi) ||
|
|
inode->i_ino == F2FS_META_INO(sbi) ||
|
|
inode->i_ino == F2FS_COMPRESS_INO(sbi))
|
|
goto out_clear;
|
|
|
|
f2fs_bug_on(sbi, get_dirty_pages(inode));
|
|
f2fs_remove_dirty_inode(inode);
|
|
|
|
f2fs_destroy_extent_tree(inode);
|
|
|
|
if (inode->i_nlink || is_bad_inode(inode))
|
|
goto no_delete;
|
|
|
|
err = f2fs_dquot_initialize(inode);
|
|
if (err) {
|
|
err = 0;
|
|
set_sbi_flag(sbi, SBI_QUOTA_NEED_REPAIR);
|
|
}
|
|
|
|
f2fs_remove_ino_entry(sbi, inode->i_ino, APPEND_INO);
|
|
f2fs_remove_ino_entry(sbi, inode->i_ino, UPDATE_INO);
|
|
f2fs_remove_ino_entry(sbi, inode->i_ino, FLUSH_INO);
|
|
|
|
if (!is_sbi_flag_set(sbi, SBI_IS_FREEZING)) {
|
|
sb_start_intwrite(inode->i_sb);
|
|
freeze_protected = true;
|
|
}
|
|
set_inode_flag(inode, FI_NO_ALLOC);
|
|
i_size_write(inode, 0);
|
|
retry:
|
|
if (F2FS_HAS_BLOCKS(inode))
|
|
err = f2fs_truncate(inode);
|
|
|
|
if (time_to_inject(sbi, FAULT_EVICT_INODE))
|
|
err = -EIO;
|
|
|
|
if (!err) {
|
|
f2fs_lock_op(sbi);
|
|
err = f2fs_remove_inode_page(inode);
|
|
f2fs_unlock_op(sbi);
|
|
if (err == -ENOENT) {
|
|
err = 0;
|
|
|
|
/*
|
|
* in fuzzed image, another node may has the same
|
|
* block address as inode's, if it was truncated
|
|
* previously, truncation of inode node will fail.
|
|
*/
|
|
if (is_inode_flag_set(inode, FI_DIRTY_INODE)) {
|
|
f2fs_warn(F2FS_I_SB(inode),
|
|
"f2fs_evict_inode: inconsistent node id, ino:%lu",
|
|
inode->i_ino);
|
|
f2fs_inode_synced(inode);
|
|
set_sbi_flag(sbi, SBI_NEED_FSCK);
|
|
}
|
|
}
|
|
}
|
|
|
|
/* give more chances, if ENOMEM case */
|
|
if (err == -ENOMEM) {
|
|
err = 0;
|
|
goto retry;
|
|
}
|
|
|
|
if (err) {
|
|
f2fs_update_inode_page(inode);
|
|
if (dquot_initialize_needed(inode))
|
|
set_sbi_flag(sbi, SBI_QUOTA_NEED_REPAIR);
|
|
|
|
/*
|
|
* If both f2fs_truncate() and f2fs_update_inode_page() failed
|
|
* due to fuzzed corrupted inode, call f2fs_inode_synced() to
|
|
* avoid triggering later f2fs_bug_on().
|
|
*/
|
|
if (is_inode_flag_set(inode, FI_DIRTY_INODE)) {
|
|
f2fs_warn(sbi,
|
|
"f2fs_evict_inode: inode is dirty, ino:%lu",
|
|
inode->i_ino);
|
|
f2fs_inode_synced(inode);
|
|
set_sbi_flag(sbi, SBI_NEED_FSCK);
|
|
}
|
|
}
|
|
if (freeze_protected)
|
|
sb_end_intwrite(inode->i_sb);
|
|
no_delete:
|
|
dquot_drop(inode);
|
|
|
|
stat_dec_inline_xattr(inode);
|
|
stat_dec_inline_dir(inode);
|
|
stat_dec_inline_inode(inode);
|
|
stat_dec_compr_inode(inode);
|
|
stat_sub_compr_blocks(inode,
|
|
atomic_read(&fi->i_compr_blocks));
|
|
|
|
if (likely(!f2fs_cp_error(sbi) &&
|
|
!is_sbi_flag_set(sbi, SBI_CP_DISABLED)))
|
|
f2fs_bug_on(sbi, is_inode_flag_set(inode, FI_DIRTY_INODE));
|
|
|
|
/*
|
|
* anyway, it needs to remove the inode from sbi->inode_list[DIRTY_META]
|
|
* list to avoid UAF in f2fs_sync_inode_meta() during checkpoint.
|
|
*/
|
|
f2fs_inode_synced(inode);
|
|
|
|
/* for the case f2fs_new_inode() was failed, .i_ino is zero, skip it */
|
|
if (inode->i_ino)
|
|
invalidate_mapping_pages(NODE_MAPPING(sbi), inode->i_ino,
|
|
inode->i_ino);
|
|
if (xnid)
|
|
invalidate_mapping_pages(NODE_MAPPING(sbi), xnid, xnid);
|
|
if (inode->i_nlink) {
|
|
if (is_inode_flag_set(inode, FI_APPEND_WRITE))
|
|
f2fs_add_ino_entry(sbi, inode->i_ino, APPEND_INO);
|
|
if (is_inode_flag_set(inode, FI_UPDATE_WRITE))
|
|
f2fs_add_ino_entry(sbi, inode->i_ino, UPDATE_INO);
|
|
}
|
|
if (is_inode_flag_set(inode, FI_FREE_NID)) {
|
|
f2fs_alloc_nid_failed(sbi, inode->i_ino);
|
|
clear_inode_flag(inode, FI_FREE_NID);
|
|
} else {
|
|
/*
|
|
* If xattr nid is corrupted, we can reach out error condition,
|
|
* err & !f2fs_exist_written_data(sbi, inode->i_ino, ORPHAN_INO)).
|
|
* In that case, f2fs_check_nid_range() is enough to give a clue.
|
|
*/
|
|
}
|
|
out_clear:
|
|
fscrypt_put_encryption_info(inode);
|
|
fsverity_cleanup_inode(inode);
|
|
clear_inode(inode);
|
|
}
|
|
|
|
/* caller should call f2fs_lock_op() */
|
|
void f2fs_handle_failed_inode(struct inode *inode)
|
|
{
|
|
struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
|
|
struct node_info ni;
|
|
int err;
|
|
|
|
/*
|
|
* clear nlink of inode in order to release resource of inode
|
|
* immediately.
|
|
*/
|
|
clear_nlink(inode);
|
|
|
|
/*
|
|
* we must call this to avoid inode being remained as dirty, resulting
|
|
* in a panic when flushing dirty inodes in gdirty_list.
|
|
*/
|
|
f2fs_update_inode_page(inode);
|
|
f2fs_inode_synced(inode);
|
|
|
|
/* don't make bad inode, since it becomes a regular file. */
|
|
unlock_new_inode(inode);
|
|
|
|
/*
|
|
* Note: we should add inode to orphan list before f2fs_unlock_op()
|
|
* so we can prevent losing this orphan when encoutering checkpoint
|
|
* and following suddenly power-off.
|
|
*/
|
|
err = f2fs_get_node_info(sbi, inode->i_ino, &ni, false);
|
|
if (err) {
|
|
set_sbi_flag(sbi, SBI_NEED_FSCK);
|
|
set_inode_flag(inode, FI_FREE_NID);
|
|
f2fs_warn(sbi, "May loss orphan inode, run fsck to fix.");
|
|
goto out;
|
|
}
|
|
|
|
if (ni.blk_addr != NULL_ADDR) {
|
|
err = f2fs_acquire_orphan_inode(sbi);
|
|
if (err) {
|
|
set_sbi_flag(sbi, SBI_NEED_FSCK);
|
|
f2fs_warn(sbi, "Too many orphan inodes, run fsck to fix.");
|
|
} else {
|
|
f2fs_add_orphan_inode(inode);
|
|
}
|
|
f2fs_alloc_nid_done(sbi, inode->i_ino);
|
|
} else {
|
|
set_inode_flag(inode, FI_FREE_NID);
|
|
}
|
|
|
|
out:
|
|
f2fs_unlock_op(sbi);
|
|
|
|
/* iput will drop the inode object */
|
|
iput(inode);
|
|
}
|