linux-xfs.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH v3 00/10] xfs: strengthen log intent validation
@ 2020-12-06 23:09 Darrick J. Wong
  2020-12-06 23:09 ` [PATCH 01/10] xfs: hoist recovered bmap intent checks out of xfs_bui_item_recover Darrick J. Wong
                   ` (9 more replies)
  0 siblings, 10 replies; 19+ messages in thread
From: Darrick J. Wong @ 2020-12-06 23:09 UTC (permalink / raw)
  To: darrick.wong; +Cc: Christoph Hellwig, Brian Foster, linux-xfs, bfoster

Hi all,

This patchset hoists the code that checks log intent record validation
into separate functions, and reworks them to use the standard field
validation predicates instead of open-coding them.  This strengthens log
recovery against (some) fuzzed log items.

v2: rearrange some of the checks per hch; report intent item corruption
v3: call XFS_CORRUPTION_ERROR to dump the bad intent item to dmesg

If you're going to start using this mess, you probably ought to just
pull from my git trees, which are linked below.

This is an extraordinary way to destroy everything.  Enjoy!
Comments and questions are, as always, welcome.

--D

kernel git tree:
https://git.kernel.org/cgit/linux/kernel/git/djwong/xfs-linux.git/log/?h=fix-recovered-log-intent-validation-5.11
---
 fs/xfs/xfs_bmap_item.c     |   78 +++++++++++++++++++++++++++++---------------
 fs/xfs/xfs_extfree_item.c  |   32 ++++++++++++++----
 fs/xfs/xfs_log_recover.c   |    5 ++-
 fs/xfs/xfs_refcount_item.c |   61 +++++++++++++++++++++++-----------
 fs/xfs/xfs_rmap_item.c     |   76 +++++++++++++++++++++++++++++--------------
 fs/xfs/xfs_trace.h         |   18 ++++++++++
 6 files changed, 188 insertions(+), 82 deletions(-)


^ permalink raw reply	[flat|nested] 19+ messages in thread

* [PATCH 01/10] xfs: hoist recovered bmap intent checks out of xfs_bui_item_recover
  2020-12-06 23:09 [PATCH v3 00/10] xfs: strengthen log intent validation Darrick J. Wong
@ 2020-12-06 23:09 ` Darrick J. Wong
  2020-12-06 23:09 ` [PATCH 02/10] xfs: improve the code that checks recovered bmap intent items Darrick J. Wong
                   ` (8 subsequent siblings)
  9 siblings, 0 replies; 19+ messages in thread
From: Darrick J. Wong @ 2020-12-06 23:09 UTC (permalink / raw)
  To: darrick.wong; +Cc: Christoph Hellwig, Brian Foster, linux-xfs, bfoster

From: Darrick J. Wong <darrick.wong@oracle.com>

When we recover a bmap intent from the log, we need to validate its
contents before we try to replay them.  Hoist the checking code into a
separate function in preparation to refactor this code to use validation
helpers.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Brian Foster <bfoster@redhat.com>
---
 fs/xfs/xfs_bmap_item.c |   74 ++++++++++++++++++++++++++++++------------------
 1 file changed, 47 insertions(+), 27 deletions(-)


diff --git a/fs/xfs/xfs_bmap_item.c b/fs/xfs/xfs_bmap_item.c
index 9e16a4d0f97c..9be61feca65b 100644
--- a/fs/xfs/xfs_bmap_item.c
+++ b/fs/xfs/xfs_bmap_item.c
@@ -417,6 +417,49 @@ const struct xfs_defer_op_type xfs_bmap_update_defer_type = {
 	.cancel_item	= xfs_bmap_update_cancel_item,
 };
 
+/* Is this recovered BUI ok? */
+static inline bool
+xfs_bui_validate(
+	struct xfs_mount		*mp,
+	struct xfs_bui_log_item		*buip)
+{
+	struct xfs_map_extent		*bmap;
+	xfs_fsblock_t			startblock_fsb;
+	xfs_fsblock_t			inode_fsb;
+
+	/* Only one mapping operation per BUI... */
+	if (buip->bui_format.bui_nextents != XFS_BUI_MAX_FAST_EXTENTS)
+		return false;
+
+	bmap = &buip->bui_format.bui_extents[0];
+	startblock_fsb = XFS_BB_TO_FSB(mp,
+			XFS_FSB_TO_DADDR(mp, bmap->me_startblock));
+	inode_fsb = XFS_BB_TO_FSB(mp, XFS_FSB_TO_DADDR(mp,
+			XFS_INO_TO_FSB(mp, bmap->me_owner)));
+
+	if (bmap->me_flags & ~XFS_BMAP_EXTENT_FLAGS)
+		return false;
+
+	switch (bmap->me_flags & XFS_BMAP_EXTENT_TYPE_MASK) {
+	case XFS_BMAP_MAP:
+	case XFS_BMAP_UNMAP:
+		break;
+	default:
+		return false;
+	}
+
+	if (startblock_fsb == 0 ||
+	    bmap->me_len == 0 ||
+	    inode_fsb == 0 ||
+	    startblock_fsb >= mp->m_sb.sb_dblocks ||
+	    bmap->me_len >= mp->m_sb.sb_agblocks ||
+	    inode_fsb >= mp->m_sb.sb_dblocks ||
+	    (bmap->me_flags & ~XFS_BMAP_EXTENT_FLAGS))
+		return false;
+
+	return true;
+}
+
 /*
  * Process a bmap update intent item that was recovered from the log.
  * We need to update some inode's bmbt.
@@ -433,47 +476,24 @@ xfs_bui_item_recover(
 	struct xfs_mount		*mp = lip->li_mountp;
 	struct xfs_map_extent		*bmap;
 	struct xfs_bud_log_item		*budp;
-	xfs_fsblock_t			startblock_fsb;
-	xfs_fsblock_t			inode_fsb;
 	xfs_filblks_t			count;
 	xfs_exntst_t			state;
 	unsigned int			bui_type;
 	int				whichfork;
 	int				error = 0;
 
-	/* Only one mapping operation per BUI... */
-	if (buip->bui_format.bui_nextents != XFS_BUI_MAX_FAST_EXTENTS)
+	if (!xfs_bui_validate(mp, buip)) {
+		XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
+				&buip->bui_format, sizeof(buip->bui_format));
 		return -EFSCORRUPTED;
+	}
 
-	/*
-	 * First check the validity of the extent described by the
-	 * BUI.  If anything is bad, then toss the BUI.
-	 */
 	bmap = &buip->bui_format.bui_extents[0];
-	startblock_fsb = XFS_BB_TO_FSB(mp,
-			   XFS_FSB_TO_DADDR(mp, bmap->me_startblock));
-	inode_fsb = XFS_BB_TO_FSB(mp, XFS_FSB_TO_DADDR(mp,
-			XFS_INO_TO_FSB(mp, bmap->me_owner)));
 	state = (bmap->me_flags & XFS_BMAP_EXTENT_UNWRITTEN) ?
 			XFS_EXT_UNWRITTEN : XFS_EXT_NORM;
 	whichfork = (bmap->me_flags & XFS_BMAP_EXTENT_ATTR_FORK) ?
 			XFS_ATTR_FORK : XFS_DATA_FORK;
 	bui_type = bmap->me_flags & XFS_BMAP_EXTENT_TYPE_MASK;
-	switch (bui_type) {
-	case XFS_BMAP_MAP:
-	case XFS_BMAP_UNMAP:
-		break;
-	default:
-		return -EFSCORRUPTED;
-	}
-	if (startblock_fsb == 0 ||
-	    bmap->me_len == 0 ||
-	    inode_fsb == 0 ||
-	    startblock_fsb >= mp->m_sb.sb_dblocks ||
-	    bmap->me_len >= mp->m_sb.sb_agblocks ||
-	    inode_fsb >= mp->m_sb.sb_dblocks ||
-	    (bmap->me_flags & ~XFS_BMAP_EXTENT_FLAGS))
-		return -EFSCORRUPTED;
 
 	/* Grab the inode. */
 	error = xfs_iget(mp, NULL, bmap->me_owner, 0, 0, &ip);


^ permalink raw reply related	[flat|nested] 19+ messages in thread

* [PATCH 02/10] xfs: improve the code that checks recovered bmap intent items
  2020-12-06 23:09 [PATCH v3 00/10] xfs: strengthen log intent validation Darrick J. Wong
  2020-12-06 23:09 ` [PATCH 01/10] xfs: hoist recovered bmap intent checks out of xfs_bui_item_recover Darrick J. Wong
@ 2020-12-06 23:09 ` Darrick J. Wong
  2020-12-06 23:10 ` [PATCH 03/10] xfs: hoist recovered rmap intent checks out of xfs_rui_item_recover Darrick J. Wong
                   ` (7 subsequent siblings)
  9 siblings, 0 replies; 19+ messages in thread
From: Darrick J. Wong @ 2020-12-06 23:09 UTC (permalink / raw)
  To: darrick.wong; +Cc: Christoph Hellwig, Brian Foster, linux-xfs, bfoster

From: Darrick J. Wong <darrick.wong@oracle.com>

The code that validates recovered bmap intent items is kind of a mess --
it doesn't use the standard xfs type validators, and it doesn't check
for things that it should.  Fix the validator function to use the
standard validation helpers and look for more types of obvious errors.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Brian Foster <bfoster@redhat.com>
---
 fs/xfs/xfs_bmap_item.c |   26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)


diff --git a/fs/xfs/xfs_bmap_item.c b/fs/xfs/xfs_bmap_item.c
index 9be61feca65b..a21a9f71c0c0 100644
--- a/fs/xfs/xfs_bmap_item.c
+++ b/fs/xfs/xfs_bmap_item.c
@@ -424,18 +424,12 @@ xfs_bui_validate(
 	struct xfs_bui_log_item		*buip)
 {
 	struct xfs_map_extent		*bmap;
-	xfs_fsblock_t			startblock_fsb;
-	xfs_fsblock_t			inode_fsb;
 
 	/* Only one mapping operation per BUI... */
 	if (buip->bui_format.bui_nextents != XFS_BUI_MAX_FAST_EXTENTS)
 		return false;
 
 	bmap = &buip->bui_format.bui_extents[0];
-	startblock_fsb = XFS_BB_TO_FSB(mp,
-			XFS_FSB_TO_DADDR(mp, bmap->me_startblock));
-	inode_fsb = XFS_BB_TO_FSB(mp, XFS_FSB_TO_DADDR(mp,
-			XFS_INO_TO_FSB(mp, bmap->me_owner)));
 
 	if (bmap->me_flags & ~XFS_BMAP_EXTENT_FLAGS)
 		return false;
@@ -448,13 +442,19 @@ xfs_bui_validate(
 		return false;
 	}
 
-	if (startblock_fsb == 0 ||
-	    bmap->me_len == 0 ||
-	    inode_fsb == 0 ||
-	    startblock_fsb >= mp->m_sb.sb_dblocks ||
-	    bmap->me_len >= mp->m_sb.sb_agblocks ||
-	    inode_fsb >= mp->m_sb.sb_dblocks ||
-	    (bmap->me_flags & ~XFS_BMAP_EXTENT_FLAGS))
+	if (!xfs_verify_ino(mp, bmap->me_owner))
+		return false;
+
+	if (bmap->me_startoff + bmap->me_len <= bmap->me_startoff)
+		return false;
+
+	if (bmap->me_startblock + bmap->me_len <= bmap->me_startblock)
+		return false;
+
+	if (!xfs_verify_fsbno(mp, bmap->me_startblock))
+		return false;
+
+	if (!xfs_verify_fsbno(mp, bmap->me_startblock + bmap->me_len - 1))
 		return false;
 
 	return true;


^ permalink raw reply related	[flat|nested] 19+ messages in thread

* [PATCH 03/10] xfs: hoist recovered rmap intent checks out of xfs_rui_item_recover
  2020-12-06 23:09 [PATCH v3 00/10] xfs: strengthen log intent validation Darrick J. Wong
  2020-12-06 23:09 ` [PATCH 01/10] xfs: hoist recovered bmap intent checks out of xfs_bui_item_recover Darrick J. Wong
  2020-12-06 23:09 ` [PATCH 02/10] xfs: improve the code that checks recovered bmap intent items Darrick J. Wong
@ 2020-12-06 23:10 ` Darrick J. Wong
  2020-12-06 23:10 ` [PATCH 04/10] xfs: improve the code that checks recovered rmap intent items Darrick J. Wong
                   ` (6 subsequent siblings)
  9 siblings, 0 replies; 19+ messages in thread
From: Darrick J. Wong @ 2020-12-06 23:10 UTC (permalink / raw)
  To: darrick.wong; +Cc: Christoph Hellwig, Brian Foster, linux-xfs, bfoster

From: Darrick J. Wong <darrick.wong@oracle.com>

When we recover a rmap intent from the log, we need to validate its
contents before we try to replay them.  Hoist the checking code into a
separate function in preparation to refactor this code to use validation
helpers.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Brian Foster <bfoster@redhat.com>
---
 fs/xfs/xfs_rmap_item.c |   67 ++++++++++++++++++++++++++++++------------------
 1 file changed, 42 insertions(+), 25 deletions(-)


diff --git a/fs/xfs/xfs_rmap_item.c b/fs/xfs/xfs_rmap_item.c
index 7adc996ca6e3..19d2dc285ed6 100644
--- a/fs/xfs/xfs_rmap_item.c
+++ b/fs/xfs/xfs_rmap_item.c
@@ -460,6 +460,42 @@ const struct xfs_defer_op_type xfs_rmap_update_defer_type = {
 	.cancel_item	= xfs_rmap_update_cancel_item,
 };
 
+/* Is this recovered RUI ok? */
+static inline bool
+xfs_rui_validate_map(
+	struct xfs_mount		*mp,
+	struct xfs_map_extent		*rmap)
+{
+	xfs_fsblock_t			startblock_fsb;
+	bool				op_ok;
+
+	startblock_fsb = XFS_BB_TO_FSB(mp,
+			   XFS_FSB_TO_DADDR(mp, rmap->me_startblock));
+	switch (rmap->me_flags & XFS_RMAP_EXTENT_TYPE_MASK) {
+	case XFS_RMAP_EXTENT_MAP:
+	case XFS_RMAP_EXTENT_MAP_SHARED:
+	case XFS_RMAP_EXTENT_UNMAP:
+	case XFS_RMAP_EXTENT_UNMAP_SHARED:
+	case XFS_RMAP_EXTENT_CONVERT:
+	case XFS_RMAP_EXTENT_CONVERT_SHARED:
+	case XFS_RMAP_EXTENT_ALLOC:
+	case XFS_RMAP_EXTENT_FREE:
+		op_ok = true;
+		break;
+	default:
+		op_ok = false;
+		break;
+	}
+	if (!op_ok || startblock_fsb == 0 ||
+	    rmap->me_len == 0 ||
+	    startblock_fsb >= mp->m_sb.sb_dblocks ||
+	    rmap->me_len >= mp->m_sb.sb_agblocks ||
+	    (rmap->me_flags & ~XFS_RMAP_EXTENT_FLAGS))
+		return false;
+
+	return true;
+}
+
 /*
  * Process an rmap update intent item that was recovered from the log.
  * We need to update the rmapbt.
@@ -475,10 +511,8 @@ xfs_rui_item_recover(
 	struct xfs_trans		*tp;
 	struct xfs_btree_cur		*rcur = NULL;
 	struct xfs_mount		*mp = lip->li_mountp;
-	xfs_fsblock_t			startblock_fsb;
 	enum xfs_rmap_intent_type	type;
 	xfs_exntst_t			state;
-	bool				op_ok;
 	int				i;
 	int				whichfork;
 	int				error = 0;
@@ -489,30 +523,13 @@ xfs_rui_item_recover(
 	 * just toss the RUI.
 	 */
 	for (i = 0; i < ruip->rui_format.rui_nextents; i++) {
-		rmap = &ruip->rui_format.rui_extents[i];
-		startblock_fsb = XFS_BB_TO_FSB(mp,
-				   XFS_FSB_TO_DADDR(mp, rmap->me_startblock));
-		switch (rmap->me_flags & XFS_RMAP_EXTENT_TYPE_MASK) {
-		case XFS_RMAP_EXTENT_MAP:
-		case XFS_RMAP_EXTENT_MAP_SHARED:
-		case XFS_RMAP_EXTENT_UNMAP:
-		case XFS_RMAP_EXTENT_UNMAP_SHARED:
-		case XFS_RMAP_EXTENT_CONVERT:
-		case XFS_RMAP_EXTENT_CONVERT_SHARED:
-		case XFS_RMAP_EXTENT_ALLOC:
-		case XFS_RMAP_EXTENT_FREE:
-			op_ok = true;
-			break;
-		default:
-			op_ok = false;
-			break;
-		}
-		if (!op_ok || startblock_fsb == 0 ||
-		    rmap->me_len == 0 ||
-		    startblock_fsb >= mp->m_sb.sb_dblocks ||
-		    rmap->me_len >= mp->m_sb.sb_agblocks ||
-		    (rmap->me_flags & ~XFS_RMAP_EXTENT_FLAGS))
+		if (!xfs_rui_validate_map(mp,
+					&ruip->rui_format.rui_extents[i])) {
+			XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
+					&ruip->rui_format,
+					sizeof(ruip->rui_format));
 			return -EFSCORRUPTED;
+		}
 	}
 
 	error = xfs_trans_alloc(mp, &M_RES(mp)->tr_itruncate,


^ permalink raw reply related	[flat|nested] 19+ messages in thread

* [PATCH 04/10] xfs: improve the code that checks recovered rmap intent items
  2020-12-06 23:09 [PATCH v3 00/10] xfs: strengthen log intent validation Darrick J. Wong
                   ` (2 preceding siblings ...)
  2020-12-06 23:10 ` [PATCH 03/10] xfs: hoist recovered rmap intent checks out of xfs_rui_item_recover Darrick J. Wong
@ 2020-12-06 23:10 ` Darrick J. Wong
  2020-12-06 23:10 ` [PATCH 05/10] xfs: hoist recovered refcount intent checks out of xfs_cui_item_recover Darrick J. Wong
                   ` (5 subsequent siblings)
  9 siblings, 0 replies; 19+ messages in thread
From: Darrick J. Wong @ 2020-12-06 23:10 UTC (permalink / raw)
  To: darrick.wong; +Cc: Brian Foster, linux-xfs, bfoster

From: Darrick J. Wong <darrick.wong@oracle.com>

The code that validates recovered rmap intent items is kind of a mess --
it doesn't use the standard xfs type validators, and it doesn't check
for things that it should.  Fix the validator function to use the
standard validation helpers and look for more types of obvious errors.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
---
 fs/xfs/xfs_rmap_item.c |   30 ++++++++++++++++++------------
 1 file changed, 18 insertions(+), 12 deletions(-)


diff --git a/fs/xfs/xfs_rmap_item.c b/fs/xfs/xfs_rmap_item.c
index 19d2dc285ed6..6f3250a22093 100644
--- a/fs/xfs/xfs_rmap_item.c
+++ b/fs/xfs/xfs_rmap_item.c
@@ -466,11 +466,9 @@ xfs_rui_validate_map(
 	struct xfs_mount		*mp,
 	struct xfs_map_extent		*rmap)
 {
-	xfs_fsblock_t			startblock_fsb;
-	bool				op_ok;
+	if (rmap->me_flags & ~XFS_RMAP_EXTENT_FLAGS)
+		return false;
 
-	startblock_fsb = XFS_BB_TO_FSB(mp,
-			   XFS_FSB_TO_DADDR(mp, rmap->me_startblock));
 	switch (rmap->me_flags & XFS_RMAP_EXTENT_TYPE_MASK) {
 	case XFS_RMAP_EXTENT_MAP:
 	case XFS_RMAP_EXTENT_MAP_SHARED:
@@ -480,17 +478,25 @@ xfs_rui_validate_map(
 	case XFS_RMAP_EXTENT_CONVERT_SHARED:
 	case XFS_RMAP_EXTENT_ALLOC:
 	case XFS_RMAP_EXTENT_FREE:
-		op_ok = true;
 		break;
 	default:
-		op_ok = false;
-		break;
+		return false;
 	}
-	if (!op_ok || startblock_fsb == 0 ||
-	    rmap->me_len == 0 ||
-	    startblock_fsb >= mp->m_sb.sb_dblocks ||
-	    rmap->me_len >= mp->m_sb.sb_agblocks ||
-	    (rmap->me_flags & ~XFS_RMAP_EXTENT_FLAGS))
+
+	if (!XFS_RMAP_NON_INODE_OWNER(rmap->me_owner) &&
+	    !xfs_verify_ino(mp, rmap->me_owner))
+		return false;
+
+	if (rmap->me_startoff + rmap->me_len <= rmap->me_startoff)
+		return false;
+
+	if (rmap->me_startblock + rmap->me_len <= rmap->me_startblock)
+		return false;
+
+	if (!xfs_verify_fsbno(mp, rmap->me_startblock))
+		return false;
+
+	if (!xfs_verify_fsbno(mp, rmap->me_startblock + rmap->me_len - 1))
 		return false;
 
 	return true;


^ permalink raw reply related	[flat|nested] 19+ messages in thread

* [PATCH 05/10] xfs: hoist recovered refcount intent checks out of xfs_cui_item_recover
  2020-12-06 23:09 [PATCH v3 00/10] xfs: strengthen log intent validation Darrick J. Wong
                   ` (3 preceding siblings ...)
  2020-12-06 23:10 ` [PATCH 04/10] xfs: improve the code that checks recovered rmap intent items Darrick J. Wong
@ 2020-12-06 23:10 ` Darrick J. Wong
  2020-12-06 23:10 ` [PATCH 06/10] xfs: improve the code that checks recovered refcount intent items Darrick J. Wong
                   ` (4 subsequent siblings)
  9 siblings, 0 replies; 19+ messages in thread
From: Darrick J. Wong @ 2020-12-06 23:10 UTC (permalink / raw)
  To: darrick.wong; +Cc: Christoph Hellwig, Brian Foster, linux-xfs, bfoster

From: Darrick J. Wong <darrick.wong@oracle.com>

When we recover a refcount intent from the log, we need to validate its
contents before we try to replay them.  Hoist the checking code into a
separate function in preparation to refactor this code to use validation
helpers.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Brian Foster <bfoster@redhat.com>
---
 fs/xfs/xfs_refcount_item.c |   59 ++++++++++++++++++++++++++++----------------
 1 file changed, 38 insertions(+), 21 deletions(-)


diff --git a/fs/xfs/xfs_refcount_item.c b/fs/xfs/xfs_refcount_item.c
index 7529eb63ce94..e19f96c9b93a 100644
--- a/fs/xfs/xfs_refcount_item.c
+++ b/fs/xfs/xfs_refcount_item.c
@@ -417,6 +417,38 @@ const struct xfs_defer_op_type xfs_refcount_update_defer_type = {
 	.cancel_item	= xfs_refcount_update_cancel_item,
 };
 
+/* Is this recovered CUI ok? */
+static inline bool
+xfs_cui_validate_phys(
+	struct xfs_mount		*mp,
+	struct xfs_phys_extent		*refc)
+{
+	xfs_fsblock_t			startblock_fsb;
+	bool				op_ok;
+
+	startblock_fsb = XFS_BB_TO_FSB(mp,
+			   XFS_FSB_TO_DADDR(mp, refc->pe_startblock));
+	switch (refc->pe_flags & XFS_REFCOUNT_EXTENT_TYPE_MASK) {
+	case XFS_REFCOUNT_INCREASE:
+	case XFS_REFCOUNT_DECREASE:
+	case XFS_REFCOUNT_ALLOC_COW:
+	case XFS_REFCOUNT_FREE_COW:
+		op_ok = true;
+		break;
+	default:
+		op_ok = false;
+		break;
+	}
+	if (!op_ok || startblock_fsb == 0 ||
+	    refc->pe_len == 0 ||
+	    startblock_fsb >= mp->m_sb.sb_dblocks ||
+	    refc->pe_len >= mp->m_sb.sb_agblocks ||
+	    (refc->pe_flags & ~XFS_REFCOUNT_EXTENT_FLAGS))
+		return false;
+
+	return true;
+}
+
 /*
  * Process a refcount update intent item that was recovered from the log.
  * We need to update the refcountbt.
@@ -433,11 +465,9 @@ xfs_cui_item_recover(
 	struct xfs_trans		*tp;
 	struct xfs_btree_cur		*rcur = NULL;
 	struct xfs_mount		*mp = lip->li_mountp;
-	xfs_fsblock_t			startblock_fsb;
 	xfs_fsblock_t			new_fsb;
 	xfs_extlen_t			new_len;
 	unsigned int			refc_type;
-	bool				op_ok;
 	bool				requeue_only = false;
 	enum xfs_refcount_intent_type	type;
 	int				i;
@@ -449,26 +479,13 @@ xfs_cui_item_recover(
 	 * just toss the CUI.
 	 */
 	for (i = 0; i < cuip->cui_format.cui_nextents; i++) {
-		refc = &cuip->cui_format.cui_extents[i];
-		startblock_fsb = XFS_BB_TO_FSB(mp,
-				   XFS_FSB_TO_DADDR(mp, refc->pe_startblock));
-		switch (refc->pe_flags & XFS_REFCOUNT_EXTENT_TYPE_MASK) {
-		case XFS_REFCOUNT_INCREASE:
-		case XFS_REFCOUNT_DECREASE:
-		case XFS_REFCOUNT_ALLOC_COW:
-		case XFS_REFCOUNT_FREE_COW:
-			op_ok = true;
-			break;
-		default:
-			op_ok = false;
-			break;
-		}
-		if (!op_ok || startblock_fsb == 0 ||
-		    refc->pe_len == 0 ||
-		    startblock_fsb >= mp->m_sb.sb_dblocks ||
-		    refc->pe_len >= mp->m_sb.sb_agblocks ||
-		    (refc->pe_flags & ~XFS_REFCOUNT_EXTENT_FLAGS))
+		if (!xfs_cui_validate_phys(mp,
+					&cuip->cui_format.cui_extents[i])) {
+			XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
+					&cuip->cui_format,
+					sizeof(cuip->cui_format));
 			return -EFSCORRUPTED;
+		}
 	}
 
 	/*


^ permalink raw reply related	[flat|nested] 19+ messages in thread

* [PATCH 06/10] xfs: improve the code that checks recovered refcount intent items
  2020-12-06 23:09 [PATCH v3 00/10] xfs: strengthen log intent validation Darrick J. Wong
                   ` (4 preceding siblings ...)
  2020-12-06 23:10 ` [PATCH 05/10] xfs: hoist recovered refcount intent checks out of xfs_cui_item_recover Darrick J. Wong
@ 2020-12-06 23:10 ` Darrick J. Wong
  2020-12-06 23:10 ` [PATCH 07/10] xfs: hoist recovered extent-free intent checks out of xfs_efi_item_recover Darrick J. Wong
                   ` (3 subsequent siblings)
  9 siblings, 0 replies; 19+ messages in thread
From: Darrick J. Wong @ 2020-12-06 23:10 UTC (permalink / raw)
  To: darrick.wong; +Cc: Christoph Hellwig, Brian Foster, linux-xfs, bfoster

From: Darrick J. Wong <darrick.wong@oracle.com>

The code that validates recovered refcount intent items is kind of a
mess -- it doesn't use the standard xfs type validators, and it doesn't
check for things that it should.  Fix the validator function to use the
standard validation helpers and look for more types of obvious errors.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Brian Foster <bfoster@redhat.com>
---
 fs/xfs/xfs_refcount_item.c |   23 +++++++++++------------
 1 file changed, 11 insertions(+), 12 deletions(-)


diff --git a/fs/xfs/xfs_refcount_item.c b/fs/xfs/xfs_refcount_item.c
index e19f96c9b93a..c24f2da0f795 100644
--- a/fs/xfs/xfs_refcount_item.c
+++ b/fs/xfs/xfs_refcount_item.c
@@ -423,27 +423,26 @@ xfs_cui_validate_phys(
 	struct xfs_mount		*mp,
 	struct xfs_phys_extent		*refc)
 {
-	xfs_fsblock_t			startblock_fsb;
-	bool				op_ok;
+	if (refc->pe_flags & ~XFS_REFCOUNT_EXTENT_FLAGS)
+		return false;
 
-	startblock_fsb = XFS_BB_TO_FSB(mp,
-			   XFS_FSB_TO_DADDR(mp, refc->pe_startblock));
 	switch (refc->pe_flags & XFS_REFCOUNT_EXTENT_TYPE_MASK) {
 	case XFS_REFCOUNT_INCREASE:
 	case XFS_REFCOUNT_DECREASE:
 	case XFS_REFCOUNT_ALLOC_COW:
 	case XFS_REFCOUNT_FREE_COW:
-		op_ok = true;
 		break;
 	default:
-		op_ok = false;
-		break;
+		return false;
 	}
-	if (!op_ok || startblock_fsb == 0 ||
-	    refc->pe_len == 0 ||
-	    startblock_fsb >= mp->m_sb.sb_dblocks ||
-	    refc->pe_len >= mp->m_sb.sb_agblocks ||
-	    (refc->pe_flags & ~XFS_REFCOUNT_EXTENT_FLAGS))
+
+	if (refc->pe_startblock + refc->pe_len <= refc->pe_startblock)
+		return false;
+
+	if (!xfs_verify_fsbno(mp, refc->pe_startblock))
+		return false;
+
+	if (!xfs_verify_fsbno(mp, refc->pe_startblock + refc->pe_len - 1))
 		return false;
 
 	return true;


^ permalink raw reply related	[flat|nested] 19+ messages in thread

* [PATCH 07/10] xfs: hoist recovered extent-free intent checks out of xfs_efi_item_recover
  2020-12-06 23:09 [PATCH v3 00/10] xfs: strengthen log intent validation Darrick J. Wong
                   ` (5 preceding siblings ...)
  2020-12-06 23:10 ` [PATCH 06/10] xfs: improve the code that checks recovered refcount intent items Darrick J. Wong
@ 2020-12-06 23:10 ` Darrick J. Wong
  2020-12-06 23:10 ` [PATCH 08/10] xfs: improve the code that checks recovered extent-free intent items Darrick J. Wong
                   ` (2 subsequent siblings)
  9 siblings, 0 replies; 19+ messages in thread
From: Darrick J. Wong @ 2020-12-06 23:10 UTC (permalink / raw)
  To: darrick.wong; +Cc: Christoph Hellwig, Brian Foster, linux-xfs, bfoster

From: Darrick J. Wong <darrick.wong@oracle.com>

When we recover a extent-free intent from the log, we need to validate
its contents before we try to replay them.  Hoist the checking code into
a separate function in preparation to refactor this code to use
validation helpers.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Brian Foster <bfoster@redhat.com>
---
 fs/xfs/xfs_extfree_item.c |   33 +++++++++++++++++++++++++--------
 1 file changed, 25 insertions(+), 8 deletions(-)


diff --git a/fs/xfs/xfs_extfree_item.c b/fs/xfs/xfs_extfree_item.c
index 6c11bfc3d452..f86c8a7c9c4e 100644
--- a/fs/xfs/xfs_extfree_item.c
+++ b/fs/xfs/xfs_extfree_item.c
@@ -578,6 +578,25 @@ const struct xfs_defer_op_type xfs_agfl_free_defer_type = {
 	.cancel_item	= xfs_extent_free_cancel_item,
 };
 
+/* Is this recovered EFI ok? */
+static inline bool
+xfs_efi_validate_ext(
+	struct xfs_mount		*mp,
+	struct xfs_extent		*extp)
+{
+	xfs_fsblock_t			startblock_fsb;
+
+	startblock_fsb = XFS_BB_TO_FSB(mp,
+			   XFS_FSB_TO_DADDR(mp, extp->ext_start));
+	if (startblock_fsb == 0 ||
+	    extp->ext_len == 0 ||
+	    startblock_fsb >= mp->m_sb.sb_dblocks ||
+	    extp->ext_len >= mp->m_sb.sb_agblocks)
+		return false;
+
+	return true;
+}
+
 /*
  * Process an extent free intent item that was recovered from
  * the log.  We need to free the extents that it describes.
@@ -592,7 +611,6 @@ xfs_efi_item_recover(
 	struct xfs_efd_log_item		*efdp;
 	struct xfs_trans		*tp;
 	struct xfs_extent		*extp;
-	xfs_fsblock_t			startblock_fsb;
 	int				i;
 	int				error = 0;
 
@@ -602,14 +620,13 @@ xfs_efi_item_recover(
 	 * just toss the EFI.
 	 */
 	for (i = 0; i < efip->efi_format.efi_nextents; i++) {
-		extp = &efip->efi_format.efi_extents[i];
-		startblock_fsb = XFS_BB_TO_FSB(mp,
-				   XFS_FSB_TO_DADDR(mp, extp->ext_start));
-		if (startblock_fsb == 0 ||
-		    extp->ext_len == 0 ||
-		    startblock_fsb >= mp->m_sb.sb_dblocks ||
-		    extp->ext_len >= mp->m_sb.sb_agblocks)
+		if (!xfs_efi_validate_ext(mp,
+					&efip->efi_format.efi_extents[i])) {
+			XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
+					&efip->efi_format,
+					sizeof(efip->efi_format));
 			return -EFSCORRUPTED;
+		}
 	}
 
 	error = xfs_trans_alloc(mp, &M_RES(mp)->tr_itruncate, 0, 0, 0, &tp);


^ permalink raw reply related	[flat|nested] 19+ messages in thread

* [PATCH 08/10] xfs: improve the code that checks recovered extent-free intent items
  2020-12-06 23:09 [PATCH v3 00/10] xfs: strengthen log intent validation Darrick J. Wong
                   ` (6 preceding siblings ...)
  2020-12-06 23:10 ` [PATCH 07/10] xfs: hoist recovered extent-free intent checks out of xfs_efi_item_recover Darrick J. Wong
@ 2020-12-06 23:10 ` Darrick J. Wong
  2020-12-06 23:10 ` [PATCH 09/10] xfs: validate feature support when recovering rmap/refcount/bmap intents Darrick J. Wong
  2020-12-06 23:10 ` [PATCH 10/10] xfs: trace log intent item recovery failures Darrick J. Wong
  9 siblings, 0 replies; 19+ messages in thread
From: Darrick J. Wong @ 2020-12-06 23:10 UTC (permalink / raw)
  To: darrick.wong; +Cc: Christoph Hellwig, Brian Foster, linux-xfs, bfoster

From: Darrick J. Wong <darrick.wong@oracle.com>

The code that validates recovered extent-free intent items is kind of a
mess -- it doesn't use the standard xfs type validators, and it doesn't
check for things that it should.  Fix the validator function to use the
standard validation helpers and look for more types of obvious errors.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Brian Foster <bfoster@redhat.com>
---
 fs/xfs/xfs_extfree_item.c |   13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)


diff --git a/fs/xfs/xfs_extfree_item.c b/fs/xfs/xfs_extfree_item.c
index f86c8a7c9c4e..bfdfbd192a38 100644
--- a/fs/xfs/xfs_extfree_item.c
+++ b/fs/xfs/xfs_extfree_item.c
@@ -584,14 +584,13 @@ xfs_efi_validate_ext(
 	struct xfs_mount		*mp,
 	struct xfs_extent		*extp)
 {
-	xfs_fsblock_t			startblock_fsb;
+	if (extp->ext_start + extp->ext_len <= extp->ext_start)
+		return false;
 
-	startblock_fsb = XFS_BB_TO_FSB(mp,
-			   XFS_FSB_TO_DADDR(mp, extp->ext_start));
-	if (startblock_fsb == 0 ||
-	    extp->ext_len == 0 ||
-	    startblock_fsb >= mp->m_sb.sb_dblocks ||
-	    extp->ext_len >= mp->m_sb.sb_agblocks)
+	if (!xfs_verify_fsbno(mp, extp->ext_start))
+		return false;
+
+	if (!xfs_verify_fsbno(mp, extp->ext_start + extp->ext_len - 1))
 		return false;
 
 	return true;


^ permalink raw reply related	[flat|nested] 19+ messages in thread

* [PATCH 09/10] xfs: validate feature support when recovering rmap/refcount/bmap intents
  2020-12-06 23:09 [PATCH v3 00/10] xfs: strengthen log intent validation Darrick J. Wong
                   ` (7 preceding siblings ...)
  2020-12-06 23:10 ` [PATCH 08/10] xfs: improve the code that checks recovered extent-free intent items Darrick J. Wong
@ 2020-12-06 23:10 ` Darrick J. Wong
  2020-12-07 18:26   ` [PATCH v3.1 09/10] xfs: validate feature support when recovering rmap/refcount intents Darrick J. Wong
  2020-12-06 23:10 ` [PATCH 10/10] xfs: trace log intent item recovery failures Darrick J. Wong
  9 siblings, 1 reply; 19+ messages in thread
From: Darrick J. Wong @ 2020-12-06 23:10 UTC (permalink / raw)
  To: darrick.wong; +Cc: Christoph Hellwig, linux-xfs, bfoster

From: Darrick J. Wong <darrick.wong@oracle.com>

The bmap, rmap, and refcount log intent items were added to support the
rmap and reflink features.  Because these features come with changes to
the ondisk format, the log items aren't tied to a log incompat flag.

However, the log recovery routines don't actually check for those
feature flags.  The kernel has no business replayng an intent item for a
feature that isn't enabled, so check that as part of recovered log item
validation.  (Note that kernels pre-dating rmap and reflink will fail
the mount on the unknown log item type code.)

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
---
 fs/xfs/xfs_bmap_item.c     |    4 ++++
 fs/xfs/xfs_refcount_item.c |    3 +++
 fs/xfs/xfs_rmap_item.c     |    3 +++
 3 files changed, 10 insertions(+)


diff --git a/fs/xfs/xfs_bmap_item.c b/fs/xfs/xfs_bmap_item.c
index a21a9f71c0c0..8d3ed07800f6 100644
--- a/fs/xfs/xfs_bmap_item.c
+++ b/fs/xfs/xfs_bmap_item.c
@@ -425,6 +425,10 @@ xfs_bui_validate(
 {
 	struct xfs_map_extent		*bmap;
 
+	if (!xfs_sb_version_hasrmapbt(&mp->m_sb) &&
+	    !xfs_sb_version_hasreflink(&mp->m_sb))
+		return false;
+
 	/* Only one mapping operation per BUI... */
 	if (buip->bui_format.bui_nextents != XFS_BUI_MAX_FAST_EXTENTS)
 		return false;
diff --git a/fs/xfs/xfs_refcount_item.c b/fs/xfs/xfs_refcount_item.c
index c24f2da0f795..937d482c9be4 100644
--- a/fs/xfs/xfs_refcount_item.c
+++ b/fs/xfs/xfs_refcount_item.c
@@ -423,6 +423,9 @@ xfs_cui_validate_phys(
 	struct xfs_mount		*mp,
 	struct xfs_phys_extent		*refc)
 {
+	if (!xfs_sb_version_hasreflink(&mp->m_sb))
+		return false;
+
 	if (refc->pe_flags & ~XFS_REFCOUNT_EXTENT_FLAGS)
 		return false;
 
diff --git a/fs/xfs/xfs_rmap_item.c b/fs/xfs/xfs_rmap_item.c
index 6f3250a22093..9b84017184d9 100644
--- a/fs/xfs/xfs_rmap_item.c
+++ b/fs/xfs/xfs_rmap_item.c
@@ -466,6 +466,9 @@ xfs_rui_validate_map(
 	struct xfs_mount		*mp,
 	struct xfs_map_extent		*rmap)
 {
+	if (!xfs_sb_version_hasrmapbt(&mp->m_sb))
+		return false;
+
 	if (rmap->me_flags & ~XFS_RMAP_EXTENT_FLAGS)
 		return false;
 


^ permalink raw reply related	[flat|nested] 19+ messages in thread

* [PATCH 10/10] xfs: trace log intent item recovery failures
  2020-12-06 23:09 [PATCH v3 00/10] xfs: strengthen log intent validation Darrick J. Wong
                   ` (8 preceding siblings ...)
  2020-12-06 23:10 ` [PATCH 09/10] xfs: validate feature support when recovering rmap/refcount/bmap intents Darrick J. Wong
@ 2020-12-06 23:10 ` Darrick J. Wong
  2020-12-07 17:28   ` Brian Foster
  9 siblings, 1 reply; 19+ messages in thread
From: Darrick J. Wong @ 2020-12-06 23:10 UTC (permalink / raw)
  To: darrick.wong; +Cc: Christoph Hellwig, linux-xfs, bfoster

From: Darrick J. Wong <darrick.wong@oracle.com>

Add a trace point so that we can capture when a recovered log intent
item fails to recover.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
---
 fs/xfs/xfs_log_recover.c |    5 ++++-
 fs/xfs/xfs_trace.h       |   18 ++++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)


diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 87886b7f77da..1152c4b3ba96 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -2559,8 +2559,11 @@ xlog_recover_process_intents(
 		spin_unlock(&ailp->ail_lock);
 		error = lip->li_ops->iop_recover(lip, &capture_list);
 		spin_lock(&ailp->ail_lock);
-		if (error)
+		if (error) {
+			trace_xlog_intent_recovery_failed(log->l_mp, error,
+					lip->li_ops->iop_recover);
 			break;
+		}
 	}
 
 	xfs_trans_ail_cursor_done(&cur);
diff --git a/fs/xfs/xfs_trace.h b/fs/xfs/xfs_trace.h
index 86951652d3ed..8fdb51eac1af 100644
--- a/fs/xfs/xfs_trace.h
+++ b/fs/xfs/xfs_trace.h
@@ -103,6 +103,24 @@ DEFINE_ATTR_LIST_EVENT(xfs_attr_list_notfound);
 DEFINE_ATTR_LIST_EVENT(xfs_attr_leaf_list);
 DEFINE_ATTR_LIST_EVENT(xfs_attr_node_list);
 
+TRACE_EVENT(xlog_intent_recovery_failed,
+	TP_PROTO(struct xfs_mount *mp, int error, void *caller_ip),
+	TP_ARGS(mp, error, caller_ip),
+	TP_STRUCT__entry(
+		__field(dev_t, dev)
+		__field(int, error)
+		__field(void *, caller_ip)
+	),
+	TP_fast_assign(
+		__entry->dev = mp->m_super->s_dev;
+		__entry->error = error;
+		__entry->caller_ip = caller_ip;
+	),
+	TP_printk("dev %d:%d error %d function %pS",
+		  MAJOR(__entry->dev), MINOR(__entry->dev),
+		  __entry->error, __entry->caller_ip)
+);
+
 DECLARE_EVENT_CLASS(xfs_perag_class,
 	TP_PROTO(struct xfs_mount *mp, xfs_agnumber_t agno, int refcount,
 		 unsigned long caller_ip),


^ permalink raw reply related	[flat|nested] 19+ messages in thread

* Re: [PATCH 10/10] xfs: trace log intent item recovery failures
  2020-12-06 23:10 ` [PATCH 10/10] xfs: trace log intent item recovery failures Darrick J. Wong
@ 2020-12-07 17:28   ` Brian Foster
  2020-12-07 18:27     ` Darrick J. Wong
  0 siblings, 1 reply; 19+ messages in thread
From: Brian Foster @ 2020-12-07 17:28 UTC (permalink / raw)
  To: Darrick J. Wong; +Cc: Christoph Hellwig, linux-xfs

On Sun, Dec 06, 2020 at 03:10:48PM -0800, Darrick J. Wong wrote:
> From: Darrick J. Wong <darrick.wong@oracle.com>
> 
> Add a trace point so that we can capture when a recovered log intent
> item fails to recover.
> 
> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> Reviewed-by: Christoph Hellwig <hch@lst.de>
> ---
>  fs/xfs/xfs_log_recover.c |    5 ++++-
>  fs/xfs/xfs_trace.h       |   18 ++++++++++++++++++
>  2 files changed, 22 insertions(+), 1 deletion(-)
> 
> 
...
> diff --git a/fs/xfs/xfs_trace.h b/fs/xfs/xfs_trace.h
> index 86951652d3ed..8fdb51eac1af 100644
> --- a/fs/xfs/xfs_trace.h
> +++ b/fs/xfs/xfs_trace.h
> @@ -103,6 +103,24 @@ DEFINE_ATTR_LIST_EVENT(xfs_attr_list_notfound);
>  DEFINE_ATTR_LIST_EVENT(xfs_attr_leaf_list);
>  DEFINE_ATTR_LIST_EVENT(xfs_attr_node_list);
>  
> +TRACE_EVENT(xlog_intent_recovery_failed,
> +	TP_PROTO(struct xfs_mount *mp, int error, void *caller_ip),
> +	TP_ARGS(mp, error, caller_ip),
> +	TP_STRUCT__entry(
> +		__field(dev_t, dev)
> +		__field(int, error)
> +		__field(void *, caller_ip)
> +	),
> +	TP_fast_assign(
> +		__entry->dev = mp->m_super->s_dev;
> +		__entry->error = error;
> +		__entry->caller_ip = caller_ip;
> +	),
> +	TP_printk("dev %d:%d error %d function %pS",
> +		  MAJOR(__entry->dev), MINOR(__entry->dev),
> +		  __entry->error, __entry->caller_ip)
> +);
> +

Nit: I'd still swap out all of the caller_ip naming for clarity, but
otherwise LGTM:

Reviewed-by: Brian Foster <bfoster@redhat.com>

>  DECLARE_EVENT_CLASS(xfs_perag_class,
>  	TP_PROTO(struct xfs_mount *mp, xfs_agnumber_t agno, int refcount,
>  		 unsigned long caller_ip),
> 


^ permalink raw reply	[flat|nested] 19+ messages in thread

* [PATCH v3.1 09/10] xfs: validate feature support when recovering rmap/refcount intents
  2020-12-06 23:10 ` [PATCH 09/10] xfs: validate feature support when recovering rmap/refcount/bmap intents Darrick J. Wong
@ 2020-12-07 18:26   ` Darrick J. Wong
  2020-12-07 18:30     ` Brian Foster
  0 siblings, 1 reply; 19+ messages in thread
From: Darrick J. Wong @ 2020-12-07 18:26 UTC (permalink / raw)
  To: Christoph Hellwig, linux-xfs, bfoster

From: Darrick J. Wong <darrick.wong@oracle.com>

The rmap, and refcount log intent items were added to support the rmap
and reflink features.  Because these features come with changes to the
ondisk format, the log items aren't tied to a log incompat flag.

However, the log recovery routines don't actually check for those
feature flags.  The kernel has no business replayng an intent item for a
feature that isn't enabled, so check that as part of recovered log item
validation.  (Note that kernels pre-dating rmap and reflink already fail
log recovery on the unknown log item type code.)

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
---
v3.1: drop the feature check for BUI validation for now
---
 fs/xfs/xfs_refcount_item.c |    3 +++
 fs/xfs/xfs_rmap_item.c     |    3 +++
 2 files changed, 6 insertions(+)

diff --git a/fs/xfs/xfs_refcount_item.c b/fs/xfs/xfs_refcount_item.c
index c24f2da0f795..937d482c9be4 100644
--- a/fs/xfs/xfs_refcount_item.c
+++ b/fs/xfs/xfs_refcount_item.c
@@ -423,6 +423,9 @@ xfs_cui_validate_phys(
 	struct xfs_mount		*mp,
 	struct xfs_phys_extent		*refc)
 {
+	if (!xfs_sb_version_hasreflink(&mp->m_sb))
+		return false;
+
 	if (refc->pe_flags & ~XFS_REFCOUNT_EXTENT_FLAGS)
 		return false;
 
diff --git a/fs/xfs/xfs_rmap_item.c b/fs/xfs/xfs_rmap_item.c
index 6f3250a22093..9b84017184d9 100644
--- a/fs/xfs/xfs_rmap_item.c
+++ b/fs/xfs/xfs_rmap_item.c
@@ -466,6 +466,9 @@ xfs_rui_validate_map(
 	struct xfs_mount		*mp,
 	struct xfs_map_extent		*rmap)
 {
+	if (!xfs_sb_version_hasrmapbt(&mp->m_sb))
+		return false;
+
 	if (rmap->me_flags & ~XFS_RMAP_EXTENT_FLAGS)
 		return false;
 

^ permalink raw reply related	[flat|nested] 19+ messages in thread

* Re: [PATCH 10/10] xfs: trace log intent item recovery failures
  2020-12-07 17:28   ` Brian Foster
@ 2020-12-07 18:27     ` Darrick J. Wong
  0 siblings, 0 replies; 19+ messages in thread
From: Darrick J. Wong @ 2020-12-07 18:27 UTC (permalink / raw)
  To: Brian Foster; +Cc: Christoph Hellwig, linux-xfs

On Mon, Dec 07, 2020 at 12:28:47PM -0500, Brian Foster wrote:
> On Sun, Dec 06, 2020 at 03:10:48PM -0800, Darrick J. Wong wrote:
> > From: Darrick J. Wong <darrick.wong@oracle.com>
> > 
> > Add a trace point so that we can capture when a recovered log intent
> > item fails to recover.
> > 
> > Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> > Reviewed-by: Christoph Hellwig <hch@lst.de>
> > ---
> >  fs/xfs/xfs_log_recover.c |    5 ++++-
> >  fs/xfs/xfs_trace.h       |   18 ++++++++++++++++++
> >  2 files changed, 22 insertions(+), 1 deletion(-)
> > 
> > 
> ...
> > diff --git a/fs/xfs/xfs_trace.h b/fs/xfs/xfs_trace.h
> > index 86951652d3ed..8fdb51eac1af 100644
> > --- a/fs/xfs/xfs_trace.h
> > +++ b/fs/xfs/xfs_trace.h
> > @@ -103,6 +103,24 @@ DEFINE_ATTR_LIST_EVENT(xfs_attr_list_notfound);
> >  DEFINE_ATTR_LIST_EVENT(xfs_attr_leaf_list);
> >  DEFINE_ATTR_LIST_EVENT(xfs_attr_node_list);
> >  
> > +TRACE_EVENT(xlog_intent_recovery_failed,
> > +	TP_PROTO(struct xfs_mount *mp, int error, void *caller_ip),
> > +	TP_ARGS(mp, error, caller_ip),
> > +	TP_STRUCT__entry(
> > +		__field(dev_t, dev)
> > +		__field(int, error)
> > +		__field(void *, caller_ip)
> > +	),
> > +	TP_fast_assign(
> > +		__entry->dev = mp->m_super->s_dev;
> > +		__entry->error = error;
> > +		__entry->caller_ip = caller_ip;
> > +	),
> > +	TP_printk("dev %d:%d error %d function %pS",
> > +		  MAJOR(__entry->dev), MINOR(__entry->dev),
> > +		  __entry->error, __entry->caller_ip)
> > +);
> > +
> 
> Nit: I'd still swap out all of the caller_ip naming for clarity, but
> otherwise LGTM:

Ok will do, thanks for reviewing!

--D

> Reviewed-by: Brian Foster <bfoster@redhat.com>
> 
> >  DECLARE_EVENT_CLASS(xfs_perag_class,
> >  	TP_PROTO(struct xfs_mount *mp, xfs_agnumber_t agno, int refcount,
> >  		 unsigned long caller_ip),
> > 
> 

^ permalink raw reply	[flat|nested] 19+ messages in thread

* Re: [PATCH v3.1 09/10] xfs: validate feature support when recovering rmap/refcount intents
  2020-12-07 18:26   ` [PATCH v3.1 09/10] xfs: validate feature support when recovering rmap/refcount intents Darrick J. Wong
@ 2020-12-07 18:30     ` Brian Foster
  0 siblings, 0 replies; 19+ messages in thread
From: Brian Foster @ 2020-12-07 18:30 UTC (permalink / raw)
  To: Darrick J. Wong; +Cc: Christoph Hellwig, linux-xfs

On Mon, Dec 07, 2020 at 10:26:23AM -0800, Darrick J. Wong wrote:
> From: Darrick J. Wong <darrick.wong@oracle.com>
> 
> The rmap, and refcount log intent items were added to support the rmap
> and reflink features.  Because these features come with changes to the
> ondisk format, the log items aren't tied to a log incompat flag.
> 
> However, the log recovery routines don't actually check for those
> feature flags.  The kernel has no business replayng an intent item for a
> feature that isn't enabled, so check that as part of recovered log item
> validation.  (Note that kernels pre-dating rmap and reflink already fail
> log recovery on the unknown log item type code.)
> 
> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> ---
> v3.1: drop the feature check for BUI validation for now
> ---

Reviewed-by: Brian Foster <bfoster@redhat.com>

>  fs/xfs/xfs_refcount_item.c |    3 +++
>  fs/xfs/xfs_rmap_item.c     |    3 +++
>  2 files changed, 6 insertions(+)
> 
> diff --git a/fs/xfs/xfs_refcount_item.c b/fs/xfs/xfs_refcount_item.c
> index c24f2da0f795..937d482c9be4 100644
> --- a/fs/xfs/xfs_refcount_item.c
> +++ b/fs/xfs/xfs_refcount_item.c
> @@ -423,6 +423,9 @@ xfs_cui_validate_phys(
>  	struct xfs_mount		*mp,
>  	struct xfs_phys_extent		*refc)
>  {
> +	if (!xfs_sb_version_hasreflink(&mp->m_sb))
> +		return false;
> +
>  	if (refc->pe_flags & ~XFS_REFCOUNT_EXTENT_FLAGS)
>  		return false;
>  
> diff --git a/fs/xfs/xfs_rmap_item.c b/fs/xfs/xfs_rmap_item.c
> index 6f3250a22093..9b84017184d9 100644
> --- a/fs/xfs/xfs_rmap_item.c
> +++ b/fs/xfs/xfs_rmap_item.c
> @@ -466,6 +466,9 @@ xfs_rui_validate_map(
>  	struct xfs_mount		*mp,
>  	struct xfs_map_extent		*rmap)
>  {
> +	if (!xfs_sb_version_hasrmapbt(&mp->m_sb))
> +		return false;
> +
>  	if (rmap->me_flags & ~XFS_RMAP_EXTENT_FLAGS)
>  		return false;
>  
> 


^ permalink raw reply	[flat|nested] 19+ messages in thread

* Re: [PATCH 07/10] xfs: hoist recovered extent-free intent checks out of xfs_efi_item_recover
  2020-12-04  1:12 ` [PATCH 07/10] xfs: hoist recovered extent-free intent checks out of xfs_efi_item_recover Darrick J. Wong
@ 2020-12-04 14:00   ` Brian Foster
  0 siblings, 0 replies; 19+ messages in thread
From: Brian Foster @ 2020-12-04 14:00 UTC (permalink / raw)
  To: Darrick J. Wong; +Cc: Christoph Hellwig, linux-xfs

On Thu, Dec 03, 2020 at 05:12:18PM -0800, Darrick J. Wong wrote:
> From: Darrick J. Wong <darrick.wong@oracle.com>
> 
> When we recover a extent-free intent from the log, we need to validate
> its contents before we try to replay them.  Hoist the checking code into
> a separate function in preparation to refactor this code to use
> validation helpers.
> 
> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> Reviewed-by: Christoph Hellwig <hch@lst.de>
> ---

Reviewed-by: Brian Foster <bfoster@redhat.com>

>  fs/xfs/xfs_extfree_item.c |   31 +++++++++++++++++++++++--------
>  1 file changed, 23 insertions(+), 8 deletions(-)
> 
> 
> diff --git a/fs/xfs/xfs_extfree_item.c b/fs/xfs/xfs_extfree_item.c
> index 6c11bfc3d452..5e0f0b0a6c83 100644
> --- a/fs/xfs/xfs_extfree_item.c
> +++ b/fs/xfs/xfs_extfree_item.c
> @@ -578,6 +578,25 @@ const struct xfs_defer_op_type xfs_agfl_free_defer_type = {
>  	.cancel_item	= xfs_extent_free_cancel_item,
>  };
>  
> +/* Is this recovered EFI ok? */
> +static inline bool
> +xfs_efi_validate_ext(
> +	struct xfs_mount		*mp,
> +	struct xfs_extent		*extp)
> +{
> +	xfs_fsblock_t			startblock_fsb;
> +
> +	startblock_fsb = XFS_BB_TO_FSB(mp,
> +			   XFS_FSB_TO_DADDR(mp, extp->ext_start));
> +	if (startblock_fsb == 0 ||
> +	    extp->ext_len == 0 ||
> +	    startblock_fsb >= mp->m_sb.sb_dblocks ||
> +	    extp->ext_len >= mp->m_sb.sb_agblocks)
> +		return false;
> +
> +	return true;
> +}
> +
>  /*
>   * Process an extent free intent item that was recovered from
>   * the log.  We need to free the extents that it describes.
> @@ -592,7 +611,6 @@ xfs_efi_item_recover(
>  	struct xfs_efd_log_item		*efdp;
>  	struct xfs_trans		*tp;
>  	struct xfs_extent		*extp;
> -	xfs_fsblock_t			startblock_fsb;
>  	int				i;
>  	int				error = 0;
>  
> @@ -602,14 +620,11 @@ xfs_efi_item_recover(
>  	 * just toss the EFI.
>  	 */
>  	for (i = 0; i < efip->efi_format.efi_nextents; i++) {
> -		extp = &efip->efi_format.efi_extents[i];
> -		startblock_fsb = XFS_BB_TO_FSB(mp,
> -				   XFS_FSB_TO_DADDR(mp, extp->ext_start));
> -		if (startblock_fsb == 0 ||
> -		    extp->ext_len == 0 ||
> -		    startblock_fsb >= mp->m_sb.sb_dblocks ||
> -		    extp->ext_len >= mp->m_sb.sb_agblocks)
> +		if (!xfs_efi_validate_ext(mp,
> +					&efip->efi_format.efi_extents[i])) {
> +			XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, mp);
>  			return -EFSCORRUPTED;
> +		}
>  	}
>  
>  	error = xfs_trans_alloc(mp, &M_RES(mp)->tr_itruncate, 0, 0, 0, &tp);
> 


^ permalink raw reply	[flat|nested] 19+ messages in thread

* [PATCH 07/10] xfs: hoist recovered extent-free intent checks out of xfs_efi_item_recover
  2020-12-04  1:11 [PATCH v2 00/10] xfs: strengthen log intent validation Darrick J. Wong
@ 2020-12-04  1:12 ` Darrick J. Wong
  2020-12-04 14:00   ` Brian Foster
  0 siblings, 1 reply; 19+ messages in thread
From: Darrick J. Wong @ 2020-12-04  1:12 UTC (permalink / raw)
  To: darrick.wong; +Cc: Christoph Hellwig, linux-xfs

From: Darrick J. Wong <darrick.wong@oracle.com>

When we recover a extent-free intent from the log, we need to validate
its contents before we try to replay them.  Hoist the checking code into
a separate function in preparation to refactor this code to use
validation helpers.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
---
 fs/xfs/xfs_extfree_item.c |   31 +++++++++++++++++++++++--------
 1 file changed, 23 insertions(+), 8 deletions(-)


diff --git a/fs/xfs/xfs_extfree_item.c b/fs/xfs/xfs_extfree_item.c
index 6c11bfc3d452..5e0f0b0a6c83 100644
--- a/fs/xfs/xfs_extfree_item.c
+++ b/fs/xfs/xfs_extfree_item.c
@@ -578,6 +578,25 @@ const struct xfs_defer_op_type xfs_agfl_free_defer_type = {
 	.cancel_item	= xfs_extent_free_cancel_item,
 };
 
+/* Is this recovered EFI ok? */
+static inline bool
+xfs_efi_validate_ext(
+	struct xfs_mount		*mp,
+	struct xfs_extent		*extp)
+{
+	xfs_fsblock_t			startblock_fsb;
+
+	startblock_fsb = XFS_BB_TO_FSB(mp,
+			   XFS_FSB_TO_DADDR(mp, extp->ext_start));
+	if (startblock_fsb == 0 ||
+	    extp->ext_len == 0 ||
+	    startblock_fsb >= mp->m_sb.sb_dblocks ||
+	    extp->ext_len >= mp->m_sb.sb_agblocks)
+		return false;
+
+	return true;
+}
+
 /*
  * Process an extent free intent item that was recovered from
  * the log.  We need to free the extents that it describes.
@@ -592,7 +611,6 @@ xfs_efi_item_recover(
 	struct xfs_efd_log_item		*efdp;
 	struct xfs_trans		*tp;
 	struct xfs_extent		*extp;
-	xfs_fsblock_t			startblock_fsb;
 	int				i;
 	int				error = 0;
 
@@ -602,14 +620,11 @@ xfs_efi_item_recover(
 	 * just toss the EFI.
 	 */
 	for (i = 0; i < efip->efi_format.efi_nextents; i++) {
-		extp = &efip->efi_format.efi_extents[i];
-		startblock_fsb = XFS_BB_TO_FSB(mp,
-				   XFS_FSB_TO_DADDR(mp, extp->ext_start));
-		if (startblock_fsb == 0 ||
-		    extp->ext_len == 0 ||
-		    startblock_fsb >= mp->m_sb.sb_dblocks ||
-		    extp->ext_len >= mp->m_sb.sb_agblocks)
+		if (!xfs_efi_validate_ext(mp,
+					&efip->efi_format.efi_extents[i])) {
+			XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, mp);
 			return -EFSCORRUPTED;
+		}
 	}
 
 	error = xfs_trans_alloc(mp, &M_RES(mp)->tr_itruncate, 0, 0, 0, &tp);


^ permalink raw reply related	[flat|nested] 19+ messages in thread

* Re: [PATCH 07/10] xfs: hoist recovered extent-free intent checks out of xfs_efi_item_recover
  2020-12-01  3:38 ` [PATCH 07/10] xfs: hoist recovered extent-free intent checks out of xfs_efi_item_recover Darrick J. Wong
@ 2020-12-01 10:06   ` Christoph Hellwig
  0 siblings, 0 replies; 19+ messages in thread
From: Christoph Hellwig @ 2020-12-01 10:06 UTC (permalink / raw)
  To: Darrick J. Wong; +Cc: linux-xfs

On Mon, Nov 30, 2020 at 07:38:22PM -0800, Darrick J. Wong wrote:
> From: Darrick J. Wong <darrick.wong@oracle.com>
> 
> When we recover a extent-free intent from the log, we need to validate
> its contents before we try to replay them.  Hoist the checking code into
> a separate function in preparation to refactor this code to use
> validation helpers.
> 
> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>

Looks good,

Reviewed-by: Christoph Hellwig <hch@lst.de>

^ permalink raw reply	[flat|nested] 19+ messages in thread

* [PATCH 07/10] xfs: hoist recovered extent-free intent checks out of xfs_efi_item_recover
  2020-12-01  3:37 [PATCH 00/10] xfs: strengthen log intent validation Darrick J. Wong
@ 2020-12-01  3:38 ` Darrick J. Wong
  2020-12-01 10:06   ` Christoph Hellwig
  0 siblings, 1 reply; 19+ messages in thread
From: Darrick J. Wong @ 2020-12-01  3:38 UTC (permalink / raw)
  To: darrick.wong; +Cc: linux-xfs

From: Darrick J. Wong <darrick.wong@oracle.com>

When we recover a extent-free intent from the log, we need to validate
its contents before we try to replay them.  Hoist the checking code into
a separate function in preparation to refactor this code to use
validation helpers.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
---
 fs/xfs/xfs_extfree_item.c |   31 +++++++++++++++++++++----------
 1 file changed, 21 insertions(+), 10 deletions(-)


diff --git a/fs/xfs/xfs_extfree_item.c b/fs/xfs/xfs_extfree_item.c
index 6c11bfc3d452..b5710b7fc263 100644
--- a/fs/xfs/xfs_extfree_item.c
+++ b/fs/xfs/xfs_extfree_item.c
@@ -578,6 +578,25 @@ const struct xfs_defer_op_type xfs_agfl_free_defer_type = {
 	.cancel_item	= xfs_extent_free_cancel_item,
 };
 
+/* Is this recovered EFI ok? */
+static inline bool
+xfs_efi_validate_ext(
+	struct xfs_mount		*mp,
+	struct xfs_extent		*extp)
+{
+	xfs_fsblock_t			startblock_fsb;
+
+	startblock_fsb = XFS_BB_TO_FSB(mp,
+			   XFS_FSB_TO_DADDR(mp, extp->ext_start));
+	if (startblock_fsb == 0 ||
+	    extp->ext_len == 0 ||
+	    startblock_fsb >= mp->m_sb.sb_dblocks ||
+	    extp->ext_len >= mp->m_sb.sb_agblocks)
+		return false;
+
+	return true;
+}
+
 /*
  * Process an extent free intent item that was recovered from
  * the log.  We need to free the extents that it describes.
@@ -592,7 +611,6 @@ xfs_efi_item_recover(
 	struct xfs_efd_log_item		*efdp;
 	struct xfs_trans		*tp;
 	struct xfs_extent		*extp;
-	xfs_fsblock_t			startblock_fsb;
 	int				i;
 	int				error = 0;
 
@@ -601,16 +619,9 @@ xfs_efi_item_recover(
 	 * EFI.  If any are bad, then assume that all are bad and
 	 * just toss the EFI.
 	 */
-	for (i = 0; i < efip->efi_format.efi_nextents; i++) {
-		extp = &efip->efi_format.efi_extents[i];
-		startblock_fsb = XFS_BB_TO_FSB(mp,
-				   XFS_FSB_TO_DADDR(mp, extp->ext_start));
-		if (startblock_fsb == 0 ||
-		    extp->ext_len == 0 ||
-		    startblock_fsb >= mp->m_sb.sb_dblocks ||
-		    extp->ext_len >= mp->m_sb.sb_agblocks)
+	for (i = 0; i < efip->efi_format.efi_nextents; i++)
+		if (!xfs_efi_validate_ext(mp, &efip->efi_format.efi_extents[i]))
 			return -EFSCORRUPTED;
-	}
 
 	error = xfs_trans_alloc(mp, &M_RES(mp)->tr_itruncate, 0, 0, 0, &tp);
 	if (error)


^ permalink raw reply related	[flat|nested] 19+ messages in thread

end of thread, other threads:[~2020-12-07 18:31 UTC | newest]

Thread overview: 19+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-12-06 23:09 [PATCH v3 00/10] xfs: strengthen log intent validation Darrick J. Wong
2020-12-06 23:09 ` [PATCH 01/10] xfs: hoist recovered bmap intent checks out of xfs_bui_item_recover Darrick J. Wong
2020-12-06 23:09 ` [PATCH 02/10] xfs: improve the code that checks recovered bmap intent items Darrick J. Wong
2020-12-06 23:10 ` [PATCH 03/10] xfs: hoist recovered rmap intent checks out of xfs_rui_item_recover Darrick J. Wong
2020-12-06 23:10 ` [PATCH 04/10] xfs: improve the code that checks recovered rmap intent items Darrick J. Wong
2020-12-06 23:10 ` [PATCH 05/10] xfs: hoist recovered refcount intent checks out of xfs_cui_item_recover Darrick J. Wong
2020-12-06 23:10 ` [PATCH 06/10] xfs: improve the code that checks recovered refcount intent items Darrick J. Wong
2020-12-06 23:10 ` [PATCH 07/10] xfs: hoist recovered extent-free intent checks out of xfs_efi_item_recover Darrick J. Wong
2020-12-06 23:10 ` [PATCH 08/10] xfs: improve the code that checks recovered extent-free intent items Darrick J. Wong
2020-12-06 23:10 ` [PATCH 09/10] xfs: validate feature support when recovering rmap/refcount/bmap intents Darrick J. Wong
2020-12-07 18:26   ` [PATCH v3.1 09/10] xfs: validate feature support when recovering rmap/refcount intents Darrick J. Wong
2020-12-07 18:30     ` Brian Foster
2020-12-06 23:10 ` [PATCH 10/10] xfs: trace log intent item recovery failures Darrick J. Wong
2020-12-07 17:28   ` Brian Foster
2020-12-07 18:27     ` Darrick J. Wong
  -- strict thread matches above, loose matches on Subject: below --
2020-12-04  1:11 [PATCH v2 00/10] xfs: strengthen log intent validation Darrick J. Wong
2020-12-04  1:12 ` [PATCH 07/10] xfs: hoist recovered extent-free intent checks out of xfs_efi_item_recover Darrick J. Wong
2020-12-04 14:00   ` Brian Foster
2020-12-01  3:37 [PATCH 00/10] xfs: strengthen log intent validation Darrick J. Wong
2020-12-01  3:38 ` [PATCH 07/10] xfs: hoist recovered extent-free intent checks out of xfs_efi_item_recover Darrick J. Wong
2020-12-01 10:06   ` Christoph Hellwig

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).