xfs: try to avoid allocating from sick inode clusters

Source kernel commit: 2935213a6831a0087442d406301c2cdcc87b0f61

I noticed that xfs/413 and xfs/375 occasionally failed while fuzzing
core.mode of an inode.  The root cause of these problems is that the
field we fuzzed (core.mode or core.magic, typically) causes the entire
inode cluster buffer verification to fail, which affects several inodes
at once.  The repair process tries to create either a /lost+found or a
temporary repair file, but regrettably it picks the same inode cluster
that we just corrupted, with the result that repair triggers the demise
of the filesystem.

Try avoid this by making the inode allocation path detect when the perag
health status indicates that someone has found bad inode cluster
buffers, and try to read the inode cluster buffer.  If the cluster
buffer fails the verifiers, try another AG.  This isn't foolproof and
can result in premature ENOSPC, but that might be better than shutting
down.

Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>

diff --git a/libxfs/util.c b/libxfs/util.c
index 841f4b963f18d4bc958c3c2345fd8985757d5f72..2656c99a8ea7200270e68495c9144257c563196d 100644 (file)
--- a/libxfs/util.c
+++ b/libxfs/util.c
@@ -732,6 +732,12 @@ void xfs_fs_mark_sick(struct xfs_mount *mp, unsigned int mask) { }
 void xfs_agno_mark_sick(struct xfs_mount *mp, xfs_agnumber_t agno,
                unsigned int mask) { }
 void xfs_ag_mark_sick(struct xfs_perag *pag, unsigned int mask) { }
+void xfs_ag_measure_sickness(struct xfs_perag *pag, unsigned int *sick,
+               unsigned int *checked)
+{
+       *sick = 0;
+       *checked = 0;
+}
 void xfs_bmap_mark_sick(struct xfs_inode *ip, int whichfork) { }
 void xfs_btree_mark_sick(struct xfs_btree_cur *cur) { }
 void xfs_dirattr_mark_sick(struct xfs_inode *ip, int whichfork) { }

diff --git a/libxfs/xfs_ialloc.c b/libxfs/xfs_ialloc.c
index 992b8348a45a2d7ec4eb1fea196f40e636adfca6..d8697561e7df2f1b106f91f9824d057279cefe90 100644 (file)
--- a/libxfs/xfs_ialloc.c
+++ b/libxfs/xfs_ialloc.c
@@ -1052,6 +1052,33 @@ xfs_inobt_first_free_inode(
        return xfs_lowbit64(realfree);
 }
 
+/*
+ * If this AG has corrupt inodes, check if allocating this inode would fail
+ * with corruption errors.  Returns 0 if we're clear, or EAGAIN to try again
+ * somewhere else.
+ */
+static int
+xfs_dialloc_check_ino(
+       struct xfs_perag        *pag,
+       struct xfs_trans        *tp,
+       xfs_ino_t               ino)
+{
+       struct xfs_imap         imap;
+       struct xfs_buf          *bp;
+       int                     error;
+
+       error = xfs_imap(pag, tp, ino, &imap, 0);
+       if (error)
+               return -EAGAIN;
+
+       error = xfs_imap_to_bp(pag->pag_mount, tp, &imap, &bp);
+       if (error)
+               return -EAGAIN;
+
+       xfs_trans_brelse(tp, bp);
+       return 0;
+}
+
 /*
  * Allocate an inode using the inobt-only algorithm.
  */
@@ -1304,6 +1331,13 @@ alloc_inode:
        ASSERT((XFS_AGINO_TO_OFFSET(mp, rec.ir_startino) %
                                   XFS_INODES_PER_CHUNK) == 0);
        ino = XFS_AGINO_TO_INO(mp, pag->pag_agno, rec.ir_startino + offset);
+
+       if (xfs_ag_has_sickness(pag, XFS_SICK_AG_INODES)) {
+               error = xfs_dialloc_check_ino(pag, tp, ino);
+               if (error)
+                       goto error0;
+       }
+
        rec.ir_free &= ~XFS_INOBT_MASK(offset);
        rec.ir_freecount--;
        error = xfs_inobt_update(cur, &rec);
@@ -1579,6 +1613,12 @@ xfs_dialloc_ag(
                                   XFS_INODES_PER_CHUNK) == 0);
        ino = XFS_AGINO_TO_INO(mp, pag->pag_agno, rec.ir_startino + offset);
 
+       if (xfs_ag_has_sickness(pag, XFS_SICK_AG_INODES)) {
+               error = xfs_dialloc_check_ino(pag, tp, ino);
+               if (error)
+                       goto error_cur;
+       }
+
        /*
         * Modify or remove the finobt record.
         */