1 files changed, 239 insertions, 7 deletions

diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index d1dba7ce75ae..93f03ec17eec 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -29,6 +29,7 @@
 #include "xfs_bmap_btree.h"
 #include "xfs_alloc_btree.h"
 #include "xfs_ialloc_btree.h"
+#include "xfs_btree.h"
 #include "xfs_dinode.h"
 #include "xfs_inode.h"
 #include "xfs_inode_item.h"
@@ -45,6 +46,14 @@
 #include "xfs_trace.h"
 #include "xfs_icache.h"
 
+/* Need all the magic numbers and buffer ops structures from these headers */
+#include "xfs_symlink.h"
+#include "xfs_da_btree.h"
+#include "xfs_dir2_format.h"
+#include "xfs_dir2_priv.h"
+#include "xfs_attr_leaf.h"
+#include "xfs_attr_remote.h"
+
 STATIC int
 xlog_find_zeroed(
         struct xlog     *,
@@ -1785,6 +1794,7 @@ xlog_recover_do_inode_buffer(
         xfs_agino_t             *buffer_nextp;
 
         trace_xfs_log_recover_buf_inode_buf(mp->m_log, buf_f);
+        bp->b_ops = &xfs_inode_buf_ops;
 
         inodes_per_buf = BBTOB(bp->b_io_length) >> mp->m_sb.sb_inodelog;
         for (i = 0; i < inodes_per_buf; i++) {
@@ -1857,6 +1867,201 @@ xlog_recover_do_inode_buffer(
 }
 
 /*
+ * Validate the recovered buffer is of the correct type and attach the
+ * appropriate buffer operations to them for writeback. Magic numbers are in a
+ * few places:
+ *      the first 16 bits of the buffer (inode buffer, dquot buffer),
+ *      the first 32 bits of the buffer (most blocks),
+ *      inside a struct xfs_da_blkinfo at the start of the buffer.
+ */
+static void
+xlog_recovery_validate_buf_type(
+        struct xfs_mount        *mp,
+        struct xfs_buf          *bp,
+        xfs_buf_log_format_t    *buf_f)
+{
+        struct xfs_da_blkinfo   *info = bp->b_addr;
+        __uint32_t              magic32;
+        __uint16_t              magic16;
+        __uint16_t              magicda;
+
+        magic32 = be32_to_cpu(*(__be32 *)bp->b_addr);
+        magic16 = be16_to_cpu(*(__be16*)bp->b_addr);
+        magicda = be16_to_cpu(info->magic);
+        switch (xfs_blft_from_flags(buf_f)) {
+        case XFS_BLFT_BTREE_BUF:
+                switch (magic32) {
+                case XFS_ABTB_CRC_MAGIC:
+                case XFS_ABTC_CRC_MAGIC:
+                case XFS_ABTB_MAGIC:
+                case XFS_ABTC_MAGIC:
+                        bp->b_ops = &xfs_allocbt_buf_ops;
+                        break;
+                case XFS_IBT_CRC_MAGIC:
+                case XFS_IBT_MAGIC:
+                        bp->b_ops = &xfs_inobt_buf_ops;
+                        break;
+                case XFS_BMAP_CRC_MAGIC:
+                case XFS_BMAP_MAGIC:
+                        bp->b_ops = &xfs_bmbt_buf_ops;
+                        break;
+                default:
+                        xfs_warn(mp, "Bad btree block magic!");
+                        ASSERT(0);
+                        break;
+                }
+                break;
+        case XFS_BLFT_AGF_BUF:
+                if (magic32 != XFS_AGF_MAGIC) {
+                        xfs_warn(mp, "Bad AGF block magic!");
+                        ASSERT(0);
+                        break;
+                }
+                bp->b_ops = &xfs_agf_buf_ops;
+                break;
+        case XFS_BLFT_AGFL_BUF:
+                if (!xfs_sb_version_hascrc(&mp->m_sb))
+                        break;
+                if (magic32 != XFS_AGFL_MAGIC) {
+                        xfs_warn(mp, "Bad AGFL block magic!");
+                        ASSERT(0);
+                        break;
+                }
+                bp->b_ops = &xfs_agfl_buf_ops;
+                break;
+        case XFS_BLFT_AGI_BUF:
+                if (magic32 != XFS_AGI_MAGIC) {
+                        xfs_warn(mp, "Bad AGI block magic!");
+                        ASSERT(0);
+                        break;
+                }
+                bp->b_ops = &xfs_agi_buf_ops;
+                break;
+        case XFS_BLFT_UDQUOT_BUF:
+        case XFS_BLFT_PDQUOT_BUF:
+        case XFS_BLFT_GDQUOT_BUF:
+#ifdef CONFIG_XFS_QUOTA
+                if (magic16 != XFS_DQUOT_MAGIC) {
+                        xfs_warn(mp, "Bad DQUOT block magic!");
+                        ASSERT(0);
+                        break;
+                }
+                bp->b_ops = &xfs_dquot_buf_ops;
+#else
+                xfs_alert(mp,
+        "Trying to recover dquots without QUOTA support built in!");
+                ASSERT(0);
+#endif
+                break;
+        case XFS_BLFT_DINO_BUF:
+                /*
+                 * we get here with inode allocation buffers, not buffers that
+                 * track unlinked list changes.
+                 */
+                if (magic16 != XFS_DINODE_MAGIC) {
+                        xfs_warn(mp, "Bad INODE block magic!");
+                        ASSERT(0);
+                        break;
+                }
+                bp->b_ops = &xfs_inode_buf_ops;
+                break;
+        case XFS_BLFT_SYMLINK_BUF:
+                if (magic32 != XFS_SYMLINK_MAGIC) {
+                        xfs_warn(mp, "Bad symlink block magic!");
+                        ASSERT(0);
+                        break;
+                }
+                bp->b_ops = &xfs_symlink_buf_ops;
+                break;
+        case XFS_BLFT_DIR_BLOCK_BUF:
+                if (magic32 != XFS_DIR2_BLOCK_MAGIC &&
+                    magic32 != XFS_DIR3_BLOCK_MAGIC) {
+                        xfs_warn(mp, "Bad dir block magic!");
+                        ASSERT(0);
+                        break;
+                }
+                bp->b_ops = &xfs_dir3_block_buf_ops;
+                break;
+        case XFS_BLFT_DIR_DATA_BUF:
+                if (magic32 != XFS_DIR2_DATA_MAGIC &&
+                    magic32 != XFS_DIR3_DATA_MAGIC) {
+                        xfs_warn(mp, "Bad dir data magic!");
+                        ASSERT(0);
+                        break;
+                }
+                bp->b_ops = &xfs_dir3_data_buf_ops;
+                break;
+        case XFS_BLFT_DIR_FREE_BUF:
+                if (magic32 != XFS_DIR2_FREE_MAGIC &&
+                    magic32 != XFS_DIR3_FREE_MAGIC) {
+                        xfs_warn(mp, "Bad dir3 free magic!");
+                        ASSERT(0);
+                        break;
+                }
+                bp->b_ops = &xfs_dir3_free_buf_ops;
+                break;
+        case XFS_BLFT_DIR_LEAF1_BUF:
+                if (magicda != XFS_DIR2_LEAF1_MAGIC &&
+                    magicda != XFS_DIR3_LEAF1_MAGIC) {
+                        xfs_warn(mp, "Bad dir leaf1 magic!");
+                        ASSERT(0);
+                        break;
+                }
+                bp->b_ops = &xfs_dir3_leaf1_buf_ops;
+                break;
+        case XFS_BLFT_DIR_LEAFN_BUF:
+                if (magicda != XFS_DIR2_LEAFN_MAGIC &&
+                    magicda != XFS_DIR3_LEAFN_MAGIC) {
+                        xfs_warn(mp, "Bad dir leafn magic!");
+                        ASSERT(0);
+                        break;
+                }
+                bp->b_ops = &xfs_dir3_leafn_buf_ops;
+                break;
+        case XFS_BLFT_DA_NODE_BUF:
+                if (magicda != XFS_DA_NODE_MAGIC &&
+                    magicda != XFS_DA3_NODE_MAGIC) {
+                        xfs_warn(mp, "Bad da node magic!");
+                        ASSERT(0);
+                        break;
+                }
+                bp->b_ops = &xfs_da3_node_buf_ops;
+                break;
+        case XFS_BLFT_ATTR_LEAF_BUF:
+                if (magicda != XFS_ATTR_LEAF_MAGIC &&
+                    magicda != XFS_ATTR3_LEAF_MAGIC) {
+                        xfs_warn(mp, "Bad attr leaf magic!");
+                        ASSERT(0);
+                        break;
+                }
+                bp->b_ops = &xfs_attr3_leaf_buf_ops;
+                break;
+        case XFS_BLFT_ATTR_RMT_BUF:
+                if (!xfs_sb_version_hascrc(&mp->m_sb))
+                        break;
+                if (magic32 != XFS_ATTR3_RMT_MAGIC) {
+                        xfs_warn(mp, "Bad attr remote magic!");
+                        ASSERT(0);
+                        break;
+                }
+                bp->b_ops = &xfs_attr3_rmt_buf_ops;
+                break;
+        case XFS_BLFT_SB_BUF:
+                if (magic32 != XFS_SB_MAGIC) {
+                        xfs_warn(mp, "Bad SB block magic!");
+                        ASSERT(0);
+                        break;
+                }
+                bp->b_ops = &xfs_sb_buf_ops;
+                break;
+        default:
+                xfs_warn(mp, "Unknown buffer type %d!",
+                         xfs_blft_from_flags(buf_f));
+                break;
+        }
+}
+
+/*
  * Perform a 'normal' buffer recovery.  Each logged region of the
  * buffer should be copied over the corresponding region in the
  * given buffer.  The bitmap in the buf log format structure indicates
@@ -1928,6 +2133,8 @@ xlog_recover_do_reg_buffer(
 
         /* Shouldn't be any more regions */
         ASSERT(i == item->ri_total);
+
+        xlog_recovery_validate_buf_type(mp, bp, buf_f);
 }
 
 /*
@@ -2213,6 +2420,7 @@ xlog_recover_inode_pass2(
         int                     attr_index;
         uint                    fields;
         xfs_icdinode_t          *dicp;
+        uint                    isize;
         int                     need_free = 0;
 
         if (item->ri_buf[0].i_len == sizeof(xfs_inode_log_format_t)) {
@@ -2238,7 +2446,7 @@ xlog_recover_inode_pass2(
         trace_xfs_log_recover_inode_recover(log, in_f);
 
         bp = xfs_buf_read(mp->m_ddev_targp, in_f->ilf_blkno, in_f->ilf_len, 0,
-                          NULL);
+                          &xfs_inode_buf_ops);
         if (!bp) {
                 error = ENOMEM;
                 goto error;
@@ -2349,7 +2557,8 @@ xlog_recover_inode_pass2(
                 error = EFSCORRUPTED;
                 goto error;
         }
-        if (unlikely(item->ri_buf[1].i_len > sizeof(struct xfs_icdinode))) {
+        isize = xfs_icdinode_size(dicp->di_version);
+        if (unlikely(item->ri_buf[1].i_len > isize)) {
                 XFS_CORRUPTION_ERROR("xlog_recover_inode_pass2(7)",
                                      XFS_ERRLEVEL_LOW, mp, dicp);
                 xfs_buf_relse(bp);
@@ -2361,13 +2570,13 @@ xlog_recover_inode_pass2(
         }
 
         /* The core is in in-core format */
-        xfs_dinode_to_disk(dip, item->ri_buf[1].i_addr);
+        xfs_dinode_to_disk(dip, dicp);
 
         /* the rest is in on-disk format */
-        if (item->ri_buf[1].i_len > sizeof(struct xfs_icdinode)) {
-                memcpy((xfs_caddr_t) dip + sizeof(struct xfs_icdinode),
-                        item->ri_buf[1].i_addr + sizeof(struct xfs_icdinode),
-                        item->ri_buf[1].i_len  - sizeof(struct xfs_icdinode));
+        if (item->ri_buf[1].i_len > isize) {
+                memcpy((char *)dip + isize,
+                        item->ri_buf[1].i_addr + isize,
+                        item->ri_buf[1].i_len - isize);
         }
 
         fields = in_f->ilf_fields;
@@ -2451,6 +2660,9 @@ xlog_recover_inode_pass2(
         }
 
 write_inode_buffer:
+        /* re-generate the checksum. */
+        xfs_dinode_calc_crc(log->l_mp, dip);
+
         ASSERT(bp->b_target->bt_mount == mp);
         bp->b_iodone = xlog_recover_iodone;
         xfs_buf_delwri_queue(bp, buffer_list);
@@ -2948,6 +3160,7 @@ xlog_recover_process_efi(
                          * This will pull the EFI from the AIL and
                          * free the memory associated with it.
                          */
+                        set_bit(XFS_EFI_RECOVERED, &efip->efi_flags);
                         xfs_efi_release(efip, efip->efi_format.efi_nextents);
                         return XFS_ERROR(EIO);
                 }
@@ -3751,6 +3964,25 @@ xlog_recover(
                         return error;
                 }
 
+                /*
+                 * Version 5 superblock log feature mask validation. We know the
+                 * log is dirty so check if there are any unknown log features
+                 * in what we need to recover. If there are unknown features
+                 * (e.g. unsupported transactions, then simply reject the
+                 * attempt at recovery before touching anything.
+                 */
+                if (XFS_SB_VERSION_NUM(&log->l_mp->m_sb) == XFS_SB_VERSION_5 &&
+                    xfs_sb_has_incompat_log_feature(&log->l_mp->m_sb,
+                                        XFS_SB_FEAT_INCOMPAT_LOG_UNKNOWN)) {
+                        xfs_warn(log->l_mp,
+"Superblock has unknown incompatible log features (0x%x) enabled.\n"
+"The log can not be fully and/or safely recovered by this kernel.\n"
+"Please recover the log on a kernel that supports the unknown features.",
+                                (log->l_mp->m_sb.sb_features_log_incompat &
+                                        XFS_SB_FEAT_INCOMPAT_LOG_UNKNOWN));
+                        return EINVAL;
+                }
+
                 xfs_notice(log->l_mp, "Starting recovery (logdev: %s)",
                                 log->l_mp->m_logname ? log->l_mp->m_logname
                                                      : "internal");