Qu Wenruo | 90eb4c0 | 2017-10-09 01:51:02 +0000 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) Qu Wenruo 2017. All rights reserved. |
| 3 | * |
| 4 | * This program is free software; you can redistribute it and/or |
| 5 | * modify it under the terms of the GNU General Public |
| 6 | * License v2 as published by the Free Software Foundation. |
| 7 | * |
| 8 | * This program is distributed in the hope that it will be useful, |
| 9 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 10 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
| 11 | * General Public License for more details. |
| 12 | * |
| 13 | * You should have received a copy of the GNU General Public |
| 14 | * License along with this program. |
| 15 | */ |
| 16 | |
| 17 | /* |
| 18 | * The module is used to catch unexpected/corrupted tree block data. |
| 19 | * Such behavior can be caused either by a fuzzed image or bugs. |
| 20 | * |
| 21 | * The objective is to do leaf/node validation checks when tree block is read |
| 22 | * from disk, and check *every* possible member, so other code won't |
| 23 | * need to checking them again. |
| 24 | * |
| 25 | * Due to the potential and unwanted damage, every checker needs to be |
| 26 | * carefully reviewed otherwise so it does not prevent mount of valid images. |
| 27 | */ |
| 28 | |
| 29 | #include "ctree.h" |
| 30 | #include "tree-checker.h" |
| 31 | #include "disk-io.h" |
| 32 | #include "compression.h" |
Qu Wenruo | e48e62f | 2017-11-08 08:54:25 +0800 | [diff] [blame] | 33 | #include "hash.h" |
Qu Wenruo | 058e388 | 2018-07-03 17:10:05 +0800 | [diff] [blame] | 34 | #include "volumes.h" |
Qu Wenruo | 90eb4c0 | 2017-10-09 01:51:02 +0000 | [diff] [blame] | 35 | |
| 36 | #define CORRUPT(reason, eb, root, slot) \ |
| 37 | btrfs_crit(root->fs_info, \ |
| 38 | "corrupt %s, %s: block=%llu, root=%llu, slot=%d", \ |
| 39 | btrfs_header_level(eb) == 0 ? "leaf" : "node", \ |
| 40 | reason, btrfs_header_bytenr(eb), root->objectid, slot) |
| 41 | |
Qu Wenruo | f4209d9 | 2017-10-09 01:51:03 +0000 | [diff] [blame] | 42 | /* |
| 43 | * Error message should follow the following format: |
| 44 | * corrupt <type>: <identifier>, <reason>[, <bad_value>] |
| 45 | * |
| 46 | * @type: leaf or node |
| 47 | * @identifier: the necessary info to locate the leaf/node. |
| 48 | * It's recommened to decode key.objecitd/offset if it's |
| 49 | * meaningful. |
| 50 | * @reason: describe the error |
| 51 | * @bad_value: optional, it's recommened to output bad value and its |
| 52 | * expected value (range). |
| 53 | * |
| 54 | * Since comma is used to separate the components, only space is allowed |
| 55 | * inside each component. |
| 56 | */ |
| 57 | |
| 58 | /* |
| 59 | * Append generic "corrupt leaf/node root=%llu block=%llu slot=%d: " to @fmt. |
| 60 | * Allows callers to customize the output. |
| 61 | */ |
| 62 | __printf(4, 5) |
| 63 | static void generic_err(const struct btrfs_root *root, |
| 64 | const struct extent_buffer *eb, int slot, |
| 65 | const char *fmt, ...) |
| 66 | { |
| 67 | struct va_format vaf; |
| 68 | va_list args; |
| 69 | |
| 70 | va_start(args, fmt); |
| 71 | |
| 72 | vaf.fmt = fmt; |
| 73 | vaf.va = &args; |
| 74 | |
| 75 | btrfs_crit(root->fs_info, |
| 76 | "corrupt %s: root=%llu block=%llu slot=%d, %pV", |
| 77 | btrfs_header_level(eb) == 0 ? "leaf" : "node", |
| 78 | root->objectid, btrfs_header_bytenr(eb), slot, &vaf); |
| 79 | va_end(args); |
| 80 | } |
| 81 | |
Qu Wenruo | 90eb4c0 | 2017-10-09 01:51:02 +0000 | [diff] [blame] | 82 | static int check_extent_data_item(struct btrfs_root *root, |
| 83 | struct extent_buffer *leaf, |
| 84 | struct btrfs_key *key, int slot) |
| 85 | { |
| 86 | struct btrfs_file_extent_item *fi; |
| 87 | u32 sectorsize = root->sectorsize; |
| 88 | u32 item_size = btrfs_item_size_nr(leaf, slot); |
| 89 | |
| 90 | if (!IS_ALIGNED(key->offset, sectorsize)) { |
| 91 | CORRUPT("unaligned key offset for file extent", |
| 92 | leaf, root, slot); |
| 93 | return -EUCLEAN; |
| 94 | } |
| 95 | |
| 96 | fi = btrfs_item_ptr(leaf, slot, struct btrfs_file_extent_item); |
| 97 | |
| 98 | if (btrfs_file_extent_type(leaf, fi) > BTRFS_FILE_EXTENT_TYPES) { |
| 99 | CORRUPT("invalid file extent type", leaf, root, slot); |
| 100 | return -EUCLEAN; |
| 101 | } |
| 102 | |
| 103 | /* |
| 104 | * Support for new compression/encrption must introduce incompat flag, |
| 105 | * and must be caught in open_ctree(). |
| 106 | */ |
| 107 | if (btrfs_file_extent_compression(leaf, fi) > BTRFS_COMPRESS_TYPES) { |
| 108 | CORRUPT("invalid file extent compression", leaf, root, slot); |
| 109 | return -EUCLEAN; |
| 110 | } |
| 111 | if (btrfs_file_extent_encryption(leaf, fi)) { |
| 112 | CORRUPT("invalid file extent encryption", leaf, root, slot); |
| 113 | return -EUCLEAN; |
| 114 | } |
| 115 | if (btrfs_file_extent_type(leaf, fi) == BTRFS_FILE_EXTENT_INLINE) { |
| 116 | /* Inline extent must have 0 as key offset */ |
| 117 | if (key->offset) { |
| 118 | CORRUPT("inline extent has non-zero key offset", |
| 119 | leaf, root, slot); |
| 120 | return -EUCLEAN; |
| 121 | } |
| 122 | |
| 123 | /* Compressed inline extent has no on-disk size, skip it */ |
| 124 | if (btrfs_file_extent_compression(leaf, fi) != |
| 125 | BTRFS_COMPRESS_NONE) |
| 126 | return 0; |
| 127 | |
| 128 | /* Uncompressed inline extent size must match item size */ |
| 129 | if (item_size != BTRFS_FILE_EXTENT_INLINE_DATA_START + |
| 130 | btrfs_file_extent_ram_bytes(leaf, fi)) { |
| 131 | CORRUPT("plaintext inline extent has invalid size", |
| 132 | leaf, root, slot); |
| 133 | return -EUCLEAN; |
| 134 | } |
| 135 | return 0; |
| 136 | } |
| 137 | |
| 138 | /* Regular or preallocated extent has fixed item size */ |
| 139 | if (item_size != sizeof(*fi)) { |
| 140 | CORRUPT( |
| 141 | "regluar or preallocated extent data item size is invalid", |
| 142 | leaf, root, slot); |
| 143 | return -EUCLEAN; |
| 144 | } |
| 145 | if (!IS_ALIGNED(btrfs_file_extent_ram_bytes(leaf, fi), sectorsize) || |
| 146 | !IS_ALIGNED(btrfs_file_extent_disk_bytenr(leaf, fi), sectorsize) || |
| 147 | !IS_ALIGNED(btrfs_file_extent_disk_num_bytes(leaf, fi), sectorsize) || |
| 148 | !IS_ALIGNED(btrfs_file_extent_offset(leaf, fi), sectorsize) || |
| 149 | !IS_ALIGNED(btrfs_file_extent_num_bytes(leaf, fi), sectorsize)) { |
| 150 | CORRUPT( |
| 151 | "regular or preallocated extent data item has unaligned value", |
| 152 | leaf, root, slot); |
| 153 | return -EUCLEAN; |
| 154 | } |
| 155 | |
| 156 | return 0; |
| 157 | } |
| 158 | |
| 159 | static int check_csum_item(struct btrfs_root *root, struct extent_buffer *leaf, |
| 160 | struct btrfs_key *key, int slot) |
| 161 | { |
| 162 | u32 sectorsize = root->sectorsize; |
| 163 | u32 csumsize = btrfs_super_csum_size(root->fs_info->super_copy); |
| 164 | |
| 165 | if (key->objectid != BTRFS_EXTENT_CSUM_OBJECTID) { |
| 166 | CORRUPT("invalid objectid for csum item", leaf, root, slot); |
| 167 | return -EUCLEAN; |
| 168 | } |
| 169 | if (!IS_ALIGNED(key->offset, sectorsize)) { |
| 170 | CORRUPT("unaligned key offset for csum item", leaf, root, slot); |
| 171 | return -EUCLEAN; |
| 172 | } |
| 173 | if (!IS_ALIGNED(btrfs_item_size_nr(leaf, slot), csumsize)) { |
| 174 | CORRUPT("unaligned csum item size", leaf, root, slot); |
| 175 | return -EUCLEAN; |
| 176 | } |
| 177 | return 0; |
| 178 | } |
| 179 | |
| 180 | /* |
Qu Wenruo | e48e62f | 2017-11-08 08:54:25 +0800 | [diff] [blame] | 181 | * Customized reported for dir_item, only important new info is key->objectid, |
| 182 | * which represents inode number |
| 183 | */ |
| 184 | __printf(4, 5) |
| 185 | static void dir_item_err(const struct btrfs_root *root, |
| 186 | const struct extent_buffer *eb, int slot, |
| 187 | const char *fmt, ...) |
| 188 | { |
| 189 | struct btrfs_key key; |
| 190 | struct va_format vaf; |
| 191 | va_list args; |
| 192 | |
| 193 | btrfs_item_key_to_cpu(eb, &key, slot); |
| 194 | va_start(args, fmt); |
| 195 | |
| 196 | vaf.fmt = fmt; |
| 197 | vaf.va = &args; |
| 198 | |
| 199 | btrfs_crit(root->fs_info, |
| 200 | "corrupt %s: root=%llu block=%llu slot=%d ino=%llu, %pV", |
| 201 | btrfs_header_level(eb) == 0 ? "leaf" : "node", root->objectid, |
| 202 | btrfs_header_bytenr(eb), slot, key.objectid, &vaf); |
| 203 | va_end(args); |
| 204 | } |
| 205 | |
| 206 | static int check_dir_item(struct btrfs_root *root, |
| 207 | struct extent_buffer *leaf, |
| 208 | struct btrfs_key *key, int slot) |
| 209 | { |
| 210 | struct btrfs_dir_item *di; |
| 211 | u32 item_size = btrfs_item_size_nr(leaf, slot); |
| 212 | u32 cur = 0; |
| 213 | |
| 214 | di = btrfs_item_ptr(leaf, slot, struct btrfs_dir_item); |
| 215 | while (cur < item_size) { |
Qu Wenruo | e48e62f | 2017-11-08 08:54:25 +0800 | [diff] [blame] | 216 | u32 name_len; |
| 217 | u32 data_len; |
| 218 | u32 max_name_len; |
| 219 | u32 total_size; |
| 220 | u32 name_hash; |
| 221 | u8 dir_type; |
| 222 | |
| 223 | /* header itself should not cross item boundary */ |
| 224 | if (cur + sizeof(*di) > item_size) { |
| 225 | dir_item_err(root, leaf, slot, |
Arnd Bergmann | 6b66f51 | 2017-12-06 15:18:14 +0100 | [diff] [blame] | 226 | "dir item header crosses item boundary, have %zu boundary %u", |
Qu Wenruo | e48e62f | 2017-11-08 08:54:25 +0800 | [diff] [blame] | 227 | cur + sizeof(*di), item_size); |
| 228 | return -EUCLEAN; |
| 229 | } |
| 230 | |
| 231 | /* dir type check */ |
| 232 | dir_type = btrfs_dir_type(leaf, di); |
| 233 | if (dir_type >= BTRFS_FT_MAX) { |
| 234 | dir_item_err(root, leaf, slot, |
| 235 | "invalid dir item type, have %u expect [0, %u)", |
| 236 | dir_type, BTRFS_FT_MAX); |
| 237 | return -EUCLEAN; |
| 238 | } |
| 239 | |
| 240 | if (key->type == BTRFS_XATTR_ITEM_KEY && |
| 241 | dir_type != BTRFS_FT_XATTR) { |
| 242 | dir_item_err(root, leaf, slot, |
| 243 | "invalid dir item type for XATTR key, have %u expect %u", |
| 244 | dir_type, BTRFS_FT_XATTR); |
| 245 | return -EUCLEAN; |
| 246 | } |
| 247 | if (dir_type == BTRFS_FT_XATTR && |
| 248 | key->type != BTRFS_XATTR_ITEM_KEY) { |
| 249 | dir_item_err(root, leaf, slot, |
| 250 | "xattr dir type found for non-XATTR key"); |
| 251 | return -EUCLEAN; |
| 252 | } |
| 253 | if (dir_type == BTRFS_FT_XATTR) |
| 254 | max_name_len = XATTR_NAME_MAX; |
| 255 | else |
| 256 | max_name_len = BTRFS_NAME_LEN; |
| 257 | |
| 258 | /* Name/data length check */ |
| 259 | name_len = btrfs_dir_name_len(leaf, di); |
| 260 | data_len = btrfs_dir_data_len(leaf, di); |
| 261 | if (name_len > max_name_len) { |
| 262 | dir_item_err(root, leaf, slot, |
| 263 | "dir item name len too long, have %u max %u", |
| 264 | name_len, max_name_len); |
| 265 | return -EUCLEAN; |
| 266 | } |
| 267 | if (name_len + data_len > BTRFS_MAX_XATTR_SIZE(root)) { |
| 268 | dir_item_err(root, leaf, slot, |
| 269 | "dir item name and data len too long, have %u max %u", |
| 270 | name_len + data_len, |
| 271 | BTRFS_MAX_XATTR_SIZE(root)); |
| 272 | return -EUCLEAN; |
| 273 | } |
| 274 | |
| 275 | if (data_len && dir_type != BTRFS_FT_XATTR) { |
| 276 | dir_item_err(root, leaf, slot, |
| 277 | "dir item with invalid data len, have %u expect 0", |
| 278 | data_len); |
| 279 | return -EUCLEAN; |
| 280 | } |
| 281 | |
| 282 | total_size = sizeof(*di) + name_len + data_len; |
| 283 | |
| 284 | /* header and name/data should not cross item boundary */ |
| 285 | if (cur + total_size > item_size) { |
| 286 | dir_item_err(root, leaf, slot, |
| 287 | "dir item data crosses item boundary, have %u boundary %u", |
| 288 | cur + total_size, item_size); |
| 289 | return -EUCLEAN; |
| 290 | } |
| 291 | |
| 292 | /* |
| 293 | * Special check for XATTR/DIR_ITEM, as key->offset is name |
| 294 | * hash, should match its name |
| 295 | */ |
| 296 | if (key->type == BTRFS_DIR_ITEM_KEY || |
| 297 | key->type == BTRFS_XATTR_ITEM_KEY) { |
David Sterba | db438c3 | 2018-01-10 15:13:07 +0100 | [diff] [blame] | 298 | char namebuf[max(BTRFS_NAME_LEN, XATTR_NAME_MAX)]; |
| 299 | |
Qu Wenruo | e48e62f | 2017-11-08 08:54:25 +0800 | [diff] [blame] | 300 | read_extent_buffer(leaf, namebuf, |
| 301 | (unsigned long)(di + 1), name_len); |
| 302 | name_hash = btrfs_name_hash(namebuf, name_len); |
| 303 | if (key->offset != name_hash) { |
| 304 | dir_item_err(root, leaf, slot, |
| 305 | "name hash mismatch with key, have 0x%016x expect 0x%016llx", |
| 306 | name_hash, key->offset); |
| 307 | return -EUCLEAN; |
| 308 | } |
| 309 | } |
| 310 | cur += total_size; |
| 311 | di = (struct btrfs_dir_item *)((void *)di + total_size); |
| 312 | } |
| 313 | return 0; |
| 314 | } |
| 315 | |
Qu Wenruo | 058e388 | 2018-07-03 17:10:05 +0800 | [diff] [blame] | 316 | __printf(4, 5) |
| 317 | __cold |
| 318 | static void block_group_err(const struct btrfs_fs_info *fs_info, |
| 319 | const struct extent_buffer *eb, int slot, |
| 320 | const char *fmt, ...) |
| 321 | { |
| 322 | struct btrfs_key key; |
| 323 | struct va_format vaf; |
| 324 | va_list args; |
| 325 | |
| 326 | btrfs_item_key_to_cpu(eb, &key, slot); |
| 327 | va_start(args, fmt); |
| 328 | |
| 329 | vaf.fmt = fmt; |
| 330 | vaf.va = &args; |
| 331 | |
| 332 | btrfs_crit(fs_info, |
| 333 | "corrupt %s: root=%llu block=%llu slot=%d bg_start=%llu bg_len=%llu, %pV", |
| 334 | btrfs_header_level(eb) == 0 ? "leaf" : "node", |
| 335 | btrfs_header_owner(eb), btrfs_header_bytenr(eb), slot, |
| 336 | key.objectid, key.offset, &vaf); |
| 337 | va_end(args); |
| 338 | } |
| 339 | |
| 340 | static int check_block_group_item(struct btrfs_fs_info *fs_info, |
| 341 | struct extent_buffer *leaf, |
| 342 | struct btrfs_key *key, int slot) |
| 343 | { |
| 344 | struct btrfs_block_group_item bgi; |
| 345 | u32 item_size = btrfs_item_size_nr(leaf, slot); |
| 346 | u64 flags; |
| 347 | u64 type; |
| 348 | |
| 349 | /* |
| 350 | * Here we don't really care about alignment since extent allocator can |
| 351 | * handle it. We care more about the size, as if one block group is |
| 352 | * larger than maximum size, it's must be some obvious corruption. |
| 353 | */ |
| 354 | if (key->offset > BTRFS_MAX_DATA_CHUNK_SIZE || key->offset == 0) { |
| 355 | block_group_err(fs_info, leaf, slot, |
| 356 | "invalid block group size, have %llu expect (0, %llu]", |
| 357 | key->offset, BTRFS_MAX_DATA_CHUNK_SIZE); |
| 358 | return -EUCLEAN; |
| 359 | } |
| 360 | |
| 361 | if (item_size != sizeof(bgi)) { |
| 362 | block_group_err(fs_info, leaf, slot, |
| 363 | "invalid item size, have %u expect %zu", |
| 364 | item_size, sizeof(bgi)); |
| 365 | return -EUCLEAN; |
| 366 | } |
| 367 | |
| 368 | read_extent_buffer(leaf, &bgi, btrfs_item_ptr_offset(leaf, slot), |
| 369 | sizeof(bgi)); |
| 370 | if (btrfs_block_group_chunk_objectid(&bgi) != |
| 371 | BTRFS_FIRST_CHUNK_TREE_OBJECTID) { |
| 372 | block_group_err(fs_info, leaf, slot, |
| 373 | "invalid block group chunk objectid, have %llu expect %llu", |
| 374 | btrfs_block_group_chunk_objectid(&bgi), |
| 375 | BTRFS_FIRST_CHUNK_TREE_OBJECTID); |
| 376 | return -EUCLEAN; |
| 377 | } |
| 378 | |
| 379 | if (btrfs_block_group_used(&bgi) > key->offset) { |
| 380 | block_group_err(fs_info, leaf, slot, |
| 381 | "invalid block group used, have %llu expect [0, %llu)", |
| 382 | btrfs_block_group_used(&bgi), key->offset); |
| 383 | return -EUCLEAN; |
| 384 | } |
| 385 | |
| 386 | flags = btrfs_block_group_flags(&bgi); |
| 387 | if (hweight64(flags & BTRFS_BLOCK_GROUP_PROFILE_MASK) > 1) { |
| 388 | block_group_err(fs_info, leaf, slot, |
| 389 | "invalid profile flags, have 0x%llx (%lu bits set) expect no more than 1 bit set", |
| 390 | flags & BTRFS_BLOCK_GROUP_PROFILE_MASK, |
| 391 | hweight64(flags & BTRFS_BLOCK_GROUP_PROFILE_MASK)); |
| 392 | return -EUCLEAN; |
| 393 | } |
| 394 | |
| 395 | type = flags & BTRFS_BLOCK_GROUP_TYPE_MASK; |
| 396 | if (type != BTRFS_BLOCK_GROUP_DATA && |
| 397 | type != BTRFS_BLOCK_GROUP_METADATA && |
| 398 | type != BTRFS_BLOCK_GROUP_SYSTEM && |
| 399 | type != (BTRFS_BLOCK_GROUP_METADATA | |
| 400 | BTRFS_BLOCK_GROUP_DATA)) { |
| 401 | block_group_err(fs_info, leaf, slot, |
Shaokun Zhang | d558df7 | 2018-11-05 18:49:09 +0800 | [diff] [blame] | 402 | "invalid type, have 0x%llx (%lu bits set) expect either 0x%llx, 0x%llx, 0x%llx or 0x%llx", |
Qu Wenruo | 058e388 | 2018-07-03 17:10:05 +0800 | [diff] [blame] | 403 | type, hweight64(type), |
| 404 | BTRFS_BLOCK_GROUP_DATA, BTRFS_BLOCK_GROUP_METADATA, |
| 405 | BTRFS_BLOCK_GROUP_SYSTEM, |
| 406 | BTRFS_BLOCK_GROUP_METADATA | BTRFS_BLOCK_GROUP_DATA); |
| 407 | return -EUCLEAN; |
| 408 | } |
| 409 | return 0; |
| 410 | } |
| 411 | |
Qu Wenruo | e48e62f | 2017-11-08 08:54:25 +0800 | [diff] [blame] | 412 | /* |
Qu Wenruo | 90eb4c0 | 2017-10-09 01:51:02 +0000 | [diff] [blame] | 413 | * Common point to switch the item-specific validation. |
| 414 | */ |
| 415 | static int check_leaf_item(struct btrfs_root *root, |
| 416 | struct extent_buffer *leaf, |
| 417 | struct btrfs_key *key, int slot) |
| 418 | { |
| 419 | int ret = 0; |
| 420 | |
| 421 | switch (key->type) { |
| 422 | case BTRFS_EXTENT_DATA_KEY: |
| 423 | ret = check_extent_data_item(root, leaf, key, slot); |
| 424 | break; |
| 425 | case BTRFS_EXTENT_CSUM_KEY: |
| 426 | ret = check_csum_item(root, leaf, key, slot); |
| 427 | break; |
Qu Wenruo | e48e62f | 2017-11-08 08:54:25 +0800 | [diff] [blame] | 428 | case BTRFS_DIR_ITEM_KEY: |
| 429 | case BTRFS_DIR_INDEX_KEY: |
| 430 | case BTRFS_XATTR_ITEM_KEY: |
| 431 | ret = check_dir_item(root, leaf, key, slot); |
| 432 | break; |
Qu Wenruo | 058e388 | 2018-07-03 17:10:05 +0800 | [diff] [blame] | 433 | case BTRFS_BLOCK_GROUP_ITEM_KEY: |
| 434 | ret = check_block_group_item(root->fs_info, leaf, key, slot); |
| 435 | break; |
Qu Wenruo | 90eb4c0 | 2017-10-09 01:51:02 +0000 | [diff] [blame] | 436 | } |
| 437 | return ret; |
| 438 | } |
| 439 | |
Qu Wenruo | f7438e6 | 2017-11-08 08:54:24 +0800 | [diff] [blame] | 440 | static int check_leaf(struct btrfs_root *root, struct extent_buffer *leaf, |
| 441 | bool check_item_data) |
Qu Wenruo | 90eb4c0 | 2017-10-09 01:51:02 +0000 | [diff] [blame] | 442 | { |
| 443 | struct btrfs_fs_info *fs_info = root->fs_info; |
| 444 | /* No valid key type is 0, so all key should be larger than this key */ |
| 445 | struct btrfs_key prev_key = {0, 0, 0}; |
| 446 | struct btrfs_key key; |
| 447 | u32 nritems = btrfs_header_nritems(leaf); |
| 448 | int slot; |
| 449 | |
Qu Wenruo | fbf8bd3 | 2018-09-28 07:59:34 +0800 | [diff] [blame] | 450 | if (btrfs_header_level(leaf) != 0) { |
| 451 | generic_err(root, leaf, 0, |
| 452 | "invalid level for leaf, have %d expect 0", |
| 453 | btrfs_header_level(leaf)); |
| 454 | return -EUCLEAN; |
| 455 | } |
| 456 | |
Qu Wenruo | 90eb4c0 | 2017-10-09 01:51:02 +0000 | [diff] [blame] | 457 | /* |
| 458 | * Extent buffers from a relocation tree have a owner field that |
| 459 | * corresponds to the subvolume tree they are based on. So just from an |
| 460 | * extent buffer alone we can not find out what is the id of the |
| 461 | * corresponding subvolume tree, so we can not figure out if the extent |
| 462 | * buffer corresponds to the root of the relocation tree or not. So |
| 463 | * skip this check for relocation trees. |
| 464 | */ |
| 465 | if (nritems == 0 && !btrfs_header_flag(leaf, BTRFS_HEADER_FLAG_RELOC)) { |
Qu Wenruo | 6f33d3d | 2018-07-03 17:10:06 +0800 | [diff] [blame] | 466 | u64 owner = btrfs_header_owner(leaf); |
Qu Wenruo | 90eb4c0 | 2017-10-09 01:51:02 +0000 | [diff] [blame] | 467 | struct btrfs_root *check_root; |
| 468 | |
Qu Wenruo | 6f33d3d | 2018-07-03 17:10:06 +0800 | [diff] [blame] | 469 | /* These trees must never be empty */ |
| 470 | if (owner == BTRFS_ROOT_TREE_OBJECTID || |
| 471 | owner == BTRFS_CHUNK_TREE_OBJECTID || |
| 472 | owner == BTRFS_EXTENT_TREE_OBJECTID || |
| 473 | owner == BTRFS_DEV_TREE_OBJECTID || |
| 474 | owner == BTRFS_FS_TREE_OBJECTID || |
| 475 | owner == BTRFS_DATA_RELOC_TREE_OBJECTID) { |
| 476 | generic_err(root, leaf, 0, |
| 477 | "invalid root, root %llu must never be empty", |
| 478 | owner); |
| 479 | return -EUCLEAN; |
| 480 | } |
| 481 | key.objectid = owner; |
Qu Wenruo | 90eb4c0 | 2017-10-09 01:51:02 +0000 | [diff] [blame] | 482 | key.type = BTRFS_ROOT_ITEM_KEY; |
| 483 | key.offset = (u64)-1; |
| 484 | |
| 485 | check_root = btrfs_get_fs_root(fs_info, &key, false); |
| 486 | /* |
| 487 | * The only reason we also check NULL here is that during |
| 488 | * open_ctree() some roots has not yet been set up. |
| 489 | */ |
| 490 | if (!IS_ERR_OR_NULL(check_root)) { |
| 491 | struct extent_buffer *eb; |
| 492 | |
| 493 | eb = btrfs_root_node(check_root); |
| 494 | /* if leaf is the root, then it's fine */ |
| 495 | if (leaf != eb) { |
| 496 | CORRUPT("non-root leaf's nritems is 0", |
| 497 | leaf, check_root, 0); |
| 498 | free_extent_buffer(eb); |
| 499 | return -EUCLEAN; |
| 500 | } |
| 501 | free_extent_buffer(eb); |
| 502 | } |
| 503 | return 0; |
| 504 | } |
| 505 | |
| 506 | if (nritems == 0) |
| 507 | return 0; |
| 508 | |
| 509 | /* |
| 510 | * Check the following things to make sure this is a good leaf, and |
| 511 | * leaf users won't need to bother with similar sanity checks: |
| 512 | * |
| 513 | * 1) key ordering |
| 514 | * 2) item offset and size |
| 515 | * No overlap, no hole, all inside the leaf. |
| 516 | * 3) item content |
| 517 | * If possible, do comprehensive sanity check. |
| 518 | * NOTE: All checks must only rely on the item data itself. |
| 519 | */ |
| 520 | for (slot = 0; slot < nritems; slot++) { |
| 521 | u32 item_end_expected; |
| 522 | int ret; |
| 523 | |
| 524 | btrfs_item_key_to_cpu(leaf, &key, slot); |
| 525 | |
| 526 | /* Make sure the keys are in the right order */ |
| 527 | if (btrfs_comp_cpu_keys(&prev_key, &key) >= 0) { |
| 528 | CORRUPT("bad key order", leaf, root, slot); |
| 529 | return -EUCLEAN; |
| 530 | } |
| 531 | |
| 532 | /* |
| 533 | * Make sure the offset and ends are right, remember that the |
| 534 | * item data starts at the end of the leaf and grows towards the |
| 535 | * front. |
| 536 | */ |
| 537 | if (slot == 0) |
| 538 | item_end_expected = BTRFS_LEAF_DATA_SIZE(root); |
| 539 | else |
| 540 | item_end_expected = btrfs_item_offset_nr(leaf, |
| 541 | slot - 1); |
| 542 | if (btrfs_item_end_nr(leaf, slot) != item_end_expected) { |
| 543 | CORRUPT("slot offset bad", leaf, root, slot); |
| 544 | return -EUCLEAN; |
| 545 | } |
| 546 | |
| 547 | /* |
| 548 | * Check to make sure that we don't point outside of the leaf, |
| 549 | * just in case all the items are consistent to each other, but |
| 550 | * all point outside of the leaf. |
| 551 | */ |
| 552 | if (btrfs_item_end_nr(leaf, slot) > |
| 553 | BTRFS_LEAF_DATA_SIZE(root)) { |
| 554 | CORRUPT("slot end outside of leaf", leaf, root, slot); |
| 555 | return -EUCLEAN; |
| 556 | } |
| 557 | |
| 558 | /* Also check if the item pointer overlaps with btrfs item. */ |
| 559 | if (btrfs_item_nr_offset(slot) + sizeof(struct btrfs_item) > |
| 560 | btrfs_item_ptr_offset(leaf, slot)) { |
| 561 | CORRUPT("slot overlap with its data", leaf, root, slot); |
| 562 | return -EUCLEAN; |
| 563 | } |
| 564 | |
Qu Wenruo | f7438e6 | 2017-11-08 08:54:24 +0800 | [diff] [blame] | 565 | if (check_item_data) { |
| 566 | /* |
| 567 | * Check if the item size and content meet other |
| 568 | * criteria |
| 569 | */ |
| 570 | ret = check_leaf_item(root, leaf, &key, slot); |
| 571 | if (ret < 0) |
| 572 | return ret; |
| 573 | } |
Qu Wenruo | 90eb4c0 | 2017-10-09 01:51:02 +0000 | [diff] [blame] | 574 | |
| 575 | prev_key.objectid = key.objectid; |
| 576 | prev_key.type = key.type; |
| 577 | prev_key.offset = key.offset; |
| 578 | } |
| 579 | |
| 580 | return 0; |
| 581 | } |
| 582 | |
Qu Wenruo | f7438e6 | 2017-11-08 08:54:24 +0800 | [diff] [blame] | 583 | int btrfs_check_leaf_full(struct btrfs_root *root, struct extent_buffer *leaf) |
| 584 | { |
| 585 | return check_leaf(root, leaf, true); |
| 586 | } |
| 587 | |
| 588 | int btrfs_check_leaf_relaxed(struct btrfs_root *root, |
| 589 | struct extent_buffer *leaf) |
| 590 | { |
| 591 | return check_leaf(root, leaf, false); |
| 592 | } |
| 593 | |
Qu Wenruo | 90eb4c0 | 2017-10-09 01:51:02 +0000 | [diff] [blame] | 594 | int btrfs_check_node(struct btrfs_root *root, struct extent_buffer *node) |
| 595 | { |
| 596 | unsigned long nr = btrfs_header_nritems(node); |
| 597 | struct btrfs_key key, next_key; |
| 598 | int slot; |
Qu Wenruo | fbf8bd3 | 2018-09-28 07:59:34 +0800 | [diff] [blame] | 599 | int level = btrfs_header_level(node); |
Qu Wenruo | 90eb4c0 | 2017-10-09 01:51:02 +0000 | [diff] [blame] | 600 | u64 bytenr; |
| 601 | int ret = 0; |
| 602 | |
Qu Wenruo | fbf8bd3 | 2018-09-28 07:59:34 +0800 | [diff] [blame] | 603 | if (level <= 0 || level >= BTRFS_MAX_LEVEL) { |
| 604 | generic_err(root, node, 0, |
| 605 | "invalid level for node, have %d expect [1, %d]", |
| 606 | level, BTRFS_MAX_LEVEL - 1); |
| 607 | return -EUCLEAN; |
| 608 | } |
Qu Wenruo | 90eb4c0 | 2017-10-09 01:51:02 +0000 | [diff] [blame] | 609 | if (nr == 0 || nr > BTRFS_NODEPTRS_PER_BLOCK(root)) { |
| 610 | btrfs_crit(root->fs_info, |
Qu Wenruo | f4209d9 | 2017-10-09 01:51:03 +0000 | [diff] [blame] | 611 | "corrupt node: root=%llu block=%llu, nritems too %s, have %lu expect range [1,%u]", |
| 612 | root->objectid, node->start, |
| 613 | nr == 0 ? "small" : "large", nr, |
| 614 | BTRFS_NODEPTRS_PER_BLOCK(root)); |
| 615 | return -EUCLEAN; |
Qu Wenruo | 90eb4c0 | 2017-10-09 01:51:02 +0000 | [diff] [blame] | 616 | } |
| 617 | |
| 618 | for (slot = 0; slot < nr - 1; slot++) { |
| 619 | bytenr = btrfs_node_blockptr(node, slot); |
| 620 | btrfs_node_key_to_cpu(node, &key, slot); |
| 621 | btrfs_node_key_to_cpu(node, &next_key, slot + 1); |
| 622 | |
| 623 | if (!bytenr) { |
Qu Wenruo | f4209d9 | 2017-10-09 01:51:03 +0000 | [diff] [blame] | 624 | generic_err(root, node, slot, |
| 625 | "invalid NULL node pointer"); |
| 626 | ret = -EUCLEAN; |
| 627 | goto out; |
| 628 | } |
| 629 | if (!IS_ALIGNED(bytenr, root->sectorsize)) { |
| 630 | generic_err(root, node, slot, |
| 631 | "unaligned pointer, have %llu should be aligned to %u", |
| 632 | bytenr, root->sectorsize); |
| 633 | ret = -EUCLEAN; |
Qu Wenruo | 90eb4c0 | 2017-10-09 01:51:02 +0000 | [diff] [blame] | 634 | goto out; |
| 635 | } |
| 636 | |
| 637 | if (btrfs_comp_cpu_keys(&key, &next_key) >= 0) { |
Qu Wenruo | f4209d9 | 2017-10-09 01:51:03 +0000 | [diff] [blame] | 638 | generic_err(root, node, slot, |
| 639 | "bad key order, current (%llu %u %llu) next (%llu %u %llu)", |
| 640 | key.objectid, key.type, key.offset, |
| 641 | next_key.objectid, next_key.type, |
| 642 | next_key.offset); |
| 643 | ret = -EUCLEAN; |
Qu Wenruo | 90eb4c0 | 2017-10-09 01:51:02 +0000 | [diff] [blame] | 644 | goto out; |
| 645 | } |
| 646 | } |
| 647 | out: |
| 648 | return ret; |
| 649 | } |