1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Copyright (C) Qu Wenruo 2017. All rights reserved. 4 */ 5 6 /* 7 * The module is used to catch unexpected/corrupted tree block data. 8 * Such behavior can be caused either by a fuzzed image or bugs. 9 * 10 * The objective is to do leaf/node validation checks when tree block is read 11 * from disk, and check *every* possible member, so other code won't 12 * need to checking them again. 13 * 14 * Due to the potential and unwanted damage, every checker needs to be 15 * carefully reviewed otherwise so it does not prevent mount of valid images. 16 */ 17 18 #include <linux/types.h> 19 #include <linux/stddef.h> 20 #include <linux/error-injection.h> 21 #include "ctree.h" 22 #include "tree-checker.h" 23 #include "disk-io.h" 24 #include "compression.h" 25 #include "volumes.h" 26 #include "misc.h" 27 28 /* 29 * Error message should follow the following format: 30 * corrupt <type>: <identifier>, <reason>[, <bad_value>] 31 * 32 * @type: leaf or node 33 * @identifier: the necessary info to locate the leaf/node. 34 * It's recommended to decode key.objecitd/offset if it's 35 * meaningful. 36 * @reason: describe the error 37 * @bad_value: optional, it's recommended to output bad value and its 38 * expected value (range). 39 * 40 * Since comma is used to separate the components, only space is allowed 41 * inside each component. 42 */ 43 44 /* 45 * Append generic "corrupt leaf/node root=%llu block=%llu slot=%d: " to @fmt. 46 * Allows callers to customize the output. 47 */ 48 __printf(3, 4) 49 __cold 50 static void generic_err(const struct extent_buffer *eb, int slot, 51 const char *fmt, ...) 52 { 53 const struct btrfs_fs_info *fs_info = eb->fs_info; 54 struct va_format vaf; 55 va_list args; 56 57 va_start(args, fmt); 58 59 vaf.fmt = fmt; 60 vaf.va = &args; 61 62 btrfs_crit(fs_info, 63 "corrupt %s: root=%llu block=%llu slot=%d, %pV", 64 btrfs_header_level(eb) == 0 ? "leaf" : "node", 65 btrfs_header_owner(eb), btrfs_header_bytenr(eb), slot, &vaf); 66 va_end(args); 67 } 68 69 /* 70 * Customized reporter for extent data item, since its key objectid and 71 * offset has its own meaning. 72 */ 73 __printf(3, 4) 74 __cold 75 static void file_extent_err(const struct extent_buffer *eb, int slot, 76 const char *fmt, ...) 77 { 78 const struct btrfs_fs_info *fs_info = eb->fs_info; 79 struct btrfs_key key; 80 struct va_format vaf; 81 va_list args; 82 83 btrfs_item_key_to_cpu(eb, &key, slot); 84 va_start(args, fmt); 85 86 vaf.fmt = fmt; 87 vaf.va = &args; 88 89 btrfs_crit(fs_info, 90 "corrupt %s: root=%llu block=%llu slot=%d ino=%llu file_offset=%llu, %pV", 91 btrfs_header_level(eb) == 0 ? "leaf" : "node", 92 btrfs_header_owner(eb), btrfs_header_bytenr(eb), slot, 93 key.objectid, key.offset, &vaf); 94 va_end(args); 95 } 96 97 /* 98 * Return 0 if the btrfs_file_extent_##name is aligned to @alignment 99 * Else return 1 100 */ 101 #define CHECK_FE_ALIGNED(leaf, slot, fi, name, alignment) \ 102 ({ \ 103 if (!IS_ALIGNED(btrfs_file_extent_##name((leaf), (fi)), (alignment))) \ 104 file_extent_err((leaf), (slot), \ 105 "invalid %s for file extent, have %llu, should be aligned to %u", \ 106 (#name), btrfs_file_extent_##name((leaf), (fi)), \ 107 (alignment)); \ 108 (!IS_ALIGNED(btrfs_file_extent_##name((leaf), (fi)), (alignment))); \ 109 }) 110 111 static u64 file_extent_end(struct extent_buffer *leaf, 112 struct btrfs_key *key, 113 struct btrfs_file_extent_item *extent) 114 { 115 u64 end; 116 u64 len; 117 118 if (btrfs_file_extent_type(leaf, extent) == BTRFS_FILE_EXTENT_INLINE) { 119 len = btrfs_file_extent_ram_bytes(leaf, extent); 120 end = ALIGN(key->offset + len, leaf->fs_info->sectorsize); 121 } else { 122 len = btrfs_file_extent_num_bytes(leaf, extent); 123 end = key->offset + len; 124 } 125 return end; 126 } 127 128 /* 129 * Customized report for dir_item, the only new important information is 130 * key->objectid, which represents inode number 131 */ 132 __printf(3, 4) 133 __cold 134 static void dir_item_err(const struct extent_buffer *eb, int slot, 135 const char *fmt, ...) 136 { 137 const struct btrfs_fs_info *fs_info = eb->fs_info; 138 struct btrfs_key key; 139 struct va_format vaf; 140 va_list args; 141 142 btrfs_item_key_to_cpu(eb, &key, slot); 143 va_start(args, fmt); 144 145 vaf.fmt = fmt; 146 vaf.va = &args; 147 148 btrfs_crit(fs_info, 149 "corrupt %s: root=%llu block=%llu slot=%d ino=%llu, %pV", 150 btrfs_header_level(eb) == 0 ? "leaf" : "node", 151 btrfs_header_owner(eb), btrfs_header_bytenr(eb), slot, 152 key.objectid, &vaf); 153 va_end(args); 154 } 155 156 /* 157 * This functions checks prev_key->objectid, to ensure current key and prev_key 158 * share the same objectid as inode number. 159 * 160 * This is to detect missing INODE_ITEM in subvolume trees. 161 * 162 * Return true if everything is OK or we don't need to check. 163 * Return false if anything is wrong. 164 */ 165 static bool check_prev_ino(struct extent_buffer *leaf, 166 struct btrfs_key *key, int slot, 167 struct btrfs_key *prev_key) 168 { 169 /* No prev key, skip check */ 170 if (slot == 0) 171 return true; 172 173 /* Only these key->types needs to be checked */ 174 ASSERT(key->type == BTRFS_XATTR_ITEM_KEY || 175 key->type == BTRFS_INODE_REF_KEY || 176 key->type == BTRFS_DIR_INDEX_KEY || 177 key->type == BTRFS_DIR_ITEM_KEY || 178 key->type == BTRFS_EXTENT_DATA_KEY); 179 180 /* 181 * Only subvolume trees along with their reloc trees need this check. 182 * Things like log tree doesn't follow this ino requirement. 183 */ 184 if (!is_fstree(btrfs_header_owner(leaf))) 185 return true; 186 187 if (key->objectid == prev_key->objectid) 188 return true; 189 190 /* Error found */ 191 dir_item_err(leaf, slot, 192 "invalid previous key objectid, have %llu expect %llu", 193 prev_key->objectid, key->objectid); 194 return false; 195 } 196 static int check_extent_data_item(struct extent_buffer *leaf, 197 struct btrfs_key *key, int slot, 198 struct btrfs_key *prev_key) 199 { 200 struct btrfs_fs_info *fs_info = leaf->fs_info; 201 struct btrfs_file_extent_item *fi; 202 u32 sectorsize = fs_info->sectorsize; 203 u32 item_size = btrfs_item_size_nr(leaf, slot); 204 u64 extent_end; 205 206 if (!IS_ALIGNED(key->offset, sectorsize)) { 207 file_extent_err(leaf, slot, 208 "unaligned file_offset for file extent, have %llu should be aligned to %u", 209 key->offset, sectorsize); 210 return -EUCLEAN; 211 } 212 213 /* 214 * Previous key must have the same key->objectid (ino). 215 * It can be XATTR_ITEM, INODE_ITEM or just another EXTENT_DATA. 216 * But if objectids mismatch, it means we have a missing 217 * INODE_ITEM. 218 */ 219 if (!check_prev_ino(leaf, key, slot, prev_key)) 220 return -EUCLEAN; 221 222 fi = btrfs_item_ptr(leaf, slot, struct btrfs_file_extent_item); 223 224 /* 225 * Make sure the item contains at least inline header, so the file 226 * extent type is not some garbage. 227 */ 228 if (item_size < BTRFS_FILE_EXTENT_INLINE_DATA_START) { 229 file_extent_err(leaf, slot, 230 "invalid item size, have %u expect [%zu, %u)", 231 item_size, BTRFS_FILE_EXTENT_INLINE_DATA_START, 232 SZ_4K); 233 return -EUCLEAN; 234 } 235 if (btrfs_file_extent_type(leaf, fi) >= BTRFS_NR_FILE_EXTENT_TYPES) { 236 file_extent_err(leaf, slot, 237 "invalid type for file extent, have %u expect range [0, %u]", 238 btrfs_file_extent_type(leaf, fi), 239 BTRFS_NR_FILE_EXTENT_TYPES - 1); 240 return -EUCLEAN; 241 } 242 243 /* 244 * Support for new compression/encryption must introduce incompat flag, 245 * and must be caught in open_ctree(). 246 */ 247 if (btrfs_file_extent_compression(leaf, fi) >= BTRFS_NR_COMPRESS_TYPES) { 248 file_extent_err(leaf, slot, 249 "invalid compression for file extent, have %u expect range [0, %u]", 250 btrfs_file_extent_compression(leaf, fi), 251 BTRFS_NR_COMPRESS_TYPES - 1); 252 return -EUCLEAN; 253 } 254 if (btrfs_file_extent_encryption(leaf, fi)) { 255 file_extent_err(leaf, slot, 256 "invalid encryption for file extent, have %u expect 0", 257 btrfs_file_extent_encryption(leaf, fi)); 258 return -EUCLEAN; 259 } 260 if (btrfs_file_extent_type(leaf, fi) == BTRFS_FILE_EXTENT_INLINE) { 261 /* Inline extent must have 0 as key offset */ 262 if (key->offset) { 263 file_extent_err(leaf, slot, 264 "invalid file_offset for inline file extent, have %llu expect 0", 265 key->offset); 266 return -EUCLEAN; 267 } 268 269 /* Compressed inline extent has no on-disk size, skip it */ 270 if (btrfs_file_extent_compression(leaf, fi) != 271 BTRFS_COMPRESS_NONE) 272 return 0; 273 274 /* Uncompressed inline extent size must match item size */ 275 if (item_size != BTRFS_FILE_EXTENT_INLINE_DATA_START + 276 btrfs_file_extent_ram_bytes(leaf, fi)) { 277 file_extent_err(leaf, slot, 278 "invalid ram_bytes for uncompressed inline extent, have %u expect %llu", 279 item_size, BTRFS_FILE_EXTENT_INLINE_DATA_START + 280 btrfs_file_extent_ram_bytes(leaf, fi)); 281 return -EUCLEAN; 282 } 283 return 0; 284 } 285 286 /* Regular or preallocated extent has fixed item size */ 287 if (item_size != sizeof(*fi)) { 288 file_extent_err(leaf, slot, 289 "invalid item size for reg/prealloc file extent, have %u expect %zu", 290 item_size, sizeof(*fi)); 291 return -EUCLEAN; 292 } 293 if (CHECK_FE_ALIGNED(leaf, slot, fi, ram_bytes, sectorsize) || 294 CHECK_FE_ALIGNED(leaf, slot, fi, disk_bytenr, sectorsize) || 295 CHECK_FE_ALIGNED(leaf, slot, fi, disk_num_bytes, sectorsize) || 296 CHECK_FE_ALIGNED(leaf, slot, fi, offset, sectorsize) || 297 CHECK_FE_ALIGNED(leaf, slot, fi, num_bytes, sectorsize)) 298 return -EUCLEAN; 299 300 /* Catch extent end overflow */ 301 if (check_add_overflow(btrfs_file_extent_num_bytes(leaf, fi), 302 key->offset, &extent_end)) { 303 file_extent_err(leaf, slot, 304 "extent end overflow, have file offset %llu extent num bytes %llu", 305 key->offset, 306 btrfs_file_extent_num_bytes(leaf, fi)); 307 return -EUCLEAN; 308 } 309 310 /* 311 * Check that no two consecutive file extent items, in the same leaf, 312 * present ranges that overlap each other. 313 */ 314 if (slot > 0 && 315 prev_key->objectid == key->objectid && 316 prev_key->type == BTRFS_EXTENT_DATA_KEY) { 317 struct btrfs_file_extent_item *prev_fi; 318 u64 prev_end; 319 320 prev_fi = btrfs_item_ptr(leaf, slot - 1, 321 struct btrfs_file_extent_item); 322 prev_end = file_extent_end(leaf, prev_key, prev_fi); 323 if (prev_end > key->offset) { 324 file_extent_err(leaf, slot - 1, 325 "file extent end range (%llu) goes beyond start offset (%llu) of the next file extent", 326 prev_end, key->offset); 327 return -EUCLEAN; 328 } 329 } 330 331 return 0; 332 } 333 334 static int check_csum_item(struct extent_buffer *leaf, struct btrfs_key *key, 335 int slot, struct btrfs_key *prev_key) 336 { 337 struct btrfs_fs_info *fs_info = leaf->fs_info; 338 u32 sectorsize = fs_info->sectorsize; 339 u32 csumsize = btrfs_super_csum_size(fs_info->super_copy); 340 341 if (key->objectid != BTRFS_EXTENT_CSUM_OBJECTID) { 342 generic_err(leaf, slot, 343 "invalid key objectid for csum item, have %llu expect %llu", 344 key->objectid, BTRFS_EXTENT_CSUM_OBJECTID); 345 return -EUCLEAN; 346 } 347 if (!IS_ALIGNED(key->offset, sectorsize)) { 348 generic_err(leaf, slot, 349 "unaligned key offset for csum item, have %llu should be aligned to %u", 350 key->offset, sectorsize); 351 return -EUCLEAN; 352 } 353 if (!IS_ALIGNED(btrfs_item_size_nr(leaf, slot), csumsize)) { 354 generic_err(leaf, slot, 355 "unaligned item size for csum item, have %u should be aligned to %u", 356 btrfs_item_size_nr(leaf, slot), csumsize); 357 return -EUCLEAN; 358 } 359 if (slot > 0 && prev_key->type == BTRFS_EXTENT_CSUM_KEY) { 360 u64 prev_csum_end; 361 u32 prev_item_size; 362 363 prev_item_size = btrfs_item_size_nr(leaf, slot - 1); 364 prev_csum_end = (prev_item_size / csumsize) * sectorsize; 365 prev_csum_end += prev_key->offset; 366 if (prev_csum_end > key->offset) { 367 generic_err(leaf, slot - 1, 368 "csum end range (%llu) goes beyond the start range (%llu) of the next csum item", 369 prev_csum_end, key->offset); 370 return -EUCLEAN; 371 } 372 } 373 return 0; 374 } 375 376 static int check_dir_item(struct extent_buffer *leaf, 377 struct btrfs_key *key, struct btrfs_key *prev_key, 378 int slot) 379 { 380 struct btrfs_fs_info *fs_info = leaf->fs_info; 381 struct btrfs_dir_item *di; 382 u32 item_size = btrfs_item_size_nr(leaf, slot); 383 u32 cur = 0; 384 385 if (!check_prev_ino(leaf, key, slot, prev_key)) 386 return -EUCLEAN; 387 di = btrfs_item_ptr(leaf, slot, struct btrfs_dir_item); 388 while (cur < item_size) { 389 u32 name_len; 390 u32 data_len; 391 u32 max_name_len; 392 u32 total_size; 393 u32 name_hash; 394 u8 dir_type; 395 396 /* header itself should not cross item boundary */ 397 if (cur + sizeof(*di) > item_size) { 398 dir_item_err(leaf, slot, 399 "dir item header crosses item boundary, have %zu boundary %u", 400 cur + sizeof(*di), item_size); 401 return -EUCLEAN; 402 } 403 404 /* dir type check */ 405 dir_type = btrfs_dir_type(leaf, di); 406 if (dir_type >= BTRFS_FT_MAX) { 407 dir_item_err(leaf, slot, 408 "invalid dir item type, have %u expect [0, %u)", 409 dir_type, BTRFS_FT_MAX); 410 return -EUCLEAN; 411 } 412 413 if (key->type == BTRFS_XATTR_ITEM_KEY && 414 dir_type != BTRFS_FT_XATTR) { 415 dir_item_err(leaf, slot, 416 "invalid dir item type for XATTR key, have %u expect %u", 417 dir_type, BTRFS_FT_XATTR); 418 return -EUCLEAN; 419 } 420 if (dir_type == BTRFS_FT_XATTR && 421 key->type != BTRFS_XATTR_ITEM_KEY) { 422 dir_item_err(leaf, slot, 423 "xattr dir type found for non-XATTR key"); 424 return -EUCLEAN; 425 } 426 if (dir_type == BTRFS_FT_XATTR) 427 max_name_len = XATTR_NAME_MAX; 428 else 429 max_name_len = BTRFS_NAME_LEN; 430 431 /* Name/data length check */ 432 name_len = btrfs_dir_name_len(leaf, di); 433 data_len = btrfs_dir_data_len(leaf, di); 434 if (name_len > max_name_len) { 435 dir_item_err(leaf, slot, 436 "dir item name len too long, have %u max %u", 437 name_len, max_name_len); 438 return -EUCLEAN; 439 } 440 if (name_len + data_len > BTRFS_MAX_XATTR_SIZE(fs_info)) { 441 dir_item_err(leaf, slot, 442 "dir item name and data len too long, have %u max %u", 443 name_len + data_len, 444 BTRFS_MAX_XATTR_SIZE(fs_info)); 445 return -EUCLEAN; 446 } 447 448 if (data_len && dir_type != BTRFS_FT_XATTR) { 449 dir_item_err(leaf, slot, 450 "dir item with invalid data len, have %u expect 0", 451 data_len); 452 return -EUCLEAN; 453 } 454 455 total_size = sizeof(*di) + name_len + data_len; 456 457 /* header and name/data should not cross item boundary */ 458 if (cur + total_size > item_size) { 459 dir_item_err(leaf, slot, 460 "dir item data crosses item boundary, have %u boundary %u", 461 cur + total_size, item_size); 462 return -EUCLEAN; 463 } 464 465 /* 466 * Special check for XATTR/DIR_ITEM, as key->offset is name 467 * hash, should match its name 468 */ 469 if (key->type == BTRFS_DIR_ITEM_KEY || 470 key->type == BTRFS_XATTR_ITEM_KEY) { 471 char namebuf[max(BTRFS_NAME_LEN, XATTR_NAME_MAX)]; 472 473 read_extent_buffer(leaf, namebuf, 474 (unsigned long)(di + 1), name_len); 475 name_hash = btrfs_name_hash(namebuf, name_len); 476 if (key->offset != name_hash) { 477 dir_item_err(leaf, slot, 478 "name hash mismatch with key, have 0x%016x expect 0x%016llx", 479 name_hash, key->offset); 480 return -EUCLEAN; 481 } 482 } 483 cur += total_size; 484 di = (struct btrfs_dir_item *)((void *)di + total_size); 485 } 486 return 0; 487 } 488 489 __printf(3, 4) 490 __cold 491 static void block_group_err(const struct extent_buffer *eb, int slot, 492 const char *fmt, ...) 493 { 494 const struct btrfs_fs_info *fs_info = eb->fs_info; 495 struct btrfs_key key; 496 struct va_format vaf; 497 va_list args; 498 499 btrfs_item_key_to_cpu(eb, &key, slot); 500 va_start(args, fmt); 501 502 vaf.fmt = fmt; 503 vaf.va = &args; 504 505 btrfs_crit(fs_info, 506 "corrupt %s: root=%llu block=%llu slot=%d bg_start=%llu bg_len=%llu, %pV", 507 btrfs_header_level(eb) == 0 ? "leaf" : "node", 508 btrfs_header_owner(eb), btrfs_header_bytenr(eb), slot, 509 key.objectid, key.offset, &vaf); 510 va_end(args); 511 } 512 513 static int check_block_group_item(struct extent_buffer *leaf, 514 struct btrfs_key *key, int slot) 515 { 516 struct btrfs_block_group_item bgi; 517 u32 item_size = btrfs_item_size_nr(leaf, slot); 518 u64 flags; 519 u64 type; 520 521 /* 522 * Here we don't really care about alignment since extent allocator can 523 * handle it. We care more about the size. 524 */ 525 if (key->offset == 0) { 526 block_group_err(leaf, slot, 527 "invalid block group size 0"); 528 return -EUCLEAN; 529 } 530 531 if (item_size != sizeof(bgi)) { 532 block_group_err(leaf, slot, 533 "invalid item size, have %u expect %zu", 534 item_size, sizeof(bgi)); 535 return -EUCLEAN; 536 } 537 538 read_extent_buffer(leaf, &bgi, btrfs_item_ptr_offset(leaf, slot), 539 sizeof(bgi)); 540 if (btrfs_stack_block_group_chunk_objectid(&bgi) != 541 BTRFS_FIRST_CHUNK_TREE_OBJECTID) { 542 block_group_err(leaf, slot, 543 "invalid block group chunk objectid, have %llu expect %llu", 544 btrfs_stack_block_group_chunk_objectid(&bgi), 545 BTRFS_FIRST_CHUNK_TREE_OBJECTID); 546 return -EUCLEAN; 547 } 548 549 if (btrfs_stack_block_group_used(&bgi) > key->offset) { 550 block_group_err(leaf, slot, 551 "invalid block group used, have %llu expect [0, %llu)", 552 btrfs_stack_block_group_used(&bgi), key->offset); 553 return -EUCLEAN; 554 } 555 556 flags = btrfs_stack_block_group_flags(&bgi); 557 if (hweight64(flags & BTRFS_BLOCK_GROUP_PROFILE_MASK) > 1) { 558 block_group_err(leaf, slot, 559 "invalid profile flags, have 0x%llx (%lu bits set) expect no more than 1 bit set", 560 flags & BTRFS_BLOCK_GROUP_PROFILE_MASK, 561 hweight64(flags & BTRFS_BLOCK_GROUP_PROFILE_MASK)); 562 return -EUCLEAN; 563 } 564 565 type = flags & BTRFS_BLOCK_GROUP_TYPE_MASK; 566 if (type != BTRFS_BLOCK_GROUP_DATA && 567 type != BTRFS_BLOCK_GROUP_METADATA && 568 type != BTRFS_BLOCK_GROUP_SYSTEM && 569 type != (BTRFS_BLOCK_GROUP_METADATA | 570 BTRFS_BLOCK_GROUP_DATA)) { 571 block_group_err(leaf, slot, 572 "invalid type, have 0x%llx (%lu bits set) expect either 0x%llx, 0x%llx, 0x%llx or 0x%llx", 573 type, hweight64(type), 574 BTRFS_BLOCK_GROUP_DATA, BTRFS_BLOCK_GROUP_METADATA, 575 BTRFS_BLOCK_GROUP_SYSTEM, 576 BTRFS_BLOCK_GROUP_METADATA | BTRFS_BLOCK_GROUP_DATA); 577 return -EUCLEAN; 578 } 579 return 0; 580 } 581 582 __printf(4, 5) 583 __cold 584 static void chunk_err(const struct extent_buffer *leaf, 585 const struct btrfs_chunk *chunk, u64 logical, 586 const char *fmt, ...) 587 { 588 const struct btrfs_fs_info *fs_info = leaf->fs_info; 589 bool is_sb; 590 struct va_format vaf; 591 va_list args; 592 int i; 593 int slot = -1; 594 595 /* Only superblock eb is able to have such small offset */ 596 is_sb = (leaf->start == BTRFS_SUPER_INFO_OFFSET); 597 598 if (!is_sb) { 599 /* 600 * Get the slot number by iterating through all slots, this 601 * would provide better readability. 602 */ 603 for (i = 0; i < btrfs_header_nritems(leaf); i++) { 604 if (btrfs_item_ptr_offset(leaf, i) == 605 (unsigned long)chunk) { 606 slot = i; 607 break; 608 } 609 } 610 } 611 va_start(args, fmt); 612 vaf.fmt = fmt; 613 vaf.va = &args; 614 615 if (is_sb) 616 btrfs_crit(fs_info, 617 "corrupt superblock syschunk array: chunk_start=%llu, %pV", 618 logical, &vaf); 619 else 620 btrfs_crit(fs_info, 621 "corrupt leaf: root=%llu block=%llu slot=%d chunk_start=%llu, %pV", 622 BTRFS_CHUNK_TREE_OBJECTID, leaf->start, slot, 623 logical, &vaf); 624 va_end(args); 625 } 626 627 /* 628 * The common chunk check which could also work on super block sys chunk array. 629 * 630 * Return -EUCLEAN if anything is corrupted. 631 * Return 0 if everything is OK. 632 */ 633 int btrfs_check_chunk_valid(struct extent_buffer *leaf, 634 struct btrfs_chunk *chunk, u64 logical) 635 { 636 struct btrfs_fs_info *fs_info = leaf->fs_info; 637 u64 length; 638 u64 stripe_len; 639 u16 num_stripes; 640 u16 sub_stripes; 641 u64 type; 642 u64 features; 643 bool mixed = false; 644 645 length = btrfs_chunk_length(leaf, chunk); 646 stripe_len = btrfs_chunk_stripe_len(leaf, chunk); 647 num_stripes = btrfs_chunk_num_stripes(leaf, chunk); 648 sub_stripes = btrfs_chunk_sub_stripes(leaf, chunk); 649 type = btrfs_chunk_type(leaf, chunk); 650 651 if (!num_stripes) { 652 chunk_err(leaf, chunk, logical, 653 "invalid chunk num_stripes, have %u", num_stripes); 654 return -EUCLEAN; 655 } 656 if (!IS_ALIGNED(logical, fs_info->sectorsize)) { 657 chunk_err(leaf, chunk, logical, 658 "invalid chunk logical, have %llu should aligned to %u", 659 logical, fs_info->sectorsize); 660 return -EUCLEAN; 661 } 662 if (btrfs_chunk_sector_size(leaf, chunk) != fs_info->sectorsize) { 663 chunk_err(leaf, chunk, logical, 664 "invalid chunk sectorsize, have %u expect %u", 665 btrfs_chunk_sector_size(leaf, chunk), 666 fs_info->sectorsize); 667 return -EUCLEAN; 668 } 669 if (!length || !IS_ALIGNED(length, fs_info->sectorsize)) { 670 chunk_err(leaf, chunk, logical, 671 "invalid chunk length, have %llu", length); 672 return -EUCLEAN; 673 } 674 if (!is_power_of_2(stripe_len) || stripe_len != BTRFS_STRIPE_LEN) { 675 chunk_err(leaf, chunk, logical, 676 "invalid chunk stripe length: %llu", 677 stripe_len); 678 return -EUCLEAN; 679 } 680 if (~(BTRFS_BLOCK_GROUP_TYPE_MASK | BTRFS_BLOCK_GROUP_PROFILE_MASK) & 681 type) { 682 chunk_err(leaf, chunk, logical, 683 "unrecognized chunk type: 0x%llx", 684 ~(BTRFS_BLOCK_GROUP_TYPE_MASK | 685 BTRFS_BLOCK_GROUP_PROFILE_MASK) & 686 btrfs_chunk_type(leaf, chunk)); 687 return -EUCLEAN; 688 } 689 690 if (!has_single_bit_set(type & BTRFS_BLOCK_GROUP_PROFILE_MASK) && 691 (type & BTRFS_BLOCK_GROUP_PROFILE_MASK) != 0) { 692 chunk_err(leaf, chunk, logical, 693 "invalid chunk profile flag: 0x%llx, expect 0 or 1 bit set", 694 type & BTRFS_BLOCK_GROUP_PROFILE_MASK); 695 return -EUCLEAN; 696 } 697 if ((type & BTRFS_BLOCK_GROUP_TYPE_MASK) == 0) { 698 chunk_err(leaf, chunk, logical, 699 "missing chunk type flag, have 0x%llx one bit must be set in 0x%llx", 700 type, BTRFS_BLOCK_GROUP_TYPE_MASK); 701 return -EUCLEAN; 702 } 703 704 if ((type & BTRFS_BLOCK_GROUP_SYSTEM) && 705 (type & (BTRFS_BLOCK_GROUP_METADATA | BTRFS_BLOCK_GROUP_DATA))) { 706 chunk_err(leaf, chunk, logical, 707 "system chunk with data or metadata type: 0x%llx", 708 type); 709 return -EUCLEAN; 710 } 711 712 features = btrfs_super_incompat_flags(fs_info->super_copy); 713 if (features & BTRFS_FEATURE_INCOMPAT_MIXED_GROUPS) 714 mixed = true; 715 716 if (!mixed) { 717 if ((type & BTRFS_BLOCK_GROUP_METADATA) && 718 (type & BTRFS_BLOCK_GROUP_DATA)) { 719 chunk_err(leaf, chunk, logical, 720 "mixed chunk type in non-mixed mode: 0x%llx", type); 721 return -EUCLEAN; 722 } 723 } 724 725 if ((type & BTRFS_BLOCK_GROUP_RAID10 && sub_stripes != 2) || 726 (type & BTRFS_BLOCK_GROUP_RAID1 && num_stripes != 2) || 727 (type & BTRFS_BLOCK_GROUP_RAID5 && num_stripes < 2) || 728 (type & BTRFS_BLOCK_GROUP_RAID6 && num_stripes < 3) || 729 (type & BTRFS_BLOCK_GROUP_DUP && num_stripes != 2) || 730 ((type & BTRFS_BLOCK_GROUP_PROFILE_MASK) == 0 && num_stripes != 1)) { 731 chunk_err(leaf, chunk, logical, 732 "invalid num_stripes:sub_stripes %u:%u for profile %llu", 733 num_stripes, sub_stripes, 734 type & BTRFS_BLOCK_GROUP_PROFILE_MASK); 735 return -EUCLEAN; 736 } 737 738 return 0; 739 } 740 741 __printf(3, 4) 742 __cold 743 static void dev_item_err(const struct extent_buffer *eb, int slot, 744 const char *fmt, ...) 745 { 746 struct btrfs_key key; 747 struct va_format vaf; 748 va_list args; 749 750 btrfs_item_key_to_cpu(eb, &key, slot); 751 va_start(args, fmt); 752 753 vaf.fmt = fmt; 754 vaf.va = &args; 755 756 btrfs_crit(eb->fs_info, 757 "corrupt %s: root=%llu block=%llu slot=%d devid=%llu %pV", 758 btrfs_header_level(eb) == 0 ? "leaf" : "node", 759 btrfs_header_owner(eb), btrfs_header_bytenr(eb), slot, 760 key.objectid, &vaf); 761 va_end(args); 762 } 763 764 static int check_dev_item(struct extent_buffer *leaf, 765 struct btrfs_key *key, int slot) 766 { 767 struct btrfs_dev_item *ditem; 768 769 if (key->objectid != BTRFS_DEV_ITEMS_OBJECTID) { 770 dev_item_err(leaf, slot, 771 "invalid objectid: has=%llu expect=%llu", 772 key->objectid, BTRFS_DEV_ITEMS_OBJECTID); 773 return -EUCLEAN; 774 } 775 ditem = btrfs_item_ptr(leaf, slot, struct btrfs_dev_item); 776 if (btrfs_device_id(leaf, ditem) != key->offset) { 777 dev_item_err(leaf, slot, 778 "devid mismatch: key has=%llu item has=%llu", 779 key->offset, btrfs_device_id(leaf, ditem)); 780 return -EUCLEAN; 781 } 782 783 /* 784 * For device total_bytes, we don't have reliable way to check it, as 785 * it can be 0 for device removal. Device size check can only be done 786 * by dev extents check. 787 */ 788 if (btrfs_device_bytes_used(leaf, ditem) > 789 btrfs_device_total_bytes(leaf, ditem)) { 790 dev_item_err(leaf, slot, 791 "invalid bytes used: have %llu expect [0, %llu]", 792 btrfs_device_bytes_used(leaf, ditem), 793 btrfs_device_total_bytes(leaf, ditem)); 794 return -EUCLEAN; 795 } 796 /* 797 * Remaining members like io_align/type/gen/dev_group aren't really 798 * utilized. Skip them to make later usage of them easier. 799 */ 800 return 0; 801 } 802 803 /* Inode item error output has the same format as dir_item_err() */ 804 #define inode_item_err(fs_info, eb, slot, fmt, ...) \ 805 dir_item_err(eb, slot, fmt, __VA_ARGS__) 806 807 static int check_inode_item(struct extent_buffer *leaf, 808 struct btrfs_key *key, int slot) 809 { 810 struct btrfs_fs_info *fs_info = leaf->fs_info; 811 struct btrfs_inode_item *iitem; 812 u64 super_gen = btrfs_super_generation(fs_info->super_copy); 813 u32 valid_mask = (S_IFMT | S_ISUID | S_ISGID | S_ISVTX | 0777); 814 u32 mode; 815 816 if ((key->objectid < BTRFS_FIRST_FREE_OBJECTID || 817 key->objectid > BTRFS_LAST_FREE_OBJECTID) && 818 key->objectid != BTRFS_ROOT_TREE_DIR_OBJECTID && 819 key->objectid != BTRFS_FREE_INO_OBJECTID) { 820 generic_err(leaf, slot, 821 "invalid key objectid: has %llu expect %llu or [%llu, %llu] or %llu", 822 key->objectid, BTRFS_ROOT_TREE_DIR_OBJECTID, 823 BTRFS_FIRST_FREE_OBJECTID, 824 BTRFS_LAST_FREE_OBJECTID, 825 BTRFS_FREE_INO_OBJECTID); 826 return -EUCLEAN; 827 } 828 if (key->offset != 0) { 829 inode_item_err(fs_info, leaf, slot, 830 "invalid key offset: has %llu expect 0", 831 key->offset); 832 return -EUCLEAN; 833 } 834 iitem = btrfs_item_ptr(leaf, slot, struct btrfs_inode_item); 835 836 /* Here we use super block generation + 1 to handle log tree */ 837 if (btrfs_inode_generation(leaf, iitem) > super_gen + 1) { 838 inode_item_err(fs_info, leaf, slot, 839 "invalid inode generation: has %llu expect (0, %llu]", 840 btrfs_inode_generation(leaf, iitem), 841 super_gen + 1); 842 return -EUCLEAN; 843 } 844 /* Note for ROOT_TREE_DIR_ITEM, mkfs could set its transid 0 */ 845 if (btrfs_inode_transid(leaf, iitem) > super_gen + 1) { 846 inode_item_err(fs_info, leaf, slot, 847 "invalid inode generation: has %llu expect [0, %llu]", 848 btrfs_inode_transid(leaf, iitem), super_gen + 1); 849 return -EUCLEAN; 850 } 851 852 /* 853 * For size and nbytes it's better not to be too strict, as for dir 854 * item its size/nbytes can easily get wrong, but doesn't affect 855 * anything in the fs. So here we skip the check. 856 */ 857 mode = btrfs_inode_mode(leaf, iitem); 858 if (mode & ~valid_mask) { 859 inode_item_err(fs_info, leaf, slot, 860 "unknown mode bit detected: 0x%x", 861 mode & ~valid_mask); 862 return -EUCLEAN; 863 } 864 865 /* 866 * S_IFMT is not bit mapped so we can't completely rely on 867 * is_power_of_2/has_single_bit_set, but it can save us from checking 868 * FIFO/CHR/DIR/REG. Only needs to check BLK, LNK and SOCKS 869 */ 870 if (!has_single_bit_set(mode & S_IFMT)) { 871 if (!S_ISLNK(mode) && !S_ISBLK(mode) && !S_ISSOCK(mode)) { 872 inode_item_err(fs_info, leaf, slot, 873 "invalid mode: has 0%o expect valid S_IF* bit(s)", 874 mode & S_IFMT); 875 return -EUCLEAN; 876 } 877 } 878 if (S_ISDIR(mode) && btrfs_inode_nlink(leaf, iitem) > 1) { 879 inode_item_err(fs_info, leaf, slot, 880 "invalid nlink: has %u expect no more than 1 for dir", 881 btrfs_inode_nlink(leaf, iitem)); 882 return -EUCLEAN; 883 } 884 if (btrfs_inode_flags(leaf, iitem) & ~BTRFS_INODE_FLAG_MASK) { 885 inode_item_err(fs_info, leaf, slot, 886 "unknown flags detected: 0x%llx", 887 btrfs_inode_flags(leaf, iitem) & 888 ~BTRFS_INODE_FLAG_MASK); 889 return -EUCLEAN; 890 } 891 return 0; 892 } 893 894 static int check_root_item(struct extent_buffer *leaf, struct btrfs_key *key, 895 int slot) 896 { 897 struct btrfs_fs_info *fs_info = leaf->fs_info; 898 struct btrfs_root_item ri; 899 const u64 valid_root_flags = BTRFS_ROOT_SUBVOL_RDONLY | 900 BTRFS_ROOT_SUBVOL_DEAD; 901 902 /* No such tree id */ 903 if (key->objectid == 0) { 904 generic_err(leaf, slot, "invalid root id 0"); 905 return -EUCLEAN; 906 } 907 908 /* 909 * Some older kernel may create ROOT_ITEM with non-zero offset, so here 910 * we only check offset for reloc tree whose key->offset must be a 911 * valid tree. 912 */ 913 if (key->objectid == BTRFS_TREE_RELOC_OBJECTID && key->offset == 0) { 914 generic_err(leaf, slot, "invalid root id 0 for reloc tree"); 915 return -EUCLEAN; 916 } 917 918 if (btrfs_item_size_nr(leaf, slot) != sizeof(ri)) { 919 generic_err(leaf, slot, 920 "invalid root item size, have %u expect %zu", 921 btrfs_item_size_nr(leaf, slot), sizeof(ri)); 922 } 923 924 read_extent_buffer(leaf, &ri, btrfs_item_ptr_offset(leaf, slot), 925 sizeof(ri)); 926 927 /* Generation related */ 928 if (btrfs_root_generation(&ri) > 929 btrfs_super_generation(fs_info->super_copy) + 1) { 930 generic_err(leaf, slot, 931 "invalid root generation, have %llu expect (0, %llu]", 932 btrfs_root_generation(&ri), 933 btrfs_super_generation(fs_info->super_copy) + 1); 934 return -EUCLEAN; 935 } 936 if (btrfs_root_generation_v2(&ri) > 937 btrfs_super_generation(fs_info->super_copy) + 1) { 938 generic_err(leaf, slot, 939 "invalid root v2 generation, have %llu expect (0, %llu]", 940 btrfs_root_generation_v2(&ri), 941 btrfs_super_generation(fs_info->super_copy) + 1); 942 return -EUCLEAN; 943 } 944 if (btrfs_root_last_snapshot(&ri) > 945 btrfs_super_generation(fs_info->super_copy) + 1) { 946 generic_err(leaf, slot, 947 "invalid root last_snapshot, have %llu expect (0, %llu]", 948 btrfs_root_last_snapshot(&ri), 949 btrfs_super_generation(fs_info->super_copy) + 1); 950 return -EUCLEAN; 951 } 952 953 /* Alignment and level check */ 954 if (!IS_ALIGNED(btrfs_root_bytenr(&ri), fs_info->sectorsize)) { 955 generic_err(leaf, slot, 956 "invalid root bytenr, have %llu expect to be aligned to %u", 957 btrfs_root_bytenr(&ri), fs_info->sectorsize); 958 return -EUCLEAN; 959 } 960 if (btrfs_root_level(&ri) >= BTRFS_MAX_LEVEL) { 961 generic_err(leaf, slot, 962 "invalid root level, have %u expect [0, %u]", 963 btrfs_root_level(&ri), BTRFS_MAX_LEVEL - 1); 964 return -EUCLEAN; 965 } 966 if (ri.drop_level >= BTRFS_MAX_LEVEL) { 967 generic_err(leaf, slot, 968 "invalid root level, have %u expect [0, %u]", 969 ri.drop_level, BTRFS_MAX_LEVEL - 1); 970 return -EUCLEAN; 971 } 972 973 /* Flags check */ 974 if (btrfs_root_flags(&ri) & ~valid_root_flags) { 975 generic_err(leaf, slot, 976 "invalid root flags, have 0x%llx expect mask 0x%llx", 977 btrfs_root_flags(&ri), valid_root_flags); 978 return -EUCLEAN; 979 } 980 return 0; 981 } 982 983 __printf(3,4) 984 __cold 985 static void extent_err(const struct extent_buffer *eb, int slot, 986 const char *fmt, ...) 987 { 988 struct btrfs_key key; 989 struct va_format vaf; 990 va_list args; 991 u64 bytenr; 992 u64 len; 993 994 btrfs_item_key_to_cpu(eb, &key, slot); 995 bytenr = key.objectid; 996 if (key.type == BTRFS_METADATA_ITEM_KEY || 997 key.type == BTRFS_TREE_BLOCK_REF_KEY || 998 key.type == BTRFS_SHARED_BLOCK_REF_KEY) 999 len = eb->fs_info->nodesize; 1000 else 1001 len = key.offset; 1002 va_start(args, fmt); 1003 1004 vaf.fmt = fmt; 1005 vaf.va = &args; 1006 1007 btrfs_crit(eb->fs_info, 1008 "corrupt %s: block=%llu slot=%d extent bytenr=%llu len=%llu %pV", 1009 btrfs_header_level(eb) == 0 ? "leaf" : "node", 1010 eb->start, slot, bytenr, len, &vaf); 1011 va_end(args); 1012 } 1013 1014 static int check_extent_item(struct extent_buffer *leaf, 1015 struct btrfs_key *key, int slot) 1016 { 1017 struct btrfs_fs_info *fs_info = leaf->fs_info; 1018 struct btrfs_extent_item *ei; 1019 bool is_tree_block = false; 1020 unsigned long ptr; /* Current pointer inside inline refs */ 1021 unsigned long end; /* Extent item end */ 1022 const u32 item_size = btrfs_item_size_nr(leaf, slot); 1023 u64 flags; 1024 u64 generation; 1025 u64 total_refs; /* Total refs in btrfs_extent_item */ 1026 u64 inline_refs = 0; /* found total inline refs */ 1027 1028 if (key->type == BTRFS_METADATA_ITEM_KEY && 1029 !btrfs_fs_incompat(fs_info, SKINNY_METADATA)) { 1030 generic_err(leaf, slot, 1031 "invalid key type, METADATA_ITEM type invalid when SKINNY_METADATA feature disabled"); 1032 return -EUCLEAN; 1033 } 1034 /* key->objectid is the bytenr for both key types */ 1035 if (!IS_ALIGNED(key->objectid, fs_info->sectorsize)) { 1036 generic_err(leaf, slot, 1037 "invalid key objectid, have %llu expect to be aligned to %u", 1038 key->objectid, fs_info->sectorsize); 1039 return -EUCLEAN; 1040 } 1041 1042 /* key->offset is tree level for METADATA_ITEM_KEY */ 1043 if (key->type == BTRFS_METADATA_ITEM_KEY && 1044 key->offset >= BTRFS_MAX_LEVEL) { 1045 extent_err(leaf, slot, 1046 "invalid tree level, have %llu expect [0, %u]", 1047 key->offset, BTRFS_MAX_LEVEL - 1); 1048 return -EUCLEAN; 1049 } 1050 1051 /* 1052 * EXTENT/METADATA_ITEM consists of: 1053 * 1) One btrfs_extent_item 1054 * Records the total refs, type and generation of the extent. 1055 * 1056 * 2) One btrfs_tree_block_info (for EXTENT_ITEM and tree backref only) 1057 * Records the first key and level of the tree block. 1058 * 1059 * 2) Zero or more btrfs_extent_inline_ref(s) 1060 * Each inline ref has one btrfs_extent_inline_ref shows: 1061 * 2.1) The ref type, one of the 4 1062 * TREE_BLOCK_REF Tree block only 1063 * SHARED_BLOCK_REF Tree block only 1064 * EXTENT_DATA_REF Data only 1065 * SHARED_DATA_REF Data only 1066 * 2.2) Ref type specific data 1067 * Either using btrfs_extent_inline_ref::offset, or specific 1068 * data structure. 1069 */ 1070 if (item_size < sizeof(*ei)) { 1071 extent_err(leaf, slot, 1072 "invalid item size, have %u expect [%zu, %u)", 1073 item_size, sizeof(*ei), 1074 BTRFS_LEAF_DATA_SIZE(fs_info)); 1075 return -EUCLEAN; 1076 } 1077 end = item_size + btrfs_item_ptr_offset(leaf, slot); 1078 1079 /* Checks against extent_item */ 1080 ei = btrfs_item_ptr(leaf, slot, struct btrfs_extent_item); 1081 flags = btrfs_extent_flags(leaf, ei); 1082 total_refs = btrfs_extent_refs(leaf, ei); 1083 generation = btrfs_extent_generation(leaf, ei); 1084 if (generation > btrfs_super_generation(fs_info->super_copy) + 1) { 1085 extent_err(leaf, slot, 1086 "invalid generation, have %llu expect (0, %llu]", 1087 generation, 1088 btrfs_super_generation(fs_info->super_copy) + 1); 1089 return -EUCLEAN; 1090 } 1091 if (!has_single_bit_set(flags & (BTRFS_EXTENT_FLAG_DATA | 1092 BTRFS_EXTENT_FLAG_TREE_BLOCK))) { 1093 extent_err(leaf, slot, 1094 "invalid extent flag, have 0x%llx expect 1 bit set in 0x%llx", 1095 flags, BTRFS_EXTENT_FLAG_DATA | 1096 BTRFS_EXTENT_FLAG_TREE_BLOCK); 1097 return -EUCLEAN; 1098 } 1099 is_tree_block = !!(flags & BTRFS_EXTENT_FLAG_TREE_BLOCK); 1100 if (is_tree_block) { 1101 if (key->type == BTRFS_EXTENT_ITEM_KEY && 1102 key->offset != fs_info->nodesize) { 1103 extent_err(leaf, slot, 1104 "invalid extent length, have %llu expect %u", 1105 key->offset, fs_info->nodesize); 1106 return -EUCLEAN; 1107 } 1108 } else { 1109 if (key->type != BTRFS_EXTENT_ITEM_KEY) { 1110 extent_err(leaf, slot, 1111 "invalid key type, have %u expect %u for data backref", 1112 key->type, BTRFS_EXTENT_ITEM_KEY); 1113 return -EUCLEAN; 1114 } 1115 if (!IS_ALIGNED(key->offset, fs_info->sectorsize)) { 1116 extent_err(leaf, slot, 1117 "invalid extent length, have %llu expect aligned to %u", 1118 key->offset, fs_info->sectorsize); 1119 return -EUCLEAN; 1120 } 1121 } 1122 ptr = (unsigned long)(struct btrfs_extent_item *)(ei + 1); 1123 1124 /* Check the special case of btrfs_tree_block_info */ 1125 if (is_tree_block && key->type != BTRFS_METADATA_ITEM_KEY) { 1126 struct btrfs_tree_block_info *info; 1127 1128 info = (struct btrfs_tree_block_info *)ptr; 1129 if (btrfs_tree_block_level(leaf, info) >= BTRFS_MAX_LEVEL) { 1130 extent_err(leaf, slot, 1131 "invalid tree block info level, have %u expect [0, %u]", 1132 btrfs_tree_block_level(leaf, info), 1133 BTRFS_MAX_LEVEL - 1); 1134 return -EUCLEAN; 1135 } 1136 ptr = (unsigned long)(struct btrfs_tree_block_info *)(info + 1); 1137 } 1138 1139 /* Check inline refs */ 1140 while (ptr < end) { 1141 struct btrfs_extent_inline_ref *iref; 1142 struct btrfs_extent_data_ref *dref; 1143 struct btrfs_shared_data_ref *sref; 1144 u64 dref_offset; 1145 u64 inline_offset; 1146 u8 inline_type; 1147 1148 if (ptr + sizeof(*iref) > end) { 1149 extent_err(leaf, slot, 1150 "inline ref item overflows extent item, ptr %lu iref size %zu end %lu", 1151 ptr, sizeof(*iref), end); 1152 return -EUCLEAN; 1153 } 1154 iref = (struct btrfs_extent_inline_ref *)ptr; 1155 inline_type = btrfs_extent_inline_ref_type(leaf, iref); 1156 inline_offset = btrfs_extent_inline_ref_offset(leaf, iref); 1157 if (ptr + btrfs_extent_inline_ref_size(inline_type) > end) { 1158 extent_err(leaf, slot, 1159 "inline ref item overflows extent item, ptr %lu iref size %u end %lu", 1160 ptr, inline_type, end); 1161 return -EUCLEAN; 1162 } 1163 1164 switch (inline_type) { 1165 /* inline_offset is subvolid of the owner, no need to check */ 1166 case BTRFS_TREE_BLOCK_REF_KEY: 1167 inline_refs++; 1168 break; 1169 /* Contains parent bytenr */ 1170 case BTRFS_SHARED_BLOCK_REF_KEY: 1171 if (!IS_ALIGNED(inline_offset, fs_info->sectorsize)) { 1172 extent_err(leaf, slot, 1173 "invalid tree parent bytenr, have %llu expect aligned to %u", 1174 inline_offset, fs_info->sectorsize); 1175 return -EUCLEAN; 1176 } 1177 inline_refs++; 1178 break; 1179 /* 1180 * Contains owner subvolid, owner key objectid, adjusted offset. 1181 * The only obvious corruption can happen in that offset. 1182 */ 1183 case BTRFS_EXTENT_DATA_REF_KEY: 1184 dref = (struct btrfs_extent_data_ref *)(&iref->offset); 1185 dref_offset = btrfs_extent_data_ref_offset(leaf, dref); 1186 if (!IS_ALIGNED(dref_offset, fs_info->sectorsize)) { 1187 extent_err(leaf, slot, 1188 "invalid data ref offset, have %llu expect aligned to %u", 1189 dref_offset, fs_info->sectorsize); 1190 return -EUCLEAN; 1191 } 1192 inline_refs += btrfs_extent_data_ref_count(leaf, dref); 1193 break; 1194 /* Contains parent bytenr and ref count */ 1195 case BTRFS_SHARED_DATA_REF_KEY: 1196 sref = (struct btrfs_shared_data_ref *)(iref + 1); 1197 if (!IS_ALIGNED(inline_offset, fs_info->sectorsize)) { 1198 extent_err(leaf, slot, 1199 "invalid data parent bytenr, have %llu expect aligned to %u", 1200 inline_offset, fs_info->sectorsize); 1201 return -EUCLEAN; 1202 } 1203 inline_refs += btrfs_shared_data_ref_count(leaf, sref); 1204 break; 1205 default: 1206 extent_err(leaf, slot, "unknown inline ref type: %u", 1207 inline_type); 1208 return -EUCLEAN; 1209 } 1210 ptr += btrfs_extent_inline_ref_size(inline_type); 1211 } 1212 /* No padding is allowed */ 1213 if (ptr != end) { 1214 extent_err(leaf, slot, 1215 "invalid extent item size, padding bytes found"); 1216 return -EUCLEAN; 1217 } 1218 1219 /* Finally, check the inline refs against total refs */ 1220 if (inline_refs > total_refs) { 1221 extent_err(leaf, slot, 1222 "invalid extent refs, have %llu expect >= inline %llu", 1223 total_refs, inline_refs); 1224 return -EUCLEAN; 1225 } 1226 return 0; 1227 } 1228 1229 static int check_simple_keyed_refs(struct extent_buffer *leaf, 1230 struct btrfs_key *key, int slot) 1231 { 1232 u32 expect_item_size = 0; 1233 1234 if (key->type == BTRFS_SHARED_DATA_REF_KEY) 1235 expect_item_size = sizeof(struct btrfs_shared_data_ref); 1236 1237 if (btrfs_item_size_nr(leaf, slot) != expect_item_size) { 1238 generic_err(leaf, slot, 1239 "invalid item size, have %u expect %u for key type %u", 1240 btrfs_item_size_nr(leaf, slot), 1241 expect_item_size, key->type); 1242 return -EUCLEAN; 1243 } 1244 if (!IS_ALIGNED(key->objectid, leaf->fs_info->sectorsize)) { 1245 generic_err(leaf, slot, 1246 "invalid key objectid for shared block ref, have %llu expect aligned to %u", 1247 key->objectid, leaf->fs_info->sectorsize); 1248 return -EUCLEAN; 1249 } 1250 if (key->type != BTRFS_TREE_BLOCK_REF_KEY && 1251 !IS_ALIGNED(key->offset, leaf->fs_info->sectorsize)) { 1252 extent_err(leaf, slot, 1253 "invalid tree parent bytenr, have %llu expect aligned to %u", 1254 key->offset, leaf->fs_info->sectorsize); 1255 return -EUCLEAN; 1256 } 1257 return 0; 1258 } 1259 1260 static int check_extent_data_ref(struct extent_buffer *leaf, 1261 struct btrfs_key *key, int slot) 1262 { 1263 struct btrfs_extent_data_ref *dref; 1264 unsigned long ptr = btrfs_item_ptr_offset(leaf, slot); 1265 const unsigned long end = ptr + btrfs_item_size_nr(leaf, slot); 1266 1267 if (btrfs_item_size_nr(leaf, slot) % sizeof(*dref) != 0) { 1268 generic_err(leaf, slot, 1269 "invalid item size, have %u expect aligned to %zu for key type %u", 1270 btrfs_item_size_nr(leaf, slot), 1271 sizeof(*dref), key->type); 1272 } 1273 if (!IS_ALIGNED(key->objectid, leaf->fs_info->sectorsize)) { 1274 generic_err(leaf, slot, 1275 "invalid key objectid for shared block ref, have %llu expect aligned to %u", 1276 key->objectid, leaf->fs_info->sectorsize); 1277 return -EUCLEAN; 1278 } 1279 for (; ptr < end; ptr += sizeof(*dref)) { 1280 u64 root_objectid; 1281 u64 owner; 1282 u64 offset; 1283 u64 hash; 1284 1285 dref = (struct btrfs_extent_data_ref *)ptr; 1286 root_objectid = btrfs_extent_data_ref_root(leaf, dref); 1287 owner = btrfs_extent_data_ref_objectid(leaf, dref); 1288 offset = btrfs_extent_data_ref_offset(leaf, dref); 1289 hash = hash_extent_data_ref(root_objectid, owner, offset); 1290 if (hash != key->offset) { 1291 extent_err(leaf, slot, 1292 "invalid extent data ref hash, item has 0x%016llx key has 0x%016llx", 1293 hash, key->offset); 1294 return -EUCLEAN; 1295 } 1296 if (!IS_ALIGNED(offset, leaf->fs_info->sectorsize)) { 1297 extent_err(leaf, slot, 1298 "invalid extent data backref offset, have %llu expect aligned to %u", 1299 offset, leaf->fs_info->sectorsize); 1300 } 1301 } 1302 return 0; 1303 } 1304 1305 #define inode_ref_err(fs_info, eb, slot, fmt, args...) \ 1306 inode_item_err(fs_info, eb, slot, fmt, ##args) 1307 static int check_inode_ref(struct extent_buffer *leaf, 1308 struct btrfs_key *key, struct btrfs_key *prev_key, 1309 int slot) 1310 { 1311 struct btrfs_inode_ref *iref; 1312 unsigned long ptr; 1313 unsigned long end; 1314 1315 if (!check_prev_ino(leaf, key, slot, prev_key)) 1316 return -EUCLEAN; 1317 /* namelen can't be 0, so item_size == sizeof() is also invalid */ 1318 if (btrfs_item_size_nr(leaf, slot) <= sizeof(*iref)) { 1319 inode_ref_err(fs_info, leaf, slot, 1320 "invalid item size, have %u expect (%zu, %u)", 1321 btrfs_item_size_nr(leaf, slot), 1322 sizeof(*iref), BTRFS_LEAF_DATA_SIZE(leaf->fs_info)); 1323 return -EUCLEAN; 1324 } 1325 1326 ptr = btrfs_item_ptr_offset(leaf, slot); 1327 end = ptr + btrfs_item_size_nr(leaf, slot); 1328 while (ptr < end) { 1329 u16 namelen; 1330 1331 if (ptr + sizeof(iref) > end) { 1332 inode_ref_err(fs_info, leaf, slot, 1333 "inode ref overflow, ptr %lu end %lu inode_ref_size %zu", 1334 ptr, end, sizeof(iref)); 1335 return -EUCLEAN; 1336 } 1337 1338 iref = (struct btrfs_inode_ref *)ptr; 1339 namelen = btrfs_inode_ref_name_len(leaf, iref); 1340 if (ptr + sizeof(*iref) + namelen > end) { 1341 inode_ref_err(fs_info, leaf, slot, 1342 "inode ref overflow, ptr %lu end %lu namelen %u", 1343 ptr, end, namelen); 1344 return -EUCLEAN; 1345 } 1346 1347 /* 1348 * NOTE: In theory we should record all found index numbers 1349 * to find any duplicated indexes, but that will be too time 1350 * consuming for inodes with too many hard links. 1351 */ 1352 ptr += sizeof(*iref) + namelen; 1353 } 1354 return 0; 1355 } 1356 1357 /* 1358 * Common point to switch the item-specific validation. 1359 */ 1360 static int check_leaf_item(struct extent_buffer *leaf, 1361 struct btrfs_key *key, int slot, 1362 struct btrfs_key *prev_key) 1363 { 1364 int ret = 0; 1365 struct btrfs_chunk *chunk; 1366 1367 switch (key->type) { 1368 case BTRFS_EXTENT_DATA_KEY: 1369 ret = check_extent_data_item(leaf, key, slot, prev_key); 1370 break; 1371 case BTRFS_EXTENT_CSUM_KEY: 1372 ret = check_csum_item(leaf, key, slot, prev_key); 1373 break; 1374 case BTRFS_DIR_ITEM_KEY: 1375 case BTRFS_DIR_INDEX_KEY: 1376 case BTRFS_XATTR_ITEM_KEY: 1377 ret = check_dir_item(leaf, key, prev_key, slot); 1378 break; 1379 case BTRFS_INODE_REF_KEY: 1380 ret = check_inode_ref(leaf, key, prev_key, slot); 1381 break; 1382 case BTRFS_BLOCK_GROUP_ITEM_KEY: 1383 ret = check_block_group_item(leaf, key, slot); 1384 break; 1385 case BTRFS_CHUNK_ITEM_KEY: 1386 chunk = btrfs_item_ptr(leaf, slot, struct btrfs_chunk); 1387 ret = btrfs_check_chunk_valid(leaf, chunk, key->offset); 1388 break; 1389 case BTRFS_DEV_ITEM_KEY: 1390 ret = check_dev_item(leaf, key, slot); 1391 break; 1392 case BTRFS_INODE_ITEM_KEY: 1393 ret = check_inode_item(leaf, key, slot); 1394 break; 1395 case BTRFS_ROOT_ITEM_KEY: 1396 ret = check_root_item(leaf, key, slot); 1397 break; 1398 case BTRFS_EXTENT_ITEM_KEY: 1399 case BTRFS_METADATA_ITEM_KEY: 1400 ret = check_extent_item(leaf, key, slot); 1401 break; 1402 case BTRFS_TREE_BLOCK_REF_KEY: 1403 case BTRFS_SHARED_DATA_REF_KEY: 1404 case BTRFS_SHARED_BLOCK_REF_KEY: 1405 ret = check_simple_keyed_refs(leaf, key, slot); 1406 break; 1407 case BTRFS_EXTENT_DATA_REF_KEY: 1408 ret = check_extent_data_ref(leaf, key, slot); 1409 break; 1410 } 1411 return ret; 1412 } 1413 1414 static int check_leaf(struct extent_buffer *leaf, bool check_item_data) 1415 { 1416 struct btrfs_fs_info *fs_info = leaf->fs_info; 1417 /* No valid key type is 0, so all key should be larger than this key */ 1418 struct btrfs_key prev_key = {0, 0, 0}; 1419 struct btrfs_key key; 1420 u32 nritems = btrfs_header_nritems(leaf); 1421 int slot; 1422 1423 if (btrfs_header_level(leaf) != 0) { 1424 generic_err(leaf, 0, 1425 "invalid level for leaf, have %d expect 0", 1426 btrfs_header_level(leaf)); 1427 return -EUCLEAN; 1428 } 1429 1430 /* 1431 * Extent buffers from a relocation tree have a owner field that 1432 * corresponds to the subvolume tree they are based on. So just from an 1433 * extent buffer alone we can not find out what is the id of the 1434 * corresponding subvolume tree, so we can not figure out if the extent 1435 * buffer corresponds to the root of the relocation tree or not. So 1436 * skip this check for relocation trees. 1437 */ 1438 if (nritems == 0 && !btrfs_header_flag(leaf, BTRFS_HEADER_FLAG_RELOC)) { 1439 u64 owner = btrfs_header_owner(leaf); 1440 1441 /* These trees must never be empty */ 1442 if (owner == BTRFS_ROOT_TREE_OBJECTID || 1443 owner == BTRFS_CHUNK_TREE_OBJECTID || 1444 owner == BTRFS_EXTENT_TREE_OBJECTID || 1445 owner == BTRFS_DEV_TREE_OBJECTID || 1446 owner == BTRFS_FS_TREE_OBJECTID || 1447 owner == BTRFS_DATA_RELOC_TREE_OBJECTID) { 1448 generic_err(leaf, 0, 1449 "invalid root, root %llu must never be empty", 1450 owner); 1451 return -EUCLEAN; 1452 } 1453 /* Unknown tree */ 1454 if (owner == 0) { 1455 generic_err(leaf, 0, 1456 "invalid owner, root 0 is not defined"); 1457 return -EUCLEAN; 1458 } 1459 return 0; 1460 } 1461 1462 if (nritems == 0) 1463 return 0; 1464 1465 /* 1466 * Check the following things to make sure this is a good leaf, and 1467 * leaf users won't need to bother with similar sanity checks: 1468 * 1469 * 1) key ordering 1470 * 2) item offset and size 1471 * No overlap, no hole, all inside the leaf. 1472 * 3) item content 1473 * If possible, do comprehensive sanity check. 1474 * NOTE: All checks must only rely on the item data itself. 1475 */ 1476 for (slot = 0; slot < nritems; slot++) { 1477 u32 item_end_expected; 1478 int ret; 1479 1480 btrfs_item_key_to_cpu(leaf, &key, slot); 1481 1482 /* Make sure the keys are in the right order */ 1483 if (btrfs_comp_cpu_keys(&prev_key, &key) >= 0) { 1484 generic_err(leaf, slot, 1485 "bad key order, prev (%llu %u %llu) current (%llu %u %llu)", 1486 prev_key.objectid, prev_key.type, 1487 prev_key.offset, key.objectid, key.type, 1488 key.offset); 1489 return -EUCLEAN; 1490 } 1491 1492 /* 1493 * Make sure the offset and ends are right, remember that the 1494 * item data starts at the end of the leaf and grows towards the 1495 * front. 1496 */ 1497 if (slot == 0) 1498 item_end_expected = BTRFS_LEAF_DATA_SIZE(fs_info); 1499 else 1500 item_end_expected = btrfs_item_offset_nr(leaf, 1501 slot - 1); 1502 if (btrfs_item_end_nr(leaf, slot) != item_end_expected) { 1503 generic_err(leaf, slot, 1504 "unexpected item end, have %u expect %u", 1505 btrfs_item_end_nr(leaf, slot), 1506 item_end_expected); 1507 return -EUCLEAN; 1508 } 1509 1510 /* 1511 * Check to make sure that we don't point outside of the leaf, 1512 * just in case all the items are consistent to each other, but 1513 * all point outside of the leaf. 1514 */ 1515 if (btrfs_item_end_nr(leaf, slot) > 1516 BTRFS_LEAF_DATA_SIZE(fs_info)) { 1517 generic_err(leaf, slot, 1518 "slot end outside of leaf, have %u expect range [0, %u]", 1519 btrfs_item_end_nr(leaf, slot), 1520 BTRFS_LEAF_DATA_SIZE(fs_info)); 1521 return -EUCLEAN; 1522 } 1523 1524 /* Also check if the item pointer overlaps with btrfs item. */ 1525 if (btrfs_item_nr_offset(slot) + sizeof(struct btrfs_item) > 1526 btrfs_item_ptr_offset(leaf, slot)) { 1527 generic_err(leaf, slot, 1528 "slot overlaps with its data, item end %lu data start %lu", 1529 btrfs_item_nr_offset(slot) + 1530 sizeof(struct btrfs_item), 1531 btrfs_item_ptr_offset(leaf, slot)); 1532 return -EUCLEAN; 1533 } 1534 1535 if (check_item_data) { 1536 /* 1537 * Check if the item size and content meet other 1538 * criteria 1539 */ 1540 ret = check_leaf_item(leaf, &key, slot, &prev_key); 1541 if (ret < 0) 1542 return ret; 1543 } 1544 1545 prev_key.objectid = key.objectid; 1546 prev_key.type = key.type; 1547 prev_key.offset = key.offset; 1548 } 1549 1550 return 0; 1551 } 1552 1553 int btrfs_check_leaf_full(struct extent_buffer *leaf) 1554 { 1555 return check_leaf(leaf, true); 1556 } 1557 ALLOW_ERROR_INJECTION(btrfs_check_leaf_full, ERRNO); 1558 1559 int btrfs_check_leaf_relaxed(struct extent_buffer *leaf) 1560 { 1561 return check_leaf(leaf, false); 1562 } 1563 1564 int btrfs_check_node(struct extent_buffer *node) 1565 { 1566 struct btrfs_fs_info *fs_info = node->fs_info; 1567 unsigned long nr = btrfs_header_nritems(node); 1568 struct btrfs_key key, next_key; 1569 int slot; 1570 int level = btrfs_header_level(node); 1571 u64 bytenr; 1572 int ret = 0; 1573 1574 if (level <= 0 || level >= BTRFS_MAX_LEVEL) { 1575 generic_err(node, 0, 1576 "invalid level for node, have %d expect [1, %d]", 1577 level, BTRFS_MAX_LEVEL - 1); 1578 return -EUCLEAN; 1579 } 1580 if (nr == 0 || nr > BTRFS_NODEPTRS_PER_BLOCK(fs_info)) { 1581 btrfs_crit(fs_info, 1582 "corrupt node: root=%llu block=%llu, nritems too %s, have %lu expect range [1,%u]", 1583 btrfs_header_owner(node), node->start, 1584 nr == 0 ? "small" : "large", nr, 1585 BTRFS_NODEPTRS_PER_BLOCK(fs_info)); 1586 return -EUCLEAN; 1587 } 1588 1589 for (slot = 0; slot < nr - 1; slot++) { 1590 bytenr = btrfs_node_blockptr(node, slot); 1591 btrfs_node_key_to_cpu(node, &key, slot); 1592 btrfs_node_key_to_cpu(node, &next_key, slot + 1); 1593 1594 if (!bytenr) { 1595 generic_err(node, slot, 1596 "invalid NULL node pointer"); 1597 ret = -EUCLEAN; 1598 goto out; 1599 } 1600 if (!IS_ALIGNED(bytenr, fs_info->sectorsize)) { 1601 generic_err(node, slot, 1602 "unaligned pointer, have %llu should be aligned to %u", 1603 bytenr, fs_info->sectorsize); 1604 ret = -EUCLEAN; 1605 goto out; 1606 } 1607 1608 if (btrfs_comp_cpu_keys(&key, &next_key) >= 0) { 1609 generic_err(node, slot, 1610 "bad key order, current (%llu %u %llu) next (%llu %u %llu)", 1611 key.objectid, key.type, key.offset, 1612 next_key.objectid, next_key.type, 1613 next_key.offset); 1614 ret = -EUCLEAN; 1615 goto out; 1616 } 1617 } 1618 out: 1619 return ret; 1620 } 1621 ALLOW_ERROR_INJECTION(btrfs_check_node, ERRNO); 1622