1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * quota.c - CephFS quota
4 *
5 * Copyright (C) 2017-2018 SUSE
6 */
7
8 #include <linux/statfs.h>
9
10 #include "super.h"
11 #include "mds_client.h"
12
ceph_adjust_quota_realms_count(struct inode * inode,bool inc)13 void ceph_adjust_quota_realms_count(struct inode *inode, bool inc)
14 {
15 struct ceph_mds_client *mdsc = ceph_sb_to_mdsc(inode->i_sb);
16 if (inc)
17 atomic64_inc(&mdsc->quotarealms_count);
18 else
19 atomic64_dec(&mdsc->quotarealms_count);
20 }
21
ceph_has_realms_with_quotas(struct inode * inode)22 static inline bool ceph_has_realms_with_quotas(struct inode *inode)
23 {
24 struct super_block *sb = inode->i_sb;
25 struct ceph_mds_client *mdsc = ceph_sb_to_mdsc(sb);
26 struct inode *root = d_inode(sb->s_root);
27
28 if (atomic64_read(&mdsc->quotarealms_count) > 0)
29 return true;
30 /* if root is the real CephFS root, we don't have quota realms */
31 if (root && ceph_ino(root) == CEPH_INO_ROOT)
32 return false;
33 /* MDS stray dirs have no quota realms */
34 if (ceph_vino_is_reserved(ceph_inode(inode)->i_vino))
35 return false;
36 /* otherwise, we can't know for sure */
37 return true;
38 }
39
ceph_handle_quota(struct ceph_mds_client * mdsc,struct ceph_mds_session * session,struct ceph_msg * msg)40 void ceph_handle_quota(struct ceph_mds_client *mdsc,
41 struct ceph_mds_session *session,
42 struct ceph_msg *msg)
43 {
44 struct super_block *sb = mdsc->fsc->sb;
45 struct ceph_mds_quota *h = msg->front.iov_base;
46 struct ceph_client *cl = mdsc->fsc->client;
47 struct ceph_vino vino;
48 struct inode *inode;
49 struct ceph_inode_info *ci;
50
51 if (!ceph_inc_mds_stopping_blocker(mdsc, session))
52 return;
53
54 if (msg->front.iov_len < sizeof(*h)) {
55 pr_err_client(cl, "corrupt message mds%d len %d\n",
56 session->s_mds, (int)msg->front.iov_len);
57 ceph_msg_dump(msg);
58 goto out;
59 }
60
61 /* lookup inode */
62 vino.ino = le64_to_cpu(h->ino);
63 vino.snap = CEPH_NOSNAP;
64 inode = ceph_find_inode(sb, vino);
65 if (!inode) {
66 pr_warn_client(cl, "failed to find inode %llx\n", vino.ino);
67 goto out;
68 }
69 ci = ceph_inode(inode);
70
71 spin_lock(&ci->i_ceph_lock);
72 ci->i_rbytes = le64_to_cpu(h->rbytes);
73 ci->i_rfiles = le64_to_cpu(h->rfiles);
74 ci->i_rsubdirs = le64_to_cpu(h->rsubdirs);
75 __ceph_update_quota(ci, le64_to_cpu(h->max_bytes),
76 le64_to_cpu(h->max_files));
77 spin_unlock(&ci->i_ceph_lock);
78
79 iput(inode);
80 out:
81 ceph_dec_mds_stopping_blocker(mdsc);
82 }
83
84 static struct ceph_quotarealm_inode *
find_quotarealm_inode(struct ceph_mds_client * mdsc,u64 ino)85 find_quotarealm_inode(struct ceph_mds_client *mdsc, u64 ino)
86 {
87 struct ceph_quotarealm_inode *qri = NULL;
88 struct rb_node **node, *parent = NULL;
89 struct ceph_client *cl = mdsc->fsc->client;
90
91 mutex_lock(&mdsc->quotarealms_inodes_mutex);
92 node = &(mdsc->quotarealms_inodes.rb_node);
93 while (*node) {
94 parent = *node;
95 qri = container_of(*node, struct ceph_quotarealm_inode, node);
96
97 if (ino < qri->ino)
98 node = &((*node)->rb_left);
99 else if (ino > qri->ino)
100 node = &((*node)->rb_right);
101 else
102 break;
103 }
104 if (!qri || (qri->ino != ino)) {
105 /* Not found, create a new one and insert it */
106 qri = kmalloc_obj(*qri);
107 if (qri) {
108 qri->ino = ino;
109 qri->inode = NULL;
110 qri->timeout = 0;
111 mutex_init(&qri->mutex);
112 rb_link_node(&qri->node, parent, node);
113 rb_insert_color(&qri->node, &mdsc->quotarealms_inodes);
114 } else
115 pr_warn_client(cl, "Failed to alloc quotarealms_inode\n");
116 }
117 mutex_unlock(&mdsc->quotarealms_inodes_mutex);
118
119 return qri;
120 }
121
122 /*
123 * This function will try to lookup a realm inode which isn't visible in the
124 * filesystem mountpoint. A list of these kind of inodes (not visible) is
125 * maintained in the mdsc and freed only when the filesystem is umounted.
126 *
127 * Note that these inodes are kept in this list even if the lookup fails, which
128 * allows to prevent useless lookup requests.
129 */
lookup_quotarealm_inode(struct ceph_mds_client * mdsc,struct super_block * sb,struct ceph_snap_realm * realm)130 static struct inode *lookup_quotarealm_inode(struct ceph_mds_client *mdsc,
131 struct super_block *sb,
132 struct ceph_snap_realm *realm)
133 {
134 struct ceph_client *cl = mdsc->fsc->client;
135 struct ceph_quotarealm_inode *qri;
136 struct inode *in;
137
138 qri = find_quotarealm_inode(mdsc, realm->ino);
139 if (!qri)
140 return NULL;
141
142 mutex_lock(&qri->mutex);
143 if (qri->inode && ceph_is_any_caps(qri->inode)) {
144 /* A request has already returned the inode */
145 mutex_unlock(&qri->mutex);
146 return qri->inode;
147 }
148 /* Check if this inode lookup has failed recently */
149 if (qri->timeout &&
150 time_before_eq(jiffies, qri->timeout)) {
151 mutex_unlock(&qri->mutex);
152 return NULL;
153 }
154 if (qri->inode) {
155 /* get caps */
156 int ret = __ceph_do_getattr(qri->inode, NULL,
157 CEPH_STAT_CAP_INODE, true);
158 if (ret >= 0)
159 in = qri->inode;
160 else
161 in = ERR_PTR(ret);
162 } else {
163 in = ceph_lookup_inode(sb, realm->ino);
164 }
165
166 if (IS_ERR(in)) {
167 doutc(cl, "Can't lookup inode %llx (err: %ld)\n", realm->ino,
168 PTR_ERR(in));
169 qri->timeout = jiffies + secs_to_jiffies(60); /* XXX */
170 } else {
171 qri->timeout = 0;
172 qri->inode = in;
173 }
174 mutex_unlock(&qri->mutex);
175
176 return in;
177 }
178
ceph_cleanup_quotarealms_inodes(struct ceph_mds_client * mdsc)179 void ceph_cleanup_quotarealms_inodes(struct ceph_mds_client *mdsc)
180 {
181 struct ceph_quotarealm_inode *qri;
182 struct rb_node *node;
183
184 /*
185 * It should now be safe to clean quotarealms_inode tree without holding
186 * mdsc->quotarealms_inodes_mutex...
187 */
188 mutex_lock(&mdsc->quotarealms_inodes_mutex);
189 while (!RB_EMPTY_ROOT(&mdsc->quotarealms_inodes)) {
190 node = rb_first(&mdsc->quotarealms_inodes);
191 qri = rb_entry(node, struct ceph_quotarealm_inode, node);
192 rb_erase(node, &mdsc->quotarealms_inodes);
193 iput(qri->inode);
194 kfree(qri);
195 }
196 mutex_unlock(&mdsc->quotarealms_inodes_mutex);
197 }
198
199 /*
200 * This function walks through the snaprealm for an inode and set the
201 * realmp with the first snaprealm that has quotas set (max_files,
202 * max_bytes, or any, depending on the 'which_quota' argument). If the root is
203 * reached, set the realmp with the root ceph_snap_realm instead.
204 *
205 * Note that the caller is responsible for calling ceph_put_snap_realm() on the
206 * returned realm.
207 *
208 * Callers of this function need to hold mdsc->snap_rwsem. However, if there's
209 * a need to do an inode lookup, this rwsem will be temporarily dropped. Hence
210 * the 'retry' argument: if rwsem needs to be dropped and 'retry' is 'false'
211 * this function will return -EAGAIN; otherwise, the snaprealms walk-through
212 * will be restarted.
213 */
get_quota_realm(struct ceph_mds_client * mdsc,struct inode * inode,enum quota_get_realm which_quota,struct ceph_snap_realm ** realmp,bool retry)214 static int get_quota_realm(struct ceph_mds_client *mdsc, struct inode *inode,
215 enum quota_get_realm which_quota,
216 struct ceph_snap_realm **realmp, bool retry)
217 {
218 struct ceph_client *cl = mdsc->fsc->client;
219 struct ceph_inode_info *ci = NULL;
220 struct ceph_snap_realm *realm, *next;
221 struct inode *in;
222 bool has_quota;
223
224 if (realmp)
225 *realmp = NULL;
226 if (ceph_snap(inode) != CEPH_NOSNAP)
227 return 0;
228
229 restart:
230 realm = ceph_inode(inode)->i_snap_realm;
231 if (realm) {
232 ceph_get_snap_realm(mdsc, realm);
233 } else {
234 /*
235 * i_snap_realm is NULL when all caps have been released, e.g.
236 * after an MDS session rejection. This is a transient state;
237 * the realm will be restored once caps are re-granted.
238 * Treat it as "no quota realm found".
239 */
240 doutc(cl, "%p %llx.%llx null i_snap_realm\n",
241 inode, ceph_vinop(inode));
242 }
243
244 while (realm) {
245 bool has_inode;
246
247 spin_lock(&realm->inodes_with_caps_lock);
248 has_inode = realm->inode;
249 in = has_inode ? igrab(realm->inode) : NULL;
250 spin_unlock(&realm->inodes_with_caps_lock);
251 if (has_inode && !in)
252 break;
253 if (!in) {
254 up_read(&mdsc->snap_rwsem);
255 in = lookup_quotarealm_inode(mdsc, inode->i_sb, realm);
256 down_read(&mdsc->snap_rwsem);
257 if (IS_ERR_OR_NULL(in))
258 break;
259 ceph_put_snap_realm(mdsc, realm);
260 if (!retry)
261 return -EAGAIN;
262 goto restart;
263 }
264
265 ci = ceph_inode(in);
266 has_quota = __ceph_has_quota(ci, which_quota);
267 iput(in);
268
269 next = realm->parent;
270 if (has_quota || !next) {
271 if (realmp)
272 *realmp = realm;
273 return 0;
274 }
275
276 ceph_get_snap_realm(mdsc, next);
277 ceph_put_snap_realm(mdsc, realm);
278 realm = next;
279 }
280 if (realm)
281 ceph_put_snap_realm(mdsc, realm);
282
283 return 0;
284 }
285
ceph_quota_is_same_realm(struct inode * old,struct inode * new)286 bool ceph_quota_is_same_realm(struct inode *old, struct inode *new)
287 {
288 struct ceph_mds_client *mdsc = ceph_sb_to_mdsc(old->i_sb);
289 struct ceph_snap_realm *old_realm, *new_realm;
290 bool is_same;
291 int ret;
292
293 restart:
294 /*
295 * We need to lookup 2 quota realms atomically, i.e. with snap_rwsem.
296 * However, get_quota_realm may drop it temporarily. By setting the
297 * 'retry' parameter to 'false', we'll get -EAGAIN if the rwsem was
298 * dropped and we can then restart the whole operation.
299 */
300 down_read(&mdsc->snap_rwsem);
301 get_quota_realm(mdsc, old, QUOTA_GET_ANY, &old_realm, true);
302 ret = get_quota_realm(mdsc, new, QUOTA_GET_ANY, &new_realm, false);
303 if (ret == -EAGAIN) {
304 up_read(&mdsc->snap_rwsem);
305 if (old_realm)
306 ceph_put_snap_realm(mdsc, old_realm);
307 goto restart;
308 }
309 is_same = (old_realm == new_realm);
310 up_read(&mdsc->snap_rwsem);
311
312 if (old_realm)
313 ceph_put_snap_realm(mdsc, old_realm);
314 if (new_realm)
315 ceph_put_snap_realm(mdsc, new_realm);
316
317 return is_same;
318 }
319
320 enum quota_check_op {
321 QUOTA_CHECK_MAX_FILES_OP, /* check quota max_files limit */
322 QUOTA_CHECK_MAX_BYTES_OP, /* check quota max_files limit */
323 QUOTA_CHECK_MAX_BYTES_APPROACHING_OP /* check if quota max_files
324 limit is approaching */
325 };
326
327 /*
328 * check_quota_exceeded() will walk up the snaprealm hierarchy and, for each
329 * realm, it will execute quota check operation defined by the 'op' parameter.
330 * The snaprealm walk is interrupted if the quota check detects that the quota
331 * is exceeded or if the root inode is reached.
332 */
check_quota_exceeded(struct inode * inode,enum quota_check_op op,loff_t delta)333 static bool check_quota_exceeded(struct inode *inode, enum quota_check_op op,
334 loff_t delta)
335 {
336 struct ceph_mds_client *mdsc = ceph_sb_to_mdsc(inode->i_sb);
337 struct ceph_client *cl = mdsc->fsc->client;
338 struct ceph_inode_info *ci;
339 struct ceph_snap_realm *realm, *next;
340 struct inode *in;
341 u64 max, rvalue;
342 bool exceeded = false;
343
344 if (ceph_snap(inode) != CEPH_NOSNAP)
345 return false;
346
347 down_read(&mdsc->snap_rwsem);
348 restart:
349 realm = ceph_inode(inode)->i_snap_realm;
350 if (realm) {
351 ceph_get_snap_realm(mdsc, realm);
352 } else {
353 /*
354 * i_snap_realm is NULL when all caps have been released, e.g.
355 * after an MDS session rejection. This is a transient state;
356 * the realm will be restored once caps are re-granted.
357 * Treat it as "quota not exceeded".
358 */
359 doutc(cl, "%p %llx.%llx null i_snap_realm\n",
360 inode, ceph_vinop(inode));
361 }
362
363 while (realm) {
364 bool has_inode;
365
366 spin_lock(&realm->inodes_with_caps_lock);
367 has_inode = realm->inode;
368 in = has_inode ? igrab(realm->inode) : NULL;
369 spin_unlock(&realm->inodes_with_caps_lock);
370 if (has_inode && !in)
371 break;
372 if (!in) {
373 up_read(&mdsc->snap_rwsem);
374 in = lookup_quotarealm_inode(mdsc, inode->i_sb, realm);
375 down_read(&mdsc->snap_rwsem);
376 if (IS_ERR_OR_NULL(in))
377 break;
378 ceph_put_snap_realm(mdsc, realm);
379 goto restart;
380 }
381 ci = ceph_inode(in);
382 spin_lock(&ci->i_ceph_lock);
383 if (op == QUOTA_CHECK_MAX_FILES_OP) {
384 max = ci->i_max_files;
385 rvalue = ci->i_rfiles + ci->i_rsubdirs;
386 } else {
387 max = ci->i_max_bytes;
388 rvalue = ci->i_rbytes;
389 }
390 spin_unlock(&ci->i_ceph_lock);
391 switch (op) {
392 case QUOTA_CHECK_MAX_FILES_OP:
393 case QUOTA_CHECK_MAX_BYTES_OP:
394 exceeded = (max && (rvalue + delta > max));
395 break;
396 case QUOTA_CHECK_MAX_BYTES_APPROACHING_OP:
397 if (max) {
398 if (rvalue >= max)
399 exceeded = true;
400 else {
401 /*
402 * when we're writing more that 1/16th
403 * of the available space
404 */
405 exceeded =
406 (((max - rvalue) >> 4) < delta);
407 }
408 }
409 break;
410 default:
411 /* Shouldn't happen */
412 pr_warn_client(cl, "Invalid quota check op (%d)\n", op);
413 exceeded = true; /* Just break the loop */
414 }
415 iput(in);
416
417 next = realm->parent;
418 if (exceeded || !next)
419 break;
420 ceph_get_snap_realm(mdsc, next);
421 ceph_put_snap_realm(mdsc, realm);
422 realm = next;
423 }
424 if (realm)
425 ceph_put_snap_realm(mdsc, realm);
426 up_read(&mdsc->snap_rwsem);
427
428 return exceeded;
429 }
430
431 /*
432 * ceph_quota_is_max_files_exceeded - check if we can create a new file
433 * @inode: directory where a new file is being created
434 *
435 * This functions returns true is max_files quota allows a new file to be
436 * created. It is necessary to walk through the snaprealm hierarchy (until the
437 * FS root) to check all realms with quotas set.
438 */
ceph_quota_is_max_files_exceeded(struct inode * inode)439 bool ceph_quota_is_max_files_exceeded(struct inode *inode)
440 {
441 if (!ceph_has_realms_with_quotas(inode))
442 return false;
443
444 WARN_ON(!S_ISDIR(inode->i_mode));
445
446 return check_quota_exceeded(inode, QUOTA_CHECK_MAX_FILES_OP, 1);
447 }
448
449 /*
450 * ceph_quota_is_max_bytes_exceeded - check if we can write to a file
451 * @inode: inode being written
452 * @newsize: new size if write succeeds
453 *
454 * This functions returns true is max_bytes quota allows a file size to reach
455 * @newsize; it returns false otherwise.
456 */
ceph_quota_is_max_bytes_exceeded(struct inode * inode,loff_t newsize)457 bool ceph_quota_is_max_bytes_exceeded(struct inode *inode, loff_t newsize)
458 {
459 loff_t size = i_size_read(inode);
460
461 if (!ceph_has_realms_with_quotas(inode))
462 return false;
463
464 /* return immediately if we're decreasing file size */
465 if (newsize <= size)
466 return false;
467
468 return check_quota_exceeded(inode, QUOTA_CHECK_MAX_BYTES_OP, (newsize - size));
469 }
470
471 /*
472 * ceph_quota_is_max_bytes_approaching - check if we're reaching max_bytes
473 * @inode: inode being written
474 * @newsize: new size if write succeeds
475 *
476 * This function returns true if the new file size @newsize will be consuming
477 * more than 1/16th of the available quota space; it returns false otherwise.
478 */
ceph_quota_is_max_bytes_approaching(struct inode * inode,loff_t newsize)479 bool ceph_quota_is_max_bytes_approaching(struct inode *inode, loff_t newsize)
480 {
481 loff_t size = ceph_inode(inode)->i_reported_size;
482
483 if (!ceph_has_realms_with_quotas(inode))
484 return false;
485
486 /* return immediately if we're decreasing file size */
487 if (newsize <= size)
488 return false;
489
490 return check_quota_exceeded(inode, QUOTA_CHECK_MAX_BYTES_APPROACHING_OP,
491 (newsize - size));
492 }
493
494 /*
495 * ceph_quota_update_statfs - if root has quota update statfs with quota status
496 * @fsc: filesystem client instance
497 * @buf: statfs to update
498 *
499 * If the mounted filesystem root has max_bytes quota set, update the filesystem
500 * statistics with the quota status.
501 *
502 * This function returns true if the stats have been updated, false otherwise.
503 */
ceph_quota_update_statfs(struct ceph_fs_client * fsc,struct kstatfs * buf)504 bool ceph_quota_update_statfs(struct ceph_fs_client *fsc, struct kstatfs *buf)
505 {
506 struct ceph_mds_client *mdsc = fsc->mdsc;
507 struct ceph_inode_info *ci;
508 struct ceph_snap_realm *realm;
509 struct inode *in;
510 u64 total = 0, used, free;
511 bool is_updated = false;
512
513 if (!ceph_has_realms_with_quotas(d_inode(fsc->sb->s_root)))
514 return false;
515
516 down_read(&mdsc->snap_rwsem);
517 get_quota_realm(mdsc, d_inode(fsc->sb->s_root), QUOTA_GET_MAX_BYTES,
518 &realm, true);
519 up_read(&mdsc->snap_rwsem);
520 if (!realm)
521 return false;
522
523 spin_lock(&realm->inodes_with_caps_lock);
524 in = realm->inode ? igrab(realm->inode) : NULL;
525 spin_unlock(&realm->inodes_with_caps_lock);
526 if (in) {
527 ci = ceph_inode(in);
528 spin_lock(&ci->i_ceph_lock);
529 if (ci->i_max_bytes) {
530 total = ci->i_max_bytes >> CEPH_BLOCK_SHIFT;
531 used = ci->i_rbytes >> CEPH_BLOCK_SHIFT;
532 /* For quota size less than 4MB, use 4KB block size */
533 if (!total) {
534 total = ci->i_max_bytes >> CEPH_4K_BLOCK_SHIFT;
535 used = ci->i_rbytes >> CEPH_4K_BLOCK_SHIFT;
536 buf->f_frsize = 1 << CEPH_4K_BLOCK_SHIFT;
537 }
538 /* It is possible for a quota to be exceeded.
539 * Report 'zero' in that case
540 */
541 free = total > used ? total - used : 0;
542 /* For quota size less than 4KB, report the
543 * total=used=4KB,free=0 when quota is full
544 * and total=free=4KB, used=0 otherwise */
545 if (!total) {
546 total = 1;
547 free = ci->i_max_bytes > ci->i_rbytes ? 1 : 0;
548 buf->f_frsize = 1 << CEPH_4K_BLOCK_SHIFT;
549 }
550 }
551 spin_unlock(&ci->i_ceph_lock);
552 if (total) {
553 buf->f_blocks = total;
554 buf->f_bfree = free;
555 buf->f_bavail = free;
556 is_updated = true;
557 }
558 iput(in);
559 }
560 ceph_put_snap_realm(mdsc, realm);
561
562 return is_updated;
563 }
564
565