1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Copyright (C) Qu Wenruo 2017. All rights reserved. 4 */ 5 6 /* 7 * The module is used to catch unexpected/corrupted tree block data. 8 * Such behavior can be caused either by a fuzzed image or bugs. 9 * 10 * The objective is to do leaf/node validation checks when tree block is read 11 * from disk, and check *every* possible member, so other code won't 12 * need to checking them again. 13 * 14 * Due to the potential and unwanted damage, every checker needs to be 15 * carefully reviewed otherwise so it does not prevent mount of valid images. 16 */ 17 18 #include <linux/types.h> 19 #include <linux/stddef.h> 20 #include <linux/error-injection.h> 21 #include "ctree.h" 22 #include "tree-checker.h" 23 #include "disk-io.h" 24 #include "compression.h" 25 #include "volumes.h" 26 #include "misc.h" 27 #include "btrfs_inode.h" 28 29 /* 30 * Error message should follow the following format: 31 * corrupt <type>: <identifier>, <reason>[, <bad_value>] 32 * 33 * @type: leaf or node 34 * @identifier: the necessary info to locate the leaf/node. 35 * It's recommended to decode key.objecitd/offset if it's 36 * meaningful. 37 * @reason: describe the error 38 * @bad_value: optional, it's recommended to output bad value and its 39 * expected value (range). 40 * 41 * Since comma is used to separate the components, only space is allowed 42 * inside each component. 43 */ 44 45 /* 46 * Append generic "corrupt leaf/node root=%llu block=%llu slot=%d: " to @fmt. 47 * Allows callers to customize the output. 48 */ 49 __printf(3, 4) 50 __cold 51 static void generic_err(const struct extent_buffer *eb, int slot, 52 const char *fmt, ...) 53 { 54 const struct btrfs_fs_info *fs_info = eb->fs_info; 55 struct va_format vaf; 56 va_list args; 57 58 va_start(args, fmt); 59 60 vaf.fmt = fmt; 61 vaf.va = &args; 62 63 btrfs_crit(fs_info, 64 "corrupt %s: root=%llu block=%llu slot=%d, %pV", 65 btrfs_header_level(eb) == 0 ? "leaf" : "node", 66 btrfs_header_owner(eb), btrfs_header_bytenr(eb), slot, &vaf); 67 va_end(args); 68 } 69 70 /* 71 * Customized reporter for extent data item, since its key objectid and 72 * offset has its own meaning. 73 */ 74 __printf(3, 4) 75 __cold 76 static void file_extent_err(const struct extent_buffer *eb, int slot, 77 const char *fmt, ...) 78 { 79 const struct btrfs_fs_info *fs_info = eb->fs_info; 80 struct btrfs_key key; 81 struct va_format vaf; 82 va_list args; 83 84 btrfs_item_key_to_cpu(eb, &key, slot); 85 va_start(args, fmt); 86 87 vaf.fmt = fmt; 88 vaf.va = &args; 89 90 btrfs_crit(fs_info, 91 "corrupt %s: root=%llu block=%llu slot=%d ino=%llu file_offset=%llu, %pV", 92 btrfs_header_level(eb) == 0 ? "leaf" : "node", 93 btrfs_header_owner(eb), btrfs_header_bytenr(eb), slot, 94 key.objectid, key.offset, &vaf); 95 va_end(args); 96 } 97 98 /* 99 * Return 0 if the btrfs_file_extent_##name is aligned to @alignment 100 * Else return 1 101 */ 102 #define CHECK_FE_ALIGNED(leaf, slot, fi, name, alignment) \ 103 ({ \ 104 if (unlikely(!IS_ALIGNED(btrfs_file_extent_##name((leaf), (fi)), \ 105 (alignment)))) \ 106 file_extent_err((leaf), (slot), \ 107 "invalid %s for file extent, have %llu, should be aligned to %u", \ 108 (#name), btrfs_file_extent_##name((leaf), (fi)), \ 109 (alignment)); \ 110 (!IS_ALIGNED(btrfs_file_extent_##name((leaf), (fi)), (alignment))); \ 111 }) 112 113 static u64 file_extent_end(struct extent_buffer *leaf, 114 struct btrfs_key *key, 115 struct btrfs_file_extent_item *extent) 116 { 117 u64 end; 118 u64 len; 119 120 if (btrfs_file_extent_type(leaf, extent) == BTRFS_FILE_EXTENT_INLINE) { 121 len = btrfs_file_extent_ram_bytes(leaf, extent); 122 end = ALIGN(key->offset + len, leaf->fs_info->sectorsize); 123 } else { 124 len = btrfs_file_extent_num_bytes(leaf, extent); 125 end = key->offset + len; 126 } 127 return end; 128 } 129 130 /* 131 * Customized report for dir_item, the only new important information is 132 * key->objectid, which represents inode number 133 */ 134 __printf(3, 4) 135 __cold 136 static void dir_item_err(const struct extent_buffer *eb, int slot, 137 const char *fmt, ...) 138 { 139 const struct btrfs_fs_info *fs_info = eb->fs_info; 140 struct btrfs_key key; 141 struct va_format vaf; 142 va_list args; 143 144 btrfs_item_key_to_cpu(eb, &key, slot); 145 va_start(args, fmt); 146 147 vaf.fmt = fmt; 148 vaf.va = &args; 149 150 btrfs_crit(fs_info, 151 "corrupt %s: root=%llu block=%llu slot=%d ino=%llu, %pV", 152 btrfs_header_level(eb) == 0 ? "leaf" : "node", 153 btrfs_header_owner(eb), btrfs_header_bytenr(eb), slot, 154 key.objectid, &vaf); 155 va_end(args); 156 } 157 158 /* 159 * This functions checks prev_key->objectid, to ensure current key and prev_key 160 * share the same objectid as inode number. 161 * 162 * This is to detect missing INODE_ITEM in subvolume trees. 163 * 164 * Return true if everything is OK or we don't need to check. 165 * Return false if anything is wrong. 166 */ 167 static bool check_prev_ino(struct extent_buffer *leaf, 168 struct btrfs_key *key, int slot, 169 struct btrfs_key *prev_key) 170 { 171 /* No prev key, skip check */ 172 if (slot == 0) 173 return true; 174 175 /* Only these key->types needs to be checked */ 176 ASSERT(key->type == BTRFS_XATTR_ITEM_KEY || 177 key->type == BTRFS_INODE_REF_KEY || 178 key->type == BTRFS_DIR_INDEX_KEY || 179 key->type == BTRFS_DIR_ITEM_KEY || 180 key->type == BTRFS_EXTENT_DATA_KEY); 181 182 /* 183 * Only subvolume trees along with their reloc trees need this check. 184 * Things like log tree doesn't follow this ino requirement. 185 */ 186 if (!is_fstree(btrfs_header_owner(leaf))) 187 return true; 188 189 if (key->objectid == prev_key->objectid) 190 return true; 191 192 /* Error found */ 193 dir_item_err(leaf, slot, 194 "invalid previous key objectid, have %llu expect %llu", 195 prev_key->objectid, key->objectid); 196 return false; 197 } 198 static int check_extent_data_item(struct extent_buffer *leaf, 199 struct btrfs_key *key, int slot, 200 struct btrfs_key *prev_key) 201 { 202 struct btrfs_fs_info *fs_info = leaf->fs_info; 203 struct btrfs_file_extent_item *fi; 204 u32 sectorsize = fs_info->sectorsize; 205 u32 item_size = btrfs_item_size(leaf, slot); 206 u64 extent_end; 207 208 if (unlikely(!IS_ALIGNED(key->offset, sectorsize))) { 209 file_extent_err(leaf, slot, 210 "unaligned file_offset for file extent, have %llu should be aligned to %u", 211 key->offset, sectorsize); 212 return -EUCLEAN; 213 } 214 215 /* 216 * Previous key must have the same key->objectid (ino). 217 * It can be XATTR_ITEM, INODE_ITEM or just another EXTENT_DATA. 218 * But if objectids mismatch, it means we have a missing 219 * INODE_ITEM. 220 */ 221 if (unlikely(!check_prev_ino(leaf, key, slot, prev_key))) 222 return -EUCLEAN; 223 224 fi = btrfs_item_ptr(leaf, slot, struct btrfs_file_extent_item); 225 226 /* 227 * Make sure the item contains at least inline header, so the file 228 * extent type is not some garbage. 229 */ 230 if (unlikely(item_size < BTRFS_FILE_EXTENT_INLINE_DATA_START)) { 231 file_extent_err(leaf, slot, 232 "invalid item size, have %u expect [%zu, %u)", 233 item_size, BTRFS_FILE_EXTENT_INLINE_DATA_START, 234 SZ_4K); 235 return -EUCLEAN; 236 } 237 if (unlikely(btrfs_file_extent_type(leaf, fi) >= 238 BTRFS_NR_FILE_EXTENT_TYPES)) { 239 file_extent_err(leaf, slot, 240 "invalid type for file extent, have %u expect range [0, %u]", 241 btrfs_file_extent_type(leaf, fi), 242 BTRFS_NR_FILE_EXTENT_TYPES - 1); 243 return -EUCLEAN; 244 } 245 246 /* 247 * Support for new compression/encryption must introduce incompat flag, 248 * and must be caught in open_ctree(). 249 */ 250 if (unlikely(btrfs_file_extent_compression(leaf, fi) >= 251 BTRFS_NR_COMPRESS_TYPES)) { 252 file_extent_err(leaf, slot, 253 "invalid compression for file extent, have %u expect range [0, %u]", 254 btrfs_file_extent_compression(leaf, fi), 255 BTRFS_NR_COMPRESS_TYPES - 1); 256 return -EUCLEAN; 257 } 258 if (unlikely(btrfs_file_extent_encryption(leaf, fi))) { 259 file_extent_err(leaf, slot, 260 "invalid encryption for file extent, have %u expect 0", 261 btrfs_file_extent_encryption(leaf, fi)); 262 return -EUCLEAN; 263 } 264 if (btrfs_file_extent_type(leaf, fi) == BTRFS_FILE_EXTENT_INLINE) { 265 /* Inline extent must have 0 as key offset */ 266 if (unlikely(key->offset)) { 267 file_extent_err(leaf, slot, 268 "invalid file_offset for inline file extent, have %llu expect 0", 269 key->offset); 270 return -EUCLEAN; 271 } 272 273 /* Compressed inline extent has no on-disk size, skip it */ 274 if (btrfs_file_extent_compression(leaf, fi) != 275 BTRFS_COMPRESS_NONE) 276 return 0; 277 278 /* Uncompressed inline extent size must match item size */ 279 if (unlikely(item_size != BTRFS_FILE_EXTENT_INLINE_DATA_START + 280 btrfs_file_extent_ram_bytes(leaf, fi))) { 281 file_extent_err(leaf, slot, 282 "invalid ram_bytes for uncompressed inline extent, have %u expect %llu", 283 item_size, BTRFS_FILE_EXTENT_INLINE_DATA_START + 284 btrfs_file_extent_ram_bytes(leaf, fi)); 285 return -EUCLEAN; 286 } 287 return 0; 288 } 289 290 /* Regular or preallocated extent has fixed item size */ 291 if (unlikely(item_size != sizeof(*fi))) { 292 file_extent_err(leaf, slot, 293 "invalid item size for reg/prealloc file extent, have %u expect %zu", 294 item_size, sizeof(*fi)); 295 return -EUCLEAN; 296 } 297 if (unlikely(CHECK_FE_ALIGNED(leaf, slot, fi, ram_bytes, sectorsize) || 298 CHECK_FE_ALIGNED(leaf, slot, fi, disk_bytenr, sectorsize) || 299 CHECK_FE_ALIGNED(leaf, slot, fi, disk_num_bytes, sectorsize) || 300 CHECK_FE_ALIGNED(leaf, slot, fi, offset, sectorsize) || 301 CHECK_FE_ALIGNED(leaf, slot, fi, num_bytes, sectorsize))) 302 return -EUCLEAN; 303 304 /* Catch extent end overflow */ 305 if (unlikely(check_add_overflow(btrfs_file_extent_num_bytes(leaf, fi), 306 key->offset, &extent_end))) { 307 file_extent_err(leaf, slot, 308 "extent end overflow, have file offset %llu extent num bytes %llu", 309 key->offset, 310 btrfs_file_extent_num_bytes(leaf, fi)); 311 return -EUCLEAN; 312 } 313 314 /* 315 * Check that no two consecutive file extent items, in the same leaf, 316 * present ranges that overlap each other. 317 */ 318 if (slot > 0 && 319 prev_key->objectid == key->objectid && 320 prev_key->type == BTRFS_EXTENT_DATA_KEY) { 321 struct btrfs_file_extent_item *prev_fi; 322 u64 prev_end; 323 324 prev_fi = btrfs_item_ptr(leaf, slot - 1, 325 struct btrfs_file_extent_item); 326 prev_end = file_extent_end(leaf, prev_key, prev_fi); 327 if (unlikely(prev_end > key->offset)) { 328 file_extent_err(leaf, slot - 1, 329 "file extent end range (%llu) goes beyond start offset (%llu) of the next file extent", 330 prev_end, key->offset); 331 return -EUCLEAN; 332 } 333 } 334 335 return 0; 336 } 337 338 static int check_csum_item(struct extent_buffer *leaf, struct btrfs_key *key, 339 int slot, struct btrfs_key *prev_key) 340 { 341 struct btrfs_fs_info *fs_info = leaf->fs_info; 342 u32 sectorsize = fs_info->sectorsize; 343 const u32 csumsize = fs_info->csum_size; 344 345 if (unlikely(key->objectid != BTRFS_EXTENT_CSUM_OBJECTID)) { 346 generic_err(leaf, slot, 347 "invalid key objectid for csum item, have %llu expect %llu", 348 key->objectid, BTRFS_EXTENT_CSUM_OBJECTID); 349 return -EUCLEAN; 350 } 351 if (unlikely(!IS_ALIGNED(key->offset, sectorsize))) { 352 generic_err(leaf, slot, 353 "unaligned key offset for csum item, have %llu should be aligned to %u", 354 key->offset, sectorsize); 355 return -EUCLEAN; 356 } 357 if (unlikely(!IS_ALIGNED(btrfs_item_size(leaf, slot), csumsize))) { 358 generic_err(leaf, slot, 359 "unaligned item size for csum item, have %u should be aligned to %u", 360 btrfs_item_size(leaf, slot), csumsize); 361 return -EUCLEAN; 362 } 363 if (slot > 0 && prev_key->type == BTRFS_EXTENT_CSUM_KEY) { 364 u64 prev_csum_end; 365 u32 prev_item_size; 366 367 prev_item_size = btrfs_item_size(leaf, slot - 1); 368 prev_csum_end = (prev_item_size / csumsize) * sectorsize; 369 prev_csum_end += prev_key->offset; 370 if (unlikely(prev_csum_end > key->offset)) { 371 generic_err(leaf, slot - 1, 372 "csum end range (%llu) goes beyond the start range (%llu) of the next csum item", 373 prev_csum_end, key->offset); 374 return -EUCLEAN; 375 } 376 } 377 return 0; 378 } 379 380 /* Inode item error output has the same format as dir_item_err() */ 381 #define inode_item_err(eb, slot, fmt, ...) \ 382 dir_item_err(eb, slot, fmt, __VA_ARGS__) 383 384 static int check_inode_key(struct extent_buffer *leaf, struct btrfs_key *key, 385 int slot) 386 { 387 struct btrfs_key item_key; 388 bool is_inode_item; 389 390 btrfs_item_key_to_cpu(leaf, &item_key, slot); 391 is_inode_item = (item_key.type == BTRFS_INODE_ITEM_KEY); 392 393 /* For XATTR_ITEM, location key should be all 0 */ 394 if (item_key.type == BTRFS_XATTR_ITEM_KEY) { 395 if (unlikely(key->objectid != 0 || key->type != 0 || 396 key->offset != 0)) 397 return -EUCLEAN; 398 return 0; 399 } 400 401 if (unlikely((key->objectid < BTRFS_FIRST_FREE_OBJECTID || 402 key->objectid > BTRFS_LAST_FREE_OBJECTID) && 403 key->objectid != BTRFS_ROOT_TREE_DIR_OBJECTID && 404 key->objectid != BTRFS_FREE_INO_OBJECTID)) { 405 if (is_inode_item) { 406 generic_err(leaf, slot, 407 "invalid key objectid: has %llu expect %llu or [%llu, %llu] or %llu", 408 key->objectid, BTRFS_ROOT_TREE_DIR_OBJECTID, 409 BTRFS_FIRST_FREE_OBJECTID, 410 BTRFS_LAST_FREE_OBJECTID, 411 BTRFS_FREE_INO_OBJECTID); 412 } else { 413 dir_item_err(leaf, slot, 414 "invalid location key objectid: has %llu expect %llu or [%llu, %llu] or %llu", 415 key->objectid, BTRFS_ROOT_TREE_DIR_OBJECTID, 416 BTRFS_FIRST_FREE_OBJECTID, 417 BTRFS_LAST_FREE_OBJECTID, 418 BTRFS_FREE_INO_OBJECTID); 419 } 420 return -EUCLEAN; 421 } 422 if (unlikely(key->offset != 0)) { 423 if (is_inode_item) 424 inode_item_err(leaf, slot, 425 "invalid key offset: has %llu expect 0", 426 key->offset); 427 else 428 dir_item_err(leaf, slot, 429 "invalid location key offset:has %llu expect 0", 430 key->offset); 431 return -EUCLEAN; 432 } 433 return 0; 434 } 435 436 static int check_root_key(struct extent_buffer *leaf, struct btrfs_key *key, 437 int slot) 438 { 439 struct btrfs_key item_key; 440 bool is_root_item; 441 442 btrfs_item_key_to_cpu(leaf, &item_key, slot); 443 is_root_item = (item_key.type == BTRFS_ROOT_ITEM_KEY); 444 445 /* No such tree id */ 446 if (unlikely(key->objectid == 0)) { 447 if (is_root_item) 448 generic_err(leaf, slot, "invalid root id 0"); 449 else 450 dir_item_err(leaf, slot, 451 "invalid location key root id 0"); 452 return -EUCLEAN; 453 } 454 455 /* DIR_ITEM/INDEX/INODE_REF is not allowed to point to non-fs trees */ 456 if (unlikely(!is_fstree(key->objectid) && !is_root_item)) { 457 dir_item_err(leaf, slot, 458 "invalid location key objectid, have %llu expect [%llu, %llu]", 459 key->objectid, BTRFS_FIRST_FREE_OBJECTID, 460 BTRFS_LAST_FREE_OBJECTID); 461 return -EUCLEAN; 462 } 463 464 /* 465 * ROOT_ITEM with non-zero offset means this is a snapshot, created at 466 * @offset transid. 467 * Furthermore, for location key in DIR_ITEM, its offset is always -1. 468 * 469 * So here we only check offset for reloc tree whose key->offset must 470 * be a valid tree. 471 */ 472 if (unlikely(key->objectid == BTRFS_TREE_RELOC_OBJECTID && 473 key->offset == 0)) { 474 generic_err(leaf, slot, "invalid root id 0 for reloc tree"); 475 return -EUCLEAN; 476 } 477 return 0; 478 } 479 480 static int check_dir_item(struct extent_buffer *leaf, 481 struct btrfs_key *key, struct btrfs_key *prev_key, 482 int slot) 483 { 484 struct btrfs_fs_info *fs_info = leaf->fs_info; 485 struct btrfs_dir_item *di; 486 u32 item_size = btrfs_item_size(leaf, slot); 487 u32 cur = 0; 488 489 if (unlikely(!check_prev_ino(leaf, key, slot, prev_key))) 490 return -EUCLEAN; 491 492 di = btrfs_item_ptr(leaf, slot, struct btrfs_dir_item); 493 while (cur < item_size) { 494 struct btrfs_key location_key; 495 u32 name_len; 496 u32 data_len; 497 u32 max_name_len; 498 u32 total_size; 499 u32 name_hash; 500 u8 dir_type; 501 int ret; 502 503 /* header itself should not cross item boundary */ 504 if (unlikely(cur + sizeof(*di) > item_size)) { 505 dir_item_err(leaf, slot, 506 "dir item header crosses item boundary, have %zu boundary %u", 507 cur + sizeof(*di), item_size); 508 return -EUCLEAN; 509 } 510 511 /* Location key check */ 512 btrfs_dir_item_key_to_cpu(leaf, di, &location_key); 513 if (location_key.type == BTRFS_ROOT_ITEM_KEY) { 514 ret = check_root_key(leaf, &location_key, slot); 515 if (unlikely(ret < 0)) 516 return ret; 517 } else if (location_key.type == BTRFS_INODE_ITEM_KEY || 518 location_key.type == 0) { 519 ret = check_inode_key(leaf, &location_key, slot); 520 if (unlikely(ret < 0)) 521 return ret; 522 } else { 523 dir_item_err(leaf, slot, 524 "invalid location key type, have %u, expect %u or %u", 525 location_key.type, BTRFS_ROOT_ITEM_KEY, 526 BTRFS_INODE_ITEM_KEY); 527 return -EUCLEAN; 528 } 529 530 /* dir type check */ 531 dir_type = btrfs_dir_type(leaf, di); 532 if (unlikely(dir_type >= BTRFS_FT_MAX)) { 533 dir_item_err(leaf, slot, 534 "invalid dir item type, have %u expect [0, %u)", 535 dir_type, BTRFS_FT_MAX); 536 return -EUCLEAN; 537 } 538 539 if (unlikely(key->type == BTRFS_XATTR_ITEM_KEY && 540 dir_type != BTRFS_FT_XATTR)) { 541 dir_item_err(leaf, slot, 542 "invalid dir item type for XATTR key, have %u expect %u", 543 dir_type, BTRFS_FT_XATTR); 544 return -EUCLEAN; 545 } 546 if (unlikely(dir_type == BTRFS_FT_XATTR && 547 key->type != BTRFS_XATTR_ITEM_KEY)) { 548 dir_item_err(leaf, slot, 549 "xattr dir type found for non-XATTR key"); 550 return -EUCLEAN; 551 } 552 if (dir_type == BTRFS_FT_XATTR) 553 max_name_len = XATTR_NAME_MAX; 554 else 555 max_name_len = BTRFS_NAME_LEN; 556 557 /* Name/data length check */ 558 name_len = btrfs_dir_name_len(leaf, di); 559 data_len = btrfs_dir_data_len(leaf, di); 560 if (unlikely(name_len > max_name_len)) { 561 dir_item_err(leaf, slot, 562 "dir item name len too long, have %u max %u", 563 name_len, max_name_len); 564 return -EUCLEAN; 565 } 566 if (unlikely(name_len + data_len > BTRFS_MAX_XATTR_SIZE(fs_info))) { 567 dir_item_err(leaf, slot, 568 "dir item name and data len too long, have %u max %u", 569 name_len + data_len, 570 BTRFS_MAX_XATTR_SIZE(fs_info)); 571 return -EUCLEAN; 572 } 573 574 if (unlikely(data_len && dir_type != BTRFS_FT_XATTR)) { 575 dir_item_err(leaf, slot, 576 "dir item with invalid data len, have %u expect 0", 577 data_len); 578 return -EUCLEAN; 579 } 580 581 total_size = sizeof(*di) + name_len + data_len; 582 583 /* header and name/data should not cross item boundary */ 584 if (unlikely(cur + total_size > item_size)) { 585 dir_item_err(leaf, slot, 586 "dir item data crosses item boundary, have %u boundary %u", 587 cur + total_size, item_size); 588 return -EUCLEAN; 589 } 590 591 /* 592 * Special check for XATTR/DIR_ITEM, as key->offset is name 593 * hash, should match its name 594 */ 595 if (key->type == BTRFS_DIR_ITEM_KEY || 596 key->type == BTRFS_XATTR_ITEM_KEY) { 597 char namebuf[max(BTRFS_NAME_LEN, XATTR_NAME_MAX)]; 598 599 read_extent_buffer(leaf, namebuf, 600 (unsigned long)(di + 1), name_len); 601 name_hash = btrfs_name_hash(namebuf, name_len); 602 if (unlikely(key->offset != name_hash)) { 603 dir_item_err(leaf, slot, 604 "name hash mismatch with key, have 0x%016x expect 0x%016llx", 605 name_hash, key->offset); 606 return -EUCLEAN; 607 } 608 } 609 cur += total_size; 610 di = (struct btrfs_dir_item *)((void *)di + total_size); 611 } 612 return 0; 613 } 614 615 __printf(3, 4) 616 __cold 617 static void block_group_err(const struct extent_buffer *eb, int slot, 618 const char *fmt, ...) 619 { 620 const struct btrfs_fs_info *fs_info = eb->fs_info; 621 struct btrfs_key key; 622 struct va_format vaf; 623 va_list args; 624 625 btrfs_item_key_to_cpu(eb, &key, slot); 626 va_start(args, fmt); 627 628 vaf.fmt = fmt; 629 vaf.va = &args; 630 631 btrfs_crit(fs_info, 632 "corrupt %s: root=%llu block=%llu slot=%d bg_start=%llu bg_len=%llu, %pV", 633 btrfs_header_level(eb) == 0 ? "leaf" : "node", 634 btrfs_header_owner(eb), btrfs_header_bytenr(eb), slot, 635 key.objectid, key.offset, &vaf); 636 va_end(args); 637 } 638 639 static int check_block_group_item(struct extent_buffer *leaf, 640 struct btrfs_key *key, int slot) 641 { 642 struct btrfs_block_group_item bgi; 643 u32 item_size = btrfs_item_size(leaf, slot); 644 u64 flags; 645 u64 type; 646 647 /* 648 * Here we don't really care about alignment since extent allocator can 649 * handle it. We care more about the size. 650 */ 651 if (unlikely(key->offset == 0)) { 652 block_group_err(leaf, slot, 653 "invalid block group size 0"); 654 return -EUCLEAN; 655 } 656 657 if (unlikely(item_size != sizeof(bgi))) { 658 block_group_err(leaf, slot, 659 "invalid item size, have %u expect %zu", 660 item_size, sizeof(bgi)); 661 return -EUCLEAN; 662 } 663 664 read_extent_buffer(leaf, &bgi, btrfs_item_ptr_offset(leaf, slot), 665 sizeof(bgi)); 666 if (unlikely(btrfs_stack_block_group_chunk_objectid(&bgi) != 667 BTRFS_FIRST_CHUNK_TREE_OBJECTID)) { 668 block_group_err(leaf, slot, 669 "invalid block group chunk objectid, have %llu expect %llu", 670 btrfs_stack_block_group_chunk_objectid(&bgi), 671 BTRFS_FIRST_CHUNK_TREE_OBJECTID); 672 return -EUCLEAN; 673 } 674 675 if (unlikely(btrfs_stack_block_group_used(&bgi) > key->offset)) { 676 block_group_err(leaf, slot, 677 "invalid block group used, have %llu expect [0, %llu)", 678 btrfs_stack_block_group_used(&bgi), key->offset); 679 return -EUCLEAN; 680 } 681 682 flags = btrfs_stack_block_group_flags(&bgi); 683 if (unlikely(hweight64(flags & BTRFS_BLOCK_GROUP_PROFILE_MASK) > 1)) { 684 block_group_err(leaf, slot, 685 "invalid profile flags, have 0x%llx (%lu bits set) expect no more than 1 bit set", 686 flags & BTRFS_BLOCK_GROUP_PROFILE_MASK, 687 hweight64(flags & BTRFS_BLOCK_GROUP_PROFILE_MASK)); 688 return -EUCLEAN; 689 } 690 691 type = flags & BTRFS_BLOCK_GROUP_TYPE_MASK; 692 if (unlikely(type != BTRFS_BLOCK_GROUP_DATA && 693 type != BTRFS_BLOCK_GROUP_METADATA && 694 type != BTRFS_BLOCK_GROUP_SYSTEM && 695 type != (BTRFS_BLOCK_GROUP_METADATA | 696 BTRFS_BLOCK_GROUP_DATA))) { 697 block_group_err(leaf, slot, 698 "invalid type, have 0x%llx (%lu bits set) expect either 0x%llx, 0x%llx, 0x%llx or 0x%llx", 699 type, hweight64(type), 700 BTRFS_BLOCK_GROUP_DATA, BTRFS_BLOCK_GROUP_METADATA, 701 BTRFS_BLOCK_GROUP_SYSTEM, 702 BTRFS_BLOCK_GROUP_METADATA | BTRFS_BLOCK_GROUP_DATA); 703 return -EUCLEAN; 704 } 705 return 0; 706 } 707 708 __printf(4, 5) 709 __cold 710 static void chunk_err(const struct extent_buffer *leaf, 711 const struct btrfs_chunk *chunk, u64 logical, 712 const char *fmt, ...) 713 { 714 const struct btrfs_fs_info *fs_info = leaf->fs_info; 715 bool is_sb; 716 struct va_format vaf; 717 va_list args; 718 int i; 719 int slot = -1; 720 721 /* Only superblock eb is able to have such small offset */ 722 is_sb = (leaf->start == BTRFS_SUPER_INFO_OFFSET); 723 724 if (!is_sb) { 725 /* 726 * Get the slot number by iterating through all slots, this 727 * would provide better readability. 728 */ 729 for (i = 0; i < btrfs_header_nritems(leaf); i++) { 730 if (btrfs_item_ptr_offset(leaf, i) == 731 (unsigned long)chunk) { 732 slot = i; 733 break; 734 } 735 } 736 } 737 va_start(args, fmt); 738 vaf.fmt = fmt; 739 vaf.va = &args; 740 741 if (is_sb) 742 btrfs_crit(fs_info, 743 "corrupt superblock syschunk array: chunk_start=%llu, %pV", 744 logical, &vaf); 745 else 746 btrfs_crit(fs_info, 747 "corrupt leaf: root=%llu block=%llu slot=%d chunk_start=%llu, %pV", 748 BTRFS_CHUNK_TREE_OBJECTID, leaf->start, slot, 749 logical, &vaf); 750 va_end(args); 751 } 752 753 /* 754 * The common chunk check which could also work on super block sys chunk array. 755 * 756 * Return -EUCLEAN if anything is corrupted. 757 * Return 0 if everything is OK. 758 */ 759 int btrfs_check_chunk_valid(struct extent_buffer *leaf, 760 struct btrfs_chunk *chunk, u64 logical) 761 { 762 struct btrfs_fs_info *fs_info = leaf->fs_info; 763 u64 length; 764 u64 chunk_end; 765 u64 stripe_len; 766 u16 num_stripes; 767 u16 sub_stripes; 768 u64 type; 769 u64 features; 770 bool mixed = false; 771 int raid_index; 772 int nparity; 773 int ncopies; 774 775 length = btrfs_chunk_length(leaf, chunk); 776 stripe_len = btrfs_chunk_stripe_len(leaf, chunk); 777 num_stripes = btrfs_chunk_num_stripes(leaf, chunk); 778 sub_stripes = btrfs_chunk_sub_stripes(leaf, chunk); 779 type = btrfs_chunk_type(leaf, chunk); 780 raid_index = btrfs_bg_flags_to_raid_index(type); 781 ncopies = btrfs_raid_array[raid_index].ncopies; 782 nparity = btrfs_raid_array[raid_index].nparity; 783 784 if (unlikely(!num_stripes)) { 785 chunk_err(leaf, chunk, logical, 786 "invalid chunk num_stripes, have %u", num_stripes); 787 return -EUCLEAN; 788 } 789 if (unlikely(num_stripes < ncopies)) { 790 chunk_err(leaf, chunk, logical, 791 "invalid chunk num_stripes < ncopies, have %u < %d", 792 num_stripes, ncopies); 793 return -EUCLEAN; 794 } 795 if (unlikely(nparity && num_stripes == nparity)) { 796 chunk_err(leaf, chunk, logical, 797 "invalid chunk num_stripes == nparity, have %u == %d", 798 num_stripes, nparity); 799 return -EUCLEAN; 800 } 801 if (unlikely(!IS_ALIGNED(logical, fs_info->sectorsize))) { 802 chunk_err(leaf, chunk, logical, 803 "invalid chunk logical, have %llu should aligned to %u", 804 logical, fs_info->sectorsize); 805 return -EUCLEAN; 806 } 807 if (unlikely(btrfs_chunk_sector_size(leaf, chunk) != fs_info->sectorsize)) { 808 chunk_err(leaf, chunk, logical, 809 "invalid chunk sectorsize, have %u expect %u", 810 btrfs_chunk_sector_size(leaf, chunk), 811 fs_info->sectorsize); 812 return -EUCLEAN; 813 } 814 if (unlikely(!length || !IS_ALIGNED(length, fs_info->sectorsize))) { 815 chunk_err(leaf, chunk, logical, 816 "invalid chunk length, have %llu", length); 817 return -EUCLEAN; 818 } 819 if (unlikely(check_add_overflow(logical, length, &chunk_end))) { 820 chunk_err(leaf, chunk, logical, 821 "invalid chunk logical start and length, have logical start %llu length %llu", 822 logical, length); 823 return -EUCLEAN; 824 } 825 if (unlikely(!is_power_of_2(stripe_len) || stripe_len != BTRFS_STRIPE_LEN)) { 826 chunk_err(leaf, chunk, logical, 827 "invalid chunk stripe length: %llu", 828 stripe_len); 829 return -EUCLEAN; 830 } 831 if (unlikely(type & ~(BTRFS_BLOCK_GROUP_TYPE_MASK | 832 BTRFS_BLOCK_GROUP_PROFILE_MASK))) { 833 chunk_err(leaf, chunk, logical, 834 "unrecognized chunk type: 0x%llx", 835 ~(BTRFS_BLOCK_GROUP_TYPE_MASK | 836 BTRFS_BLOCK_GROUP_PROFILE_MASK) & 837 btrfs_chunk_type(leaf, chunk)); 838 return -EUCLEAN; 839 } 840 841 if (unlikely(!has_single_bit_set(type & BTRFS_BLOCK_GROUP_PROFILE_MASK) && 842 (type & BTRFS_BLOCK_GROUP_PROFILE_MASK) != 0)) { 843 chunk_err(leaf, chunk, logical, 844 "invalid chunk profile flag: 0x%llx, expect 0 or 1 bit set", 845 type & BTRFS_BLOCK_GROUP_PROFILE_MASK); 846 return -EUCLEAN; 847 } 848 if (unlikely((type & BTRFS_BLOCK_GROUP_TYPE_MASK) == 0)) { 849 chunk_err(leaf, chunk, logical, 850 "missing chunk type flag, have 0x%llx one bit must be set in 0x%llx", 851 type, BTRFS_BLOCK_GROUP_TYPE_MASK); 852 return -EUCLEAN; 853 } 854 855 if (unlikely((type & BTRFS_BLOCK_GROUP_SYSTEM) && 856 (type & (BTRFS_BLOCK_GROUP_METADATA | 857 BTRFS_BLOCK_GROUP_DATA)))) { 858 chunk_err(leaf, chunk, logical, 859 "system chunk with data or metadata type: 0x%llx", 860 type); 861 return -EUCLEAN; 862 } 863 864 features = btrfs_super_incompat_flags(fs_info->super_copy); 865 if (features & BTRFS_FEATURE_INCOMPAT_MIXED_GROUPS) 866 mixed = true; 867 868 if (!mixed) { 869 if (unlikely((type & BTRFS_BLOCK_GROUP_METADATA) && 870 (type & BTRFS_BLOCK_GROUP_DATA))) { 871 chunk_err(leaf, chunk, logical, 872 "mixed chunk type in non-mixed mode: 0x%llx", type); 873 return -EUCLEAN; 874 } 875 } 876 877 if (unlikely((type & BTRFS_BLOCK_GROUP_RAID10 && 878 sub_stripes != btrfs_raid_array[BTRFS_RAID_RAID10].sub_stripes) || 879 (type & BTRFS_BLOCK_GROUP_RAID1 && 880 num_stripes != btrfs_raid_array[BTRFS_RAID_RAID1].devs_min) || 881 (type & BTRFS_BLOCK_GROUP_RAID1C3 && 882 num_stripes != btrfs_raid_array[BTRFS_RAID_RAID1C3].devs_min) || 883 (type & BTRFS_BLOCK_GROUP_RAID1C4 && 884 num_stripes != btrfs_raid_array[BTRFS_RAID_RAID1C4].devs_min) || 885 (type & BTRFS_BLOCK_GROUP_RAID5 && 886 num_stripes < btrfs_raid_array[BTRFS_RAID_RAID5].devs_min) || 887 (type & BTRFS_BLOCK_GROUP_RAID6 && 888 num_stripes < btrfs_raid_array[BTRFS_RAID_RAID6].devs_min) || 889 (type & BTRFS_BLOCK_GROUP_DUP && 890 num_stripes != btrfs_raid_array[BTRFS_RAID_DUP].dev_stripes) || 891 ((type & BTRFS_BLOCK_GROUP_PROFILE_MASK) == 0 && 892 num_stripes != btrfs_raid_array[BTRFS_RAID_SINGLE].dev_stripes))) { 893 chunk_err(leaf, chunk, logical, 894 "invalid num_stripes:sub_stripes %u:%u for profile %llu", 895 num_stripes, sub_stripes, 896 type & BTRFS_BLOCK_GROUP_PROFILE_MASK); 897 return -EUCLEAN; 898 } 899 900 return 0; 901 } 902 903 /* 904 * Enhanced version of chunk item checker. 905 * 906 * The common btrfs_check_chunk_valid() doesn't check item size since it needs 907 * to work on super block sys_chunk_array which doesn't have full item ptr. 908 */ 909 static int check_leaf_chunk_item(struct extent_buffer *leaf, 910 struct btrfs_chunk *chunk, 911 struct btrfs_key *key, int slot) 912 { 913 int num_stripes; 914 915 if (unlikely(btrfs_item_size(leaf, slot) < sizeof(struct btrfs_chunk))) { 916 chunk_err(leaf, chunk, key->offset, 917 "invalid chunk item size: have %u expect [%zu, %u)", 918 btrfs_item_size(leaf, slot), 919 sizeof(struct btrfs_chunk), 920 BTRFS_LEAF_DATA_SIZE(leaf->fs_info)); 921 return -EUCLEAN; 922 } 923 924 num_stripes = btrfs_chunk_num_stripes(leaf, chunk); 925 /* Let btrfs_check_chunk_valid() handle this error type */ 926 if (num_stripes == 0) 927 goto out; 928 929 if (unlikely(btrfs_chunk_item_size(num_stripes) != 930 btrfs_item_size(leaf, slot))) { 931 chunk_err(leaf, chunk, key->offset, 932 "invalid chunk item size: have %u expect %lu", 933 btrfs_item_size(leaf, slot), 934 btrfs_chunk_item_size(num_stripes)); 935 return -EUCLEAN; 936 } 937 out: 938 return btrfs_check_chunk_valid(leaf, chunk, key->offset); 939 } 940 941 __printf(3, 4) 942 __cold 943 static void dev_item_err(const struct extent_buffer *eb, int slot, 944 const char *fmt, ...) 945 { 946 struct btrfs_key key; 947 struct va_format vaf; 948 va_list args; 949 950 btrfs_item_key_to_cpu(eb, &key, slot); 951 va_start(args, fmt); 952 953 vaf.fmt = fmt; 954 vaf.va = &args; 955 956 btrfs_crit(eb->fs_info, 957 "corrupt %s: root=%llu block=%llu slot=%d devid=%llu %pV", 958 btrfs_header_level(eb) == 0 ? "leaf" : "node", 959 btrfs_header_owner(eb), btrfs_header_bytenr(eb), slot, 960 key.objectid, &vaf); 961 va_end(args); 962 } 963 964 static int check_dev_item(struct extent_buffer *leaf, 965 struct btrfs_key *key, int slot) 966 { 967 struct btrfs_dev_item *ditem; 968 const u32 item_size = btrfs_item_size(leaf, slot); 969 970 if (unlikely(key->objectid != BTRFS_DEV_ITEMS_OBJECTID)) { 971 dev_item_err(leaf, slot, 972 "invalid objectid: has=%llu expect=%llu", 973 key->objectid, BTRFS_DEV_ITEMS_OBJECTID); 974 return -EUCLEAN; 975 } 976 977 if (unlikely(item_size != sizeof(*ditem))) { 978 dev_item_err(leaf, slot, "invalid item size: has %u expect %zu", 979 item_size, sizeof(*ditem)); 980 return -EUCLEAN; 981 } 982 983 ditem = btrfs_item_ptr(leaf, slot, struct btrfs_dev_item); 984 if (unlikely(btrfs_device_id(leaf, ditem) != key->offset)) { 985 dev_item_err(leaf, slot, 986 "devid mismatch: key has=%llu item has=%llu", 987 key->offset, btrfs_device_id(leaf, ditem)); 988 return -EUCLEAN; 989 } 990 991 /* 992 * For device total_bytes, we don't have reliable way to check it, as 993 * it can be 0 for device removal. Device size check can only be done 994 * by dev extents check. 995 */ 996 if (unlikely(btrfs_device_bytes_used(leaf, ditem) > 997 btrfs_device_total_bytes(leaf, ditem))) { 998 dev_item_err(leaf, slot, 999 "invalid bytes used: have %llu expect [0, %llu]", 1000 btrfs_device_bytes_used(leaf, ditem), 1001 btrfs_device_total_bytes(leaf, ditem)); 1002 return -EUCLEAN; 1003 } 1004 /* 1005 * Remaining members like io_align/type/gen/dev_group aren't really 1006 * utilized. Skip them to make later usage of them easier. 1007 */ 1008 return 0; 1009 } 1010 1011 static int check_inode_item(struct extent_buffer *leaf, 1012 struct btrfs_key *key, int slot) 1013 { 1014 struct btrfs_fs_info *fs_info = leaf->fs_info; 1015 struct btrfs_inode_item *iitem; 1016 u64 super_gen = btrfs_super_generation(fs_info->super_copy); 1017 u32 valid_mask = (S_IFMT | S_ISUID | S_ISGID | S_ISVTX | 0777); 1018 const u32 item_size = btrfs_item_size(leaf, slot); 1019 u32 mode; 1020 int ret; 1021 u32 flags; 1022 u32 ro_flags; 1023 1024 ret = check_inode_key(leaf, key, slot); 1025 if (unlikely(ret < 0)) 1026 return ret; 1027 1028 if (unlikely(item_size != sizeof(*iitem))) { 1029 generic_err(leaf, slot, "invalid item size: has %u expect %zu", 1030 item_size, sizeof(*iitem)); 1031 return -EUCLEAN; 1032 } 1033 1034 iitem = btrfs_item_ptr(leaf, slot, struct btrfs_inode_item); 1035 1036 /* Here we use super block generation + 1 to handle log tree */ 1037 if (unlikely(btrfs_inode_generation(leaf, iitem) > super_gen + 1)) { 1038 inode_item_err(leaf, slot, 1039 "invalid inode generation: has %llu expect (0, %llu]", 1040 btrfs_inode_generation(leaf, iitem), 1041 super_gen + 1); 1042 return -EUCLEAN; 1043 } 1044 /* Note for ROOT_TREE_DIR_ITEM, mkfs could set its transid 0 */ 1045 if (unlikely(btrfs_inode_transid(leaf, iitem) > super_gen + 1)) { 1046 inode_item_err(leaf, slot, 1047 "invalid inode transid: has %llu expect [0, %llu]", 1048 btrfs_inode_transid(leaf, iitem), super_gen + 1); 1049 return -EUCLEAN; 1050 } 1051 1052 /* 1053 * For size and nbytes it's better not to be too strict, as for dir 1054 * item its size/nbytes can easily get wrong, but doesn't affect 1055 * anything in the fs. So here we skip the check. 1056 */ 1057 mode = btrfs_inode_mode(leaf, iitem); 1058 if (unlikely(mode & ~valid_mask)) { 1059 inode_item_err(leaf, slot, 1060 "unknown mode bit detected: 0x%x", 1061 mode & ~valid_mask); 1062 return -EUCLEAN; 1063 } 1064 1065 /* 1066 * S_IFMT is not bit mapped so we can't completely rely on 1067 * is_power_of_2/has_single_bit_set, but it can save us from checking 1068 * FIFO/CHR/DIR/REG. Only needs to check BLK, LNK and SOCKS 1069 */ 1070 if (!has_single_bit_set(mode & S_IFMT)) { 1071 if (unlikely(!S_ISLNK(mode) && !S_ISBLK(mode) && !S_ISSOCK(mode))) { 1072 inode_item_err(leaf, slot, 1073 "invalid mode: has 0%o expect valid S_IF* bit(s)", 1074 mode & S_IFMT); 1075 return -EUCLEAN; 1076 } 1077 } 1078 if (unlikely(S_ISDIR(mode) && btrfs_inode_nlink(leaf, iitem) > 1)) { 1079 inode_item_err(leaf, slot, 1080 "invalid nlink: has %u expect no more than 1 for dir", 1081 btrfs_inode_nlink(leaf, iitem)); 1082 return -EUCLEAN; 1083 } 1084 btrfs_inode_split_flags(btrfs_inode_flags(leaf, iitem), &flags, &ro_flags); 1085 if (unlikely(flags & ~BTRFS_INODE_FLAG_MASK)) { 1086 inode_item_err(leaf, slot, 1087 "unknown incompat flags detected: 0x%x", flags); 1088 return -EUCLEAN; 1089 } 1090 if (unlikely(!sb_rdonly(fs_info->sb) && 1091 (ro_flags & ~BTRFS_INODE_RO_FLAG_MASK))) { 1092 inode_item_err(leaf, slot, 1093 "unknown ro-compat flags detected on writeable mount: 0x%x", 1094 ro_flags); 1095 return -EUCLEAN; 1096 } 1097 return 0; 1098 } 1099 1100 static int check_root_item(struct extent_buffer *leaf, struct btrfs_key *key, 1101 int slot) 1102 { 1103 struct btrfs_fs_info *fs_info = leaf->fs_info; 1104 struct btrfs_root_item ri = { 0 }; 1105 const u64 valid_root_flags = BTRFS_ROOT_SUBVOL_RDONLY | 1106 BTRFS_ROOT_SUBVOL_DEAD; 1107 int ret; 1108 1109 ret = check_root_key(leaf, key, slot); 1110 if (unlikely(ret < 0)) 1111 return ret; 1112 1113 if (unlikely(btrfs_item_size(leaf, slot) != sizeof(ri) && 1114 btrfs_item_size(leaf, slot) != 1115 btrfs_legacy_root_item_size())) { 1116 generic_err(leaf, slot, 1117 "invalid root item size, have %u expect %zu or %u", 1118 btrfs_item_size(leaf, slot), sizeof(ri), 1119 btrfs_legacy_root_item_size()); 1120 return -EUCLEAN; 1121 } 1122 1123 /* 1124 * For legacy root item, the members starting at generation_v2 will be 1125 * all filled with 0. 1126 * And since we allow geneartion_v2 as 0, it will still pass the check. 1127 */ 1128 read_extent_buffer(leaf, &ri, btrfs_item_ptr_offset(leaf, slot), 1129 btrfs_item_size(leaf, slot)); 1130 1131 /* Generation related */ 1132 if (unlikely(btrfs_root_generation(&ri) > 1133 btrfs_super_generation(fs_info->super_copy) + 1)) { 1134 generic_err(leaf, slot, 1135 "invalid root generation, have %llu expect (0, %llu]", 1136 btrfs_root_generation(&ri), 1137 btrfs_super_generation(fs_info->super_copy) + 1); 1138 return -EUCLEAN; 1139 } 1140 if (unlikely(btrfs_root_generation_v2(&ri) > 1141 btrfs_super_generation(fs_info->super_copy) + 1)) { 1142 generic_err(leaf, slot, 1143 "invalid root v2 generation, have %llu expect (0, %llu]", 1144 btrfs_root_generation_v2(&ri), 1145 btrfs_super_generation(fs_info->super_copy) + 1); 1146 return -EUCLEAN; 1147 } 1148 if (unlikely(btrfs_root_last_snapshot(&ri) > 1149 btrfs_super_generation(fs_info->super_copy) + 1)) { 1150 generic_err(leaf, slot, 1151 "invalid root last_snapshot, have %llu expect (0, %llu]", 1152 btrfs_root_last_snapshot(&ri), 1153 btrfs_super_generation(fs_info->super_copy) + 1); 1154 return -EUCLEAN; 1155 } 1156 1157 /* Alignment and level check */ 1158 if (unlikely(!IS_ALIGNED(btrfs_root_bytenr(&ri), fs_info->sectorsize))) { 1159 generic_err(leaf, slot, 1160 "invalid root bytenr, have %llu expect to be aligned to %u", 1161 btrfs_root_bytenr(&ri), fs_info->sectorsize); 1162 return -EUCLEAN; 1163 } 1164 if (unlikely(btrfs_root_level(&ri) >= BTRFS_MAX_LEVEL)) { 1165 generic_err(leaf, slot, 1166 "invalid root level, have %u expect [0, %u]", 1167 btrfs_root_level(&ri), BTRFS_MAX_LEVEL - 1); 1168 return -EUCLEAN; 1169 } 1170 if (unlikely(btrfs_root_drop_level(&ri) >= BTRFS_MAX_LEVEL)) { 1171 generic_err(leaf, slot, 1172 "invalid root level, have %u expect [0, %u]", 1173 btrfs_root_drop_level(&ri), BTRFS_MAX_LEVEL - 1); 1174 return -EUCLEAN; 1175 } 1176 1177 /* Flags check */ 1178 if (unlikely(btrfs_root_flags(&ri) & ~valid_root_flags)) { 1179 generic_err(leaf, slot, 1180 "invalid root flags, have 0x%llx expect mask 0x%llx", 1181 btrfs_root_flags(&ri), valid_root_flags); 1182 return -EUCLEAN; 1183 } 1184 return 0; 1185 } 1186 1187 __printf(3,4) 1188 __cold 1189 static void extent_err(const struct extent_buffer *eb, int slot, 1190 const char *fmt, ...) 1191 { 1192 struct btrfs_key key; 1193 struct va_format vaf; 1194 va_list args; 1195 u64 bytenr; 1196 u64 len; 1197 1198 btrfs_item_key_to_cpu(eb, &key, slot); 1199 bytenr = key.objectid; 1200 if (key.type == BTRFS_METADATA_ITEM_KEY || 1201 key.type == BTRFS_TREE_BLOCK_REF_KEY || 1202 key.type == BTRFS_SHARED_BLOCK_REF_KEY) 1203 len = eb->fs_info->nodesize; 1204 else 1205 len = key.offset; 1206 va_start(args, fmt); 1207 1208 vaf.fmt = fmt; 1209 vaf.va = &args; 1210 1211 btrfs_crit(eb->fs_info, 1212 "corrupt %s: block=%llu slot=%d extent bytenr=%llu len=%llu %pV", 1213 btrfs_header_level(eb) == 0 ? "leaf" : "node", 1214 eb->start, slot, bytenr, len, &vaf); 1215 va_end(args); 1216 } 1217 1218 static int check_extent_item(struct extent_buffer *leaf, 1219 struct btrfs_key *key, int slot) 1220 { 1221 struct btrfs_fs_info *fs_info = leaf->fs_info; 1222 struct btrfs_extent_item *ei; 1223 bool is_tree_block = false; 1224 unsigned long ptr; /* Current pointer inside inline refs */ 1225 unsigned long end; /* Extent item end */ 1226 const u32 item_size = btrfs_item_size(leaf, slot); 1227 u64 flags; 1228 u64 generation; 1229 u64 total_refs; /* Total refs in btrfs_extent_item */ 1230 u64 inline_refs = 0; /* found total inline refs */ 1231 1232 if (unlikely(key->type == BTRFS_METADATA_ITEM_KEY && 1233 !btrfs_fs_incompat(fs_info, SKINNY_METADATA))) { 1234 generic_err(leaf, slot, 1235 "invalid key type, METADATA_ITEM type invalid when SKINNY_METADATA feature disabled"); 1236 return -EUCLEAN; 1237 } 1238 /* key->objectid is the bytenr for both key types */ 1239 if (unlikely(!IS_ALIGNED(key->objectid, fs_info->sectorsize))) { 1240 generic_err(leaf, slot, 1241 "invalid key objectid, have %llu expect to be aligned to %u", 1242 key->objectid, fs_info->sectorsize); 1243 return -EUCLEAN; 1244 } 1245 1246 /* key->offset is tree level for METADATA_ITEM_KEY */ 1247 if (unlikely(key->type == BTRFS_METADATA_ITEM_KEY && 1248 key->offset >= BTRFS_MAX_LEVEL)) { 1249 extent_err(leaf, slot, 1250 "invalid tree level, have %llu expect [0, %u]", 1251 key->offset, BTRFS_MAX_LEVEL - 1); 1252 return -EUCLEAN; 1253 } 1254 1255 /* 1256 * EXTENT/METADATA_ITEM consists of: 1257 * 1) One btrfs_extent_item 1258 * Records the total refs, type and generation of the extent. 1259 * 1260 * 2) One btrfs_tree_block_info (for EXTENT_ITEM and tree backref only) 1261 * Records the first key and level of the tree block. 1262 * 1263 * 2) Zero or more btrfs_extent_inline_ref(s) 1264 * Each inline ref has one btrfs_extent_inline_ref shows: 1265 * 2.1) The ref type, one of the 4 1266 * TREE_BLOCK_REF Tree block only 1267 * SHARED_BLOCK_REF Tree block only 1268 * EXTENT_DATA_REF Data only 1269 * SHARED_DATA_REF Data only 1270 * 2.2) Ref type specific data 1271 * Either using btrfs_extent_inline_ref::offset, or specific 1272 * data structure. 1273 */ 1274 if (unlikely(item_size < sizeof(*ei))) { 1275 extent_err(leaf, slot, 1276 "invalid item size, have %u expect [%zu, %u)", 1277 item_size, sizeof(*ei), 1278 BTRFS_LEAF_DATA_SIZE(fs_info)); 1279 return -EUCLEAN; 1280 } 1281 end = item_size + btrfs_item_ptr_offset(leaf, slot); 1282 1283 /* Checks against extent_item */ 1284 ei = btrfs_item_ptr(leaf, slot, struct btrfs_extent_item); 1285 flags = btrfs_extent_flags(leaf, ei); 1286 total_refs = btrfs_extent_refs(leaf, ei); 1287 generation = btrfs_extent_generation(leaf, ei); 1288 if (unlikely(generation > 1289 btrfs_super_generation(fs_info->super_copy) + 1)) { 1290 extent_err(leaf, slot, 1291 "invalid generation, have %llu expect (0, %llu]", 1292 generation, 1293 btrfs_super_generation(fs_info->super_copy) + 1); 1294 return -EUCLEAN; 1295 } 1296 if (unlikely(!has_single_bit_set(flags & (BTRFS_EXTENT_FLAG_DATA | 1297 BTRFS_EXTENT_FLAG_TREE_BLOCK)))) { 1298 extent_err(leaf, slot, 1299 "invalid extent flag, have 0x%llx expect 1 bit set in 0x%llx", 1300 flags, BTRFS_EXTENT_FLAG_DATA | 1301 BTRFS_EXTENT_FLAG_TREE_BLOCK); 1302 return -EUCLEAN; 1303 } 1304 is_tree_block = !!(flags & BTRFS_EXTENT_FLAG_TREE_BLOCK); 1305 if (is_tree_block) { 1306 if (unlikely(key->type == BTRFS_EXTENT_ITEM_KEY && 1307 key->offset != fs_info->nodesize)) { 1308 extent_err(leaf, slot, 1309 "invalid extent length, have %llu expect %u", 1310 key->offset, fs_info->nodesize); 1311 return -EUCLEAN; 1312 } 1313 } else { 1314 if (unlikely(key->type != BTRFS_EXTENT_ITEM_KEY)) { 1315 extent_err(leaf, slot, 1316 "invalid key type, have %u expect %u for data backref", 1317 key->type, BTRFS_EXTENT_ITEM_KEY); 1318 return -EUCLEAN; 1319 } 1320 if (unlikely(!IS_ALIGNED(key->offset, fs_info->sectorsize))) { 1321 extent_err(leaf, slot, 1322 "invalid extent length, have %llu expect aligned to %u", 1323 key->offset, fs_info->sectorsize); 1324 return -EUCLEAN; 1325 } 1326 if (unlikely(flags & BTRFS_BLOCK_FLAG_FULL_BACKREF)) { 1327 extent_err(leaf, slot, 1328 "invalid extent flag, data has full backref set"); 1329 return -EUCLEAN; 1330 } 1331 } 1332 ptr = (unsigned long)(struct btrfs_extent_item *)(ei + 1); 1333 1334 /* Check the special case of btrfs_tree_block_info */ 1335 if (is_tree_block && key->type != BTRFS_METADATA_ITEM_KEY) { 1336 struct btrfs_tree_block_info *info; 1337 1338 info = (struct btrfs_tree_block_info *)ptr; 1339 if (unlikely(btrfs_tree_block_level(leaf, info) >= BTRFS_MAX_LEVEL)) { 1340 extent_err(leaf, slot, 1341 "invalid tree block info level, have %u expect [0, %u]", 1342 btrfs_tree_block_level(leaf, info), 1343 BTRFS_MAX_LEVEL - 1); 1344 return -EUCLEAN; 1345 } 1346 ptr = (unsigned long)(struct btrfs_tree_block_info *)(info + 1); 1347 } 1348 1349 /* Check inline refs */ 1350 while (ptr < end) { 1351 struct btrfs_extent_inline_ref *iref; 1352 struct btrfs_extent_data_ref *dref; 1353 struct btrfs_shared_data_ref *sref; 1354 u64 dref_offset; 1355 u64 inline_offset; 1356 u8 inline_type; 1357 1358 if (unlikely(ptr + sizeof(*iref) > end)) { 1359 extent_err(leaf, slot, 1360 "inline ref item overflows extent item, ptr %lu iref size %zu end %lu", 1361 ptr, sizeof(*iref), end); 1362 return -EUCLEAN; 1363 } 1364 iref = (struct btrfs_extent_inline_ref *)ptr; 1365 inline_type = btrfs_extent_inline_ref_type(leaf, iref); 1366 inline_offset = btrfs_extent_inline_ref_offset(leaf, iref); 1367 if (unlikely(ptr + btrfs_extent_inline_ref_size(inline_type) > end)) { 1368 extent_err(leaf, slot, 1369 "inline ref item overflows extent item, ptr %lu iref size %u end %lu", 1370 ptr, inline_type, end); 1371 return -EUCLEAN; 1372 } 1373 1374 switch (inline_type) { 1375 /* inline_offset is subvolid of the owner, no need to check */ 1376 case BTRFS_TREE_BLOCK_REF_KEY: 1377 inline_refs++; 1378 break; 1379 /* Contains parent bytenr */ 1380 case BTRFS_SHARED_BLOCK_REF_KEY: 1381 if (unlikely(!IS_ALIGNED(inline_offset, 1382 fs_info->sectorsize))) { 1383 extent_err(leaf, slot, 1384 "invalid tree parent bytenr, have %llu expect aligned to %u", 1385 inline_offset, fs_info->sectorsize); 1386 return -EUCLEAN; 1387 } 1388 inline_refs++; 1389 break; 1390 /* 1391 * Contains owner subvolid, owner key objectid, adjusted offset. 1392 * The only obvious corruption can happen in that offset. 1393 */ 1394 case BTRFS_EXTENT_DATA_REF_KEY: 1395 dref = (struct btrfs_extent_data_ref *)(&iref->offset); 1396 dref_offset = btrfs_extent_data_ref_offset(leaf, dref); 1397 if (unlikely(!IS_ALIGNED(dref_offset, 1398 fs_info->sectorsize))) { 1399 extent_err(leaf, slot, 1400 "invalid data ref offset, have %llu expect aligned to %u", 1401 dref_offset, fs_info->sectorsize); 1402 return -EUCLEAN; 1403 } 1404 inline_refs += btrfs_extent_data_ref_count(leaf, dref); 1405 break; 1406 /* Contains parent bytenr and ref count */ 1407 case BTRFS_SHARED_DATA_REF_KEY: 1408 sref = (struct btrfs_shared_data_ref *)(iref + 1); 1409 if (unlikely(!IS_ALIGNED(inline_offset, 1410 fs_info->sectorsize))) { 1411 extent_err(leaf, slot, 1412 "invalid data parent bytenr, have %llu expect aligned to %u", 1413 inline_offset, fs_info->sectorsize); 1414 return -EUCLEAN; 1415 } 1416 inline_refs += btrfs_shared_data_ref_count(leaf, sref); 1417 break; 1418 default: 1419 extent_err(leaf, slot, "unknown inline ref type: %u", 1420 inline_type); 1421 return -EUCLEAN; 1422 } 1423 ptr += btrfs_extent_inline_ref_size(inline_type); 1424 } 1425 /* No padding is allowed */ 1426 if (unlikely(ptr != end)) { 1427 extent_err(leaf, slot, 1428 "invalid extent item size, padding bytes found"); 1429 return -EUCLEAN; 1430 } 1431 1432 /* Finally, check the inline refs against total refs */ 1433 if (unlikely(inline_refs > total_refs)) { 1434 extent_err(leaf, slot, 1435 "invalid extent refs, have %llu expect >= inline %llu", 1436 total_refs, inline_refs); 1437 return -EUCLEAN; 1438 } 1439 return 0; 1440 } 1441 1442 static int check_simple_keyed_refs(struct extent_buffer *leaf, 1443 struct btrfs_key *key, int slot) 1444 { 1445 u32 expect_item_size = 0; 1446 1447 if (key->type == BTRFS_SHARED_DATA_REF_KEY) 1448 expect_item_size = sizeof(struct btrfs_shared_data_ref); 1449 1450 if (unlikely(btrfs_item_size(leaf, slot) != expect_item_size)) { 1451 generic_err(leaf, slot, 1452 "invalid item size, have %u expect %u for key type %u", 1453 btrfs_item_size(leaf, slot), 1454 expect_item_size, key->type); 1455 return -EUCLEAN; 1456 } 1457 if (unlikely(!IS_ALIGNED(key->objectid, leaf->fs_info->sectorsize))) { 1458 generic_err(leaf, slot, 1459 "invalid key objectid for shared block ref, have %llu expect aligned to %u", 1460 key->objectid, leaf->fs_info->sectorsize); 1461 return -EUCLEAN; 1462 } 1463 if (unlikely(key->type != BTRFS_TREE_BLOCK_REF_KEY && 1464 !IS_ALIGNED(key->offset, leaf->fs_info->sectorsize))) { 1465 extent_err(leaf, slot, 1466 "invalid tree parent bytenr, have %llu expect aligned to %u", 1467 key->offset, leaf->fs_info->sectorsize); 1468 return -EUCLEAN; 1469 } 1470 return 0; 1471 } 1472 1473 static int check_extent_data_ref(struct extent_buffer *leaf, 1474 struct btrfs_key *key, int slot) 1475 { 1476 struct btrfs_extent_data_ref *dref; 1477 unsigned long ptr = btrfs_item_ptr_offset(leaf, slot); 1478 const unsigned long end = ptr + btrfs_item_size(leaf, slot); 1479 1480 if (unlikely(btrfs_item_size(leaf, slot) % sizeof(*dref) != 0)) { 1481 generic_err(leaf, slot, 1482 "invalid item size, have %u expect aligned to %zu for key type %u", 1483 btrfs_item_size(leaf, slot), 1484 sizeof(*dref), key->type); 1485 return -EUCLEAN; 1486 } 1487 if (unlikely(!IS_ALIGNED(key->objectid, leaf->fs_info->sectorsize))) { 1488 generic_err(leaf, slot, 1489 "invalid key objectid for shared block ref, have %llu expect aligned to %u", 1490 key->objectid, leaf->fs_info->sectorsize); 1491 return -EUCLEAN; 1492 } 1493 for (; ptr < end; ptr += sizeof(*dref)) { 1494 u64 offset; 1495 1496 /* 1497 * We cannot check the extent_data_ref hash due to possible 1498 * overflow from the leaf due to hash collisions. 1499 */ 1500 dref = (struct btrfs_extent_data_ref *)ptr; 1501 offset = btrfs_extent_data_ref_offset(leaf, dref); 1502 if (unlikely(!IS_ALIGNED(offset, leaf->fs_info->sectorsize))) { 1503 extent_err(leaf, slot, 1504 "invalid extent data backref offset, have %llu expect aligned to %u", 1505 offset, leaf->fs_info->sectorsize); 1506 return -EUCLEAN; 1507 } 1508 } 1509 return 0; 1510 } 1511 1512 #define inode_ref_err(eb, slot, fmt, args...) \ 1513 inode_item_err(eb, slot, fmt, ##args) 1514 static int check_inode_ref(struct extent_buffer *leaf, 1515 struct btrfs_key *key, struct btrfs_key *prev_key, 1516 int slot) 1517 { 1518 struct btrfs_inode_ref *iref; 1519 unsigned long ptr; 1520 unsigned long end; 1521 1522 if (unlikely(!check_prev_ino(leaf, key, slot, prev_key))) 1523 return -EUCLEAN; 1524 /* namelen can't be 0, so item_size == sizeof() is also invalid */ 1525 if (unlikely(btrfs_item_size(leaf, slot) <= sizeof(*iref))) { 1526 inode_ref_err(leaf, slot, 1527 "invalid item size, have %u expect (%zu, %u)", 1528 btrfs_item_size(leaf, slot), 1529 sizeof(*iref), BTRFS_LEAF_DATA_SIZE(leaf->fs_info)); 1530 return -EUCLEAN; 1531 } 1532 1533 ptr = btrfs_item_ptr_offset(leaf, slot); 1534 end = ptr + btrfs_item_size(leaf, slot); 1535 while (ptr < end) { 1536 u16 namelen; 1537 1538 if (unlikely(ptr + sizeof(iref) > end)) { 1539 inode_ref_err(leaf, slot, 1540 "inode ref overflow, ptr %lu end %lu inode_ref_size %zu", 1541 ptr, end, sizeof(iref)); 1542 return -EUCLEAN; 1543 } 1544 1545 iref = (struct btrfs_inode_ref *)ptr; 1546 namelen = btrfs_inode_ref_name_len(leaf, iref); 1547 if (unlikely(ptr + sizeof(*iref) + namelen > end)) { 1548 inode_ref_err(leaf, slot, 1549 "inode ref overflow, ptr %lu end %lu namelen %u", 1550 ptr, end, namelen); 1551 return -EUCLEAN; 1552 } 1553 1554 /* 1555 * NOTE: In theory we should record all found index numbers 1556 * to find any duplicated indexes, but that will be too time 1557 * consuming for inodes with too many hard links. 1558 */ 1559 ptr += sizeof(*iref) + namelen; 1560 } 1561 return 0; 1562 } 1563 1564 /* 1565 * Common point to switch the item-specific validation. 1566 */ 1567 static int check_leaf_item(struct extent_buffer *leaf, 1568 struct btrfs_key *key, int slot, 1569 struct btrfs_key *prev_key) 1570 { 1571 int ret = 0; 1572 struct btrfs_chunk *chunk; 1573 1574 switch (key->type) { 1575 case BTRFS_EXTENT_DATA_KEY: 1576 ret = check_extent_data_item(leaf, key, slot, prev_key); 1577 break; 1578 case BTRFS_EXTENT_CSUM_KEY: 1579 ret = check_csum_item(leaf, key, slot, prev_key); 1580 break; 1581 case BTRFS_DIR_ITEM_KEY: 1582 case BTRFS_DIR_INDEX_KEY: 1583 case BTRFS_XATTR_ITEM_KEY: 1584 ret = check_dir_item(leaf, key, prev_key, slot); 1585 break; 1586 case BTRFS_INODE_REF_KEY: 1587 ret = check_inode_ref(leaf, key, prev_key, slot); 1588 break; 1589 case BTRFS_BLOCK_GROUP_ITEM_KEY: 1590 ret = check_block_group_item(leaf, key, slot); 1591 break; 1592 case BTRFS_CHUNK_ITEM_KEY: 1593 chunk = btrfs_item_ptr(leaf, slot, struct btrfs_chunk); 1594 ret = check_leaf_chunk_item(leaf, chunk, key, slot); 1595 break; 1596 case BTRFS_DEV_ITEM_KEY: 1597 ret = check_dev_item(leaf, key, slot); 1598 break; 1599 case BTRFS_INODE_ITEM_KEY: 1600 ret = check_inode_item(leaf, key, slot); 1601 break; 1602 case BTRFS_ROOT_ITEM_KEY: 1603 ret = check_root_item(leaf, key, slot); 1604 break; 1605 case BTRFS_EXTENT_ITEM_KEY: 1606 case BTRFS_METADATA_ITEM_KEY: 1607 ret = check_extent_item(leaf, key, slot); 1608 break; 1609 case BTRFS_TREE_BLOCK_REF_KEY: 1610 case BTRFS_SHARED_DATA_REF_KEY: 1611 case BTRFS_SHARED_BLOCK_REF_KEY: 1612 ret = check_simple_keyed_refs(leaf, key, slot); 1613 break; 1614 case BTRFS_EXTENT_DATA_REF_KEY: 1615 ret = check_extent_data_ref(leaf, key, slot); 1616 break; 1617 } 1618 return ret; 1619 } 1620 1621 static int check_leaf(struct extent_buffer *leaf, bool check_item_data) 1622 { 1623 struct btrfs_fs_info *fs_info = leaf->fs_info; 1624 /* No valid key type is 0, so all key should be larger than this key */ 1625 struct btrfs_key prev_key = {0, 0, 0}; 1626 struct btrfs_key key; 1627 u32 nritems = btrfs_header_nritems(leaf); 1628 int slot; 1629 1630 if (unlikely(btrfs_header_level(leaf) != 0)) { 1631 generic_err(leaf, 0, 1632 "invalid level for leaf, have %d expect 0", 1633 btrfs_header_level(leaf)); 1634 return -EUCLEAN; 1635 } 1636 1637 /* 1638 * Extent buffers from a relocation tree have a owner field that 1639 * corresponds to the subvolume tree they are based on. So just from an 1640 * extent buffer alone we can not find out what is the id of the 1641 * corresponding subvolume tree, so we can not figure out if the extent 1642 * buffer corresponds to the root of the relocation tree or not. So 1643 * skip this check for relocation trees. 1644 */ 1645 if (nritems == 0 && !btrfs_header_flag(leaf, BTRFS_HEADER_FLAG_RELOC)) { 1646 u64 owner = btrfs_header_owner(leaf); 1647 1648 /* These trees must never be empty */ 1649 if (unlikely(owner == BTRFS_ROOT_TREE_OBJECTID || 1650 owner == BTRFS_CHUNK_TREE_OBJECTID || 1651 owner == BTRFS_EXTENT_TREE_OBJECTID || 1652 owner == BTRFS_DEV_TREE_OBJECTID || 1653 owner == BTRFS_FS_TREE_OBJECTID || 1654 owner == BTRFS_DATA_RELOC_TREE_OBJECTID)) { 1655 generic_err(leaf, 0, 1656 "invalid root, root %llu must never be empty", 1657 owner); 1658 return -EUCLEAN; 1659 } 1660 /* Unknown tree */ 1661 if (unlikely(owner == 0)) { 1662 generic_err(leaf, 0, 1663 "invalid owner, root 0 is not defined"); 1664 return -EUCLEAN; 1665 } 1666 return 0; 1667 } 1668 1669 if (unlikely(nritems == 0)) 1670 return 0; 1671 1672 /* 1673 * Check the following things to make sure this is a good leaf, and 1674 * leaf users won't need to bother with similar sanity checks: 1675 * 1676 * 1) key ordering 1677 * 2) item offset and size 1678 * No overlap, no hole, all inside the leaf. 1679 * 3) item content 1680 * If possible, do comprehensive sanity check. 1681 * NOTE: All checks must only rely on the item data itself. 1682 */ 1683 for (slot = 0; slot < nritems; slot++) { 1684 u32 item_end_expected; 1685 int ret; 1686 1687 btrfs_item_key_to_cpu(leaf, &key, slot); 1688 1689 /* Make sure the keys are in the right order */ 1690 if (unlikely(btrfs_comp_cpu_keys(&prev_key, &key) >= 0)) { 1691 generic_err(leaf, slot, 1692 "bad key order, prev (%llu %u %llu) current (%llu %u %llu)", 1693 prev_key.objectid, prev_key.type, 1694 prev_key.offset, key.objectid, key.type, 1695 key.offset); 1696 return -EUCLEAN; 1697 } 1698 1699 /* 1700 * Make sure the offset and ends are right, remember that the 1701 * item data starts at the end of the leaf and grows towards the 1702 * front. 1703 */ 1704 if (slot == 0) 1705 item_end_expected = BTRFS_LEAF_DATA_SIZE(fs_info); 1706 else 1707 item_end_expected = btrfs_item_offset(leaf, 1708 slot - 1); 1709 if (unlikely(btrfs_item_data_end(leaf, slot) != item_end_expected)) { 1710 generic_err(leaf, slot, 1711 "unexpected item end, have %u expect %u", 1712 btrfs_item_data_end(leaf, slot), 1713 item_end_expected); 1714 return -EUCLEAN; 1715 } 1716 1717 /* 1718 * Check to make sure that we don't point outside of the leaf, 1719 * just in case all the items are consistent to each other, but 1720 * all point outside of the leaf. 1721 */ 1722 if (unlikely(btrfs_item_data_end(leaf, slot) > 1723 BTRFS_LEAF_DATA_SIZE(fs_info))) { 1724 generic_err(leaf, slot, 1725 "slot end outside of leaf, have %u expect range [0, %u]", 1726 btrfs_item_data_end(leaf, slot), 1727 BTRFS_LEAF_DATA_SIZE(fs_info)); 1728 return -EUCLEAN; 1729 } 1730 1731 /* Also check if the item pointer overlaps with btrfs item. */ 1732 if (unlikely(btrfs_item_ptr_offset(leaf, slot) < 1733 btrfs_item_nr_offset(slot) + sizeof(struct btrfs_item))) { 1734 generic_err(leaf, slot, 1735 "slot overlaps with its data, item end %lu data start %lu", 1736 btrfs_item_nr_offset(slot) + 1737 sizeof(struct btrfs_item), 1738 btrfs_item_ptr_offset(leaf, slot)); 1739 return -EUCLEAN; 1740 } 1741 1742 if (check_item_data) { 1743 /* 1744 * Check if the item size and content meet other 1745 * criteria 1746 */ 1747 ret = check_leaf_item(leaf, &key, slot, &prev_key); 1748 if (unlikely(ret < 0)) 1749 return ret; 1750 } 1751 1752 prev_key.objectid = key.objectid; 1753 prev_key.type = key.type; 1754 prev_key.offset = key.offset; 1755 } 1756 1757 return 0; 1758 } 1759 1760 int btrfs_check_leaf_full(struct extent_buffer *leaf) 1761 { 1762 return check_leaf(leaf, true); 1763 } 1764 ALLOW_ERROR_INJECTION(btrfs_check_leaf_full, ERRNO); 1765 1766 int btrfs_check_leaf_relaxed(struct extent_buffer *leaf) 1767 { 1768 return check_leaf(leaf, false); 1769 } 1770 1771 int btrfs_check_node(struct extent_buffer *node) 1772 { 1773 struct btrfs_fs_info *fs_info = node->fs_info; 1774 unsigned long nr = btrfs_header_nritems(node); 1775 struct btrfs_key key, next_key; 1776 int slot; 1777 int level = btrfs_header_level(node); 1778 u64 bytenr; 1779 int ret = 0; 1780 1781 if (unlikely(level <= 0 || level >= BTRFS_MAX_LEVEL)) { 1782 generic_err(node, 0, 1783 "invalid level for node, have %d expect [1, %d]", 1784 level, BTRFS_MAX_LEVEL - 1); 1785 return -EUCLEAN; 1786 } 1787 if (unlikely(nr == 0 || nr > BTRFS_NODEPTRS_PER_BLOCK(fs_info))) { 1788 btrfs_crit(fs_info, 1789 "corrupt node: root=%llu block=%llu, nritems too %s, have %lu expect range [1,%u]", 1790 btrfs_header_owner(node), node->start, 1791 nr == 0 ? "small" : "large", nr, 1792 BTRFS_NODEPTRS_PER_BLOCK(fs_info)); 1793 return -EUCLEAN; 1794 } 1795 1796 for (slot = 0; slot < nr - 1; slot++) { 1797 bytenr = btrfs_node_blockptr(node, slot); 1798 btrfs_node_key_to_cpu(node, &key, slot); 1799 btrfs_node_key_to_cpu(node, &next_key, slot + 1); 1800 1801 if (unlikely(!bytenr)) { 1802 generic_err(node, slot, 1803 "invalid NULL node pointer"); 1804 ret = -EUCLEAN; 1805 goto out; 1806 } 1807 if (unlikely(!IS_ALIGNED(bytenr, fs_info->sectorsize))) { 1808 generic_err(node, slot, 1809 "unaligned pointer, have %llu should be aligned to %u", 1810 bytenr, fs_info->sectorsize); 1811 ret = -EUCLEAN; 1812 goto out; 1813 } 1814 1815 if (unlikely(btrfs_comp_cpu_keys(&key, &next_key) >= 0)) { 1816 generic_err(node, slot, 1817 "bad key order, current (%llu %u %llu) next (%llu %u %llu)", 1818 key.objectid, key.type, key.offset, 1819 next_key.objectid, next_key.type, 1820 next_key.offset); 1821 ret = -EUCLEAN; 1822 goto out; 1823 } 1824 } 1825 out: 1826 return ret; 1827 } 1828 ALLOW_ERROR_INJECTION(btrfs_check_node, ERRNO); 1829