1	// SPDX-License-Identifier: GPL-2.0
2	/*
3	* Copyright (C) Qu Wenruo 2017. All rights reserved.
4	*/
5
6	/*
7	* The module is used to catch unexpected/corrupted tree block data.
8	* Such behavior can be caused either by a fuzzed image or bugs.
9	*
10	* The objective is to do leaf/node validation checks when tree block is read
11	* from disk, and check *every* possible member, so other code won't
12	* need to checking them again.
13	*
14	* Due to the potential and unwanted damage, every checker needs to be
15	* carefully reviewed otherwise so it does not prevent mount of valid images.
16	*/
17
18	#include <linux/types.h>
19	#include <linux/stddef.h>
20	#include <linux/error-injection.h>
21	#include "messages.h"
22	#include "ctree.h"
23	#include "tree-checker.h"
24	#include "compression.h"
25	#include "volumes.h"
26	#include "misc.h"
27	#include "fs.h"
28	#include "accessors.h"
29	#include "file-item.h"
30	#include "inode-item.h"
31	#include "dir-item.h"
32	#include "extent-tree.h"
33
34	/*
35	* Error message should follow the following format:
36	* corrupt <type>: <identifier>, <reason>[, <bad_value>]
37	*
38	* @type: leaf or node
39	* @identifier: the necessary info to locate the leaf/node.
40	* It's recommended to decode key.objecitd/offset if it's
41	* meaningful.
42	* @reason: describe the error
43	* @bad_value: optional, it's recommended to output bad value and its
44	* expected value (range).
45	*
46	* Since comma is used to separate the components, only space is allowed
47	* inside each component.
48	*/
49
50	/*
51	* Append generic "corrupt leaf/node root=%llu block=%llu slot=%d: " to @fmt.
52	* Allows callers to customize the output.
53	*/
54	__printf(3, 4)
55	__cold
56	static void generic_err(const struct extent_buffer *eb, int slot,
57	const char *fmt, ...)
58	{
59	const struct btrfs_fs_info *fs_info = eb->fs_info;
60	struct va_format vaf;
61	va_list args;
62
63	va_start(args, fmt);
64
65	vaf.fmt = fmt;
66	vaf.va = &args;
67
68	dump_page(folio_page(eb->folios[0], 0), reason: "eb page dump");
69	btrfs_crit(fs_info,
70	"corrupt %s: root=%llu block=%llu slot=%d, %pV",
71	btrfs_header_level(eb) == 0 ? "leaf" : "node",
72	btrfs_header_owner(eb), btrfs_header_bytenr(eb), slot, &vaf);
73	va_end(args);
74	}
75
76	/*
77	* Customized reporter for extent data item, since its key objectid and
78	* offset has its own meaning.
79	*/
80	__printf(3, 4)
81	__cold
82	static void file_extent_err(const struct extent_buffer *eb, int slot,
83	const char *fmt, ...)
84	{
85	const struct btrfs_fs_info *fs_info = eb->fs_info;
86	struct btrfs_key key;
87	struct va_format vaf;
88	va_list args;
89
90	btrfs_item_key_to_cpu(eb, cpu_key: &key, nr: slot);
91	va_start(args, fmt);
92
93	vaf.fmt = fmt;
94	vaf.va = &args;
95
96	dump_page(folio_page(eb->folios[0], 0), reason: "eb page dump");
97	btrfs_crit(fs_info,
98	"corrupt %s: root=%llu block=%llu slot=%d ino=%llu file_offset=%llu, %pV",
99	btrfs_header_level(eb) == 0 ? "leaf" : "node",
100	btrfs_header_owner(eb), btrfs_header_bytenr(eb), slot,
101	key.objectid, key.offset, &vaf);
102	va_end(args);
103	}
104
105	/*
106	* Return 0 if the btrfs_file_extent_##name is aligned to @alignment
107	* Else return 1
108	*/
109	#define CHECK_FE_ALIGNED(leaf, slot, fi, name, alignment) \
110	({ \
111	if (unlikely(!IS_ALIGNED(btrfs_file_extent_##name((leaf), (fi)), \
112	(alignment)))) \
113	file_extent_err((leaf), (slot), \
114	"invalid %s for file extent, have %llu, should be aligned to %u", \
115	(#name), btrfs_file_extent_##name((leaf), (fi)), \
116	(alignment)); \
117	(!IS_ALIGNED(btrfs_file_extent_##name((leaf), (fi)), (alignment))); \
118	})
119
120	static u64 file_extent_end(struct extent_buffer *leaf,
121	struct btrfs_key *key,
122	struct btrfs_file_extent_item *extent)
123	{
124	u64 end;
125	u64 len;
126
127	if (btrfs_file_extent_type(eb: leaf, s: extent) == BTRFS_FILE_EXTENT_INLINE) {
128	len = btrfs_file_extent_ram_bytes(eb: leaf, s: extent);
129	end = ALIGN(key->offset + len, leaf->fs_info->sectorsize);
130	} else {
131	len = btrfs_file_extent_num_bytes(eb: leaf, s: extent);
132	end = key->offset + len;
133	}
134	return end;
135	}
136
137	/*
138	* Customized report for dir_item, the only new important information is
139	* key->objectid, which represents inode number
140	*/
141	__printf(3, 4)
142	__cold
143	static void dir_item_err(const struct extent_buffer *eb, int slot,
144	const char *fmt, ...)
145	{
146	const struct btrfs_fs_info *fs_info = eb->fs_info;
147	struct btrfs_key key;
148	struct va_format vaf;
149	va_list args;
150
151	btrfs_item_key_to_cpu(eb, cpu_key: &key, nr: slot);
152	va_start(args, fmt);
153
154	vaf.fmt = fmt;
155	vaf.va = &args;
156
157	dump_page(folio_page(eb->folios[0], 0), reason: "eb page dump");
158	btrfs_crit(fs_info,
159	"corrupt %s: root=%llu block=%llu slot=%d ino=%llu, %pV",
160	btrfs_header_level(eb) == 0 ? "leaf" : "node",
161	btrfs_header_owner(eb), btrfs_header_bytenr(eb), slot,
162	key.objectid, &vaf);
163	va_end(args);
164	}
165
166	/*
167	* This functions checks prev_key->objectid, to ensure current key and prev_key
168	* share the same objectid as inode number.
169	*
170	* This is to detect missing INODE_ITEM in subvolume trees.
171	*
172	* Return true if everything is OK or we don't need to check.
173	* Return false if anything is wrong.
174	*/
175	static bool check_prev_ino(struct extent_buffer *leaf,
176	struct btrfs_key *key, int slot,
177	struct btrfs_key *prev_key)
178	{
179	/* No prev key, skip check */
180	if (slot == 0)
181	return true;
182
183	/* Only these key->types needs to be checked */
184	ASSERT(key->type == BTRFS_XATTR_ITEM_KEY ||
185	key->type == BTRFS_INODE_REF_KEY ||
186	key->type == BTRFS_DIR_INDEX_KEY ||
187	key->type == BTRFS_DIR_ITEM_KEY ||
188	key->type == BTRFS_EXTENT_DATA_KEY);
189
190	/*
191	* Only subvolume trees along with their reloc trees need this check.
192	* Things like log tree doesn't follow this ino requirement.
193	*/
194	if (!is_fstree(rootid: btrfs_header_owner(eb: leaf)))
195	return true;
196
197	if (key->objectid == prev_key->objectid)
198	return true;
199
200	/* Error found */
201	dir_item_err(eb: leaf, slot,
202	fmt: "invalid previous key objectid, have %llu expect %llu",
203	prev_key->objectid, key->objectid);
204	return false;
205	}
206	static int check_extent_data_item(struct extent_buffer *leaf,
207	struct btrfs_key *key, int slot,
208	struct btrfs_key *prev_key)
209	{
210	struct btrfs_fs_info *fs_info = leaf->fs_info;
211	struct btrfs_file_extent_item *fi;
212	u32 sectorsize = fs_info->sectorsize;
213	u32 item_size = btrfs_item_size(eb: leaf, slot);
214	u64 extent_end;
215
216	if (unlikely(!IS_ALIGNED(key->offset, sectorsize))) {
217	file_extent_err(eb: leaf, slot,
218	fmt: "unaligned file_offset for file extent, have %llu should be aligned to %u",
219	key->offset, sectorsize);
220	return -EUCLEAN;
221	}
222
223	/*
224	* Previous key must have the same key->objectid (ino).
225	* It can be XATTR_ITEM, INODE_ITEM or just another EXTENT_DATA.
226	* But if objectids mismatch, it means we have a missing
227	* INODE_ITEM.
228	*/
229	if (unlikely(!check_prev_ino(leaf, key, slot, prev_key)))
230	return -EUCLEAN;
231
232	fi = btrfs_item_ptr(leaf, slot, struct btrfs_file_extent_item);
233
234	/*
235	* Make sure the item contains at least inline header, so the file
236	* extent type is not some garbage.
237	*/
238	if (unlikely(item_size < BTRFS_FILE_EXTENT_INLINE_DATA_START)) {
239	file_extent_err(eb: leaf, slot,
240	fmt: "invalid item size, have %u expect [%zu, %u)",
241	item_size, BTRFS_FILE_EXTENT_INLINE_DATA_START,
242	SZ_4K);
243	return -EUCLEAN;
244	}
245	if (unlikely(btrfs_file_extent_type(leaf, fi) >=
246	BTRFS_NR_FILE_EXTENT_TYPES)) {
247	file_extent_err(eb: leaf, slot,
248	fmt: "invalid type for file extent, have %u expect range [0, %u]",
249	btrfs_file_extent_type(eb: leaf, s: fi),
250	BTRFS_NR_FILE_EXTENT_TYPES - 1);
251	return -EUCLEAN;
252	}
253
254	/*
255	* Support for new compression/encryption must introduce incompat flag,
256	* and must be caught in open_ctree().
257	*/
258	if (unlikely(btrfs_file_extent_compression(leaf, fi) >=
259	BTRFS_NR_COMPRESS_TYPES)) {
260	file_extent_err(eb: leaf, slot,
261	fmt: "invalid compression for file extent, have %u expect range [0, %u]",
262	btrfs_file_extent_compression(eb: leaf, s: fi),
263	BTRFS_NR_COMPRESS_TYPES - 1);
264	return -EUCLEAN;
265	}
266	if (unlikely(btrfs_file_extent_encryption(leaf, fi))) {
267	file_extent_err(eb: leaf, slot,
268	fmt: "invalid encryption for file extent, have %u expect 0",
269	btrfs_file_extent_encryption(eb: leaf, s: fi));
270	return -EUCLEAN;
271	}
272	if (btrfs_file_extent_type(eb: leaf, s: fi) == BTRFS_FILE_EXTENT_INLINE) {
273	/* Inline extent must have 0 as key offset */
274	if (unlikely(key->offset)) {
275	file_extent_err(eb: leaf, slot,
276	fmt: "invalid file_offset for inline file extent, have %llu expect 0",
277	key->offset);
278	return -EUCLEAN;
279	}
280
281	/* Compressed inline extent has no on-disk size, skip it */
282	if (btrfs_file_extent_compression(eb: leaf, s: fi) !=
283	BTRFS_COMPRESS_NONE)
284	return 0;
285
286	/* Uncompressed inline extent size must match item size */
287	if (unlikely(item_size != BTRFS_FILE_EXTENT_INLINE_DATA_START +
288	btrfs_file_extent_ram_bytes(leaf, fi))) {
289	file_extent_err(eb: leaf, slot,
290	fmt: "invalid ram_bytes for uncompressed inline extent, have %u expect %llu",
291	item_size, BTRFS_FILE_EXTENT_INLINE_DATA_START +
292	btrfs_file_extent_ram_bytes(eb: leaf, s: fi));
293	return -EUCLEAN;
294	}
295	return 0;
296	}
297
298	/* Regular or preallocated extent has fixed item size */
299	if (unlikely(item_size != sizeof(*fi))) {
300	file_extent_err(eb: leaf, slot,
301	fmt: "invalid item size for reg/prealloc file extent, have %u expect %zu",
302	item_size, sizeof(*fi));
303	return -EUCLEAN;
304	}
305	if (unlikely(CHECK_FE_ALIGNED(leaf, slot, fi, ram_bytes, sectorsize) ||
306	CHECK_FE_ALIGNED(leaf, slot, fi, disk_bytenr, sectorsize) ||
307	CHECK_FE_ALIGNED(leaf, slot, fi, disk_num_bytes, sectorsize) ||
308	CHECK_FE_ALIGNED(leaf, slot, fi, offset, sectorsize) ||
309	CHECK_FE_ALIGNED(leaf, slot, fi, num_bytes, sectorsize)))
310	return -EUCLEAN;
311
312	/* Catch extent end overflow */
313	if (unlikely(check_add_overflow(btrfs_file_extent_num_bytes(leaf, fi),
314	key->offset, &extent_end))) {
315	file_extent_err(eb: leaf, slot,
316	fmt: "extent end overflow, have file offset %llu extent num bytes %llu",
317	key->offset,
318	btrfs_file_extent_num_bytes(eb: leaf, s: fi));
319	return -EUCLEAN;
320	}
321
322	/*
323	* Check that no two consecutive file extent items, in the same leaf,
324	* present ranges that overlap each other.
325	*/
326	if (slot > 0 &&
327	prev_key->objectid == key->objectid &&
328	prev_key->type == BTRFS_EXTENT_DATA_KEY) {
329	struct btrfs_file_extent_item *prev_fi;
330	u64 prev_end;
331
332	prev_fi = btrfs_item_ptr(leaf, slot - 1,
333	struct btrfs_file_extent_item);
334	prev_end = file_extent_end(leaf, key: prev_key, extent: prev_fi);
335	if (unlikely(prev_end > key->offset)) {
336	file_extent_err(eb: leaf, slot: slot - 1,
337	fmt: "file extent end range (%llu) goes beyond start offset (%llu) of the next file extent",
338	prev_end, key->offset);
339	return -EUCLEAN;
340	}
341	}
342
343	return 0;
344	}
345
346	static int check_csum_item(struct extent_buffer *leaf, struct btrfs_key *key,
347	int slot, struct btrfs_key *prev_key)
348	{
349	struct btrfs_fs_info *fs_info = leaf->fs_info;
350	u32 sectorsize = fs_info->sectorsize;
351	const u32 csumsize = fs_info->csum_size;
352
353	if (unlikely(key->objectid != BTRFS_EXTENT_CSUM_OBJECTID)) {
354	generic_err(eb: leaf, slot,
355	fmt: "invalid key objectid for csum item, have %llu expect %llu",
356	key->objectid, BTRFS_EXTENT_CSUM_OBJECTID);
357	return -EUCLEAN;
358	}
359	if (unlikely(!IS_ALIGNED(key->offset, sectorsize))) {
360	generic_err(eb: leaf, slot,
361	fmt: "unaligned key offset for csum item, have %llu should be aligned to %u",
362	key->offset, sectorsize);
363	return -EUCLEAN;
364	}
365	if (unlikely(!IS_ALIGNED(btrfs_item_size(leaf, slot), csumsize))) {
366	generic_err(eb: leaf, slot,
367	fmt: "unaligned item size for csum item, have %u should be aligned to %u",
368	btrfs_item_size(eb: leaf, slot), csumsize);
369	return -EUCLEAN;
370	}
371	if (slot > 0 && prev_key->type == BTRFS_EXTENT_CSUM_KEY) {
372	u64 prev_csum_end;
373	u32 prev_item_size;
374
375	prev_item_size = btrfs_item_size(eb: leaf, slot: slot - 1);
376	prev_csum_end = (prev_item_size / csumsize) * sectorsize;
377	prev_csum_end += prev_key->offset;
378	if (unlikely(prev_csum_end > key->offset)) {
379	generic_err(eb: leaf, slot: slot - 1,
380	fmt: "csum end range (%llu) goes beyond the start range (%llu) of the next csum item",
381	prev_csum_end, key->offset);
382	return -EUCLEAN;
383	}
384	}
385	return 0;
386	}
387
388	/* Inode item error output has the same format as dir_item_err() */
389	#define inode_item_err(eb, slot, fmt, ...) \
390	dir_item_err(eb, slot, fmt, __VA_ARGS__)
391
392	static int check_inode_key(struct extent_buffer *leaf, struct btrfs_key *key,
393	int slot)
394	{
395	struct btrfs_key item_key;
396	bool is_inode_item;
397
398	btrfs_item_key_to_cpu(eb: leaf, cpu_key: &item_key, nr: slot);
399	is_inode_item = (item_key.type == BTRFS_INODE_ITEM_KEY);
400
401	/* For XATTR_ITEM, location key should be all 0 */
402	if (item_key.type == BTRFS_XATTR_ITEM_KEY) {
403	if (unlikely(key->objectid != 0 || key->type != 0 ||
404	key->offset != 0))
405	return -EUCLEAN;
406	return 0;
407	}
408
409	if (unlikely((key->objectid < BTRFS_FIRST_FREE_OBJECTID ||
410	key->objectid > BTRFS_LAST_FREE_OBJECTID) &&
411	key->objectid != BTRFS_ROOT_TREE_DIR_OBJECTID &&
412	key->objectid != BTRFS_FREE_INO_OBJECTID)) {
413	if (is_inode_item) {
414	generic_err(eb: leaf, slot,
415	fmt: "invalid key objectid: has %llu expect %llu or [%llu, %llu] or %llu",
416	key->objectid, BTRFS_ROOT_TREE_DIR_OBJECTID,
417	BTRFS_FIRST_FREE_OBJECTID,
418	BTRFS_LAST_FREE_OBJECTID,
419	BTRFS_FREE_INO_OBJECTID);
420	} else {
421	dir_item_err(eb: leaf, slot,
422	fmt: "invalid location key objectid: has %llu expect %llu or [%llu, %llu] or %llu",
423	key->objectid, BTRFS_ROOT_TREE_DIR_OBJECTID,
424	BTRFS_FIRST_FREE_OBJECTID,
425	BTRFS_LAST_FREE_OBJECTID,
426	BTRFS_FREE_INO_OBJECTID);
427	}
428	return -EUCLEAN;
429	}
430	if (unlikely(key->offset != 0)) {
431	if (is_inode_item)
432	inode_item_err(leaf, slot,
433	"invalid key offset: has %llu expect 0",
434	key->offset);
435	else
436	dir_item_err(eb: leaf, slot,
437	fmt: "invalid location key offset:has %llu expect 0",
438	key->offset);
439	return -EUCLEAN;
440	}
441	return 0;
442	}
443
444	static int check_root_key(struct extent_buffer *leaf, struct btrfs_key *key,
445	int slot)
446	{
447	struct btrfs_key item_key;
448	bool is_root_item;
449
450	btrfs_item_key_to_cpu(eb: leaf, cpu_key: &item_key, nr: slot);
451	is_root_item = (item_key.type == BTRFS_ROOT_ITEM_KEY);
452
453	/*
454	* Bad rootid for reloc trees.
455	*
456	* Reloc trees are only for subvolume trees, other trees only need
457	* to be COWed to be relocated.
458	*/
459	if (unlikely(is_root_item && key->objectid == BTRFS_TREE_RELOC_OBJECTID &&
460	!is_fstree(key->offset))) {
461	generic_err(eb: leaf, slot,
462	fmt: "invalid reloc tree for root %lld, root id is not a subvolume tree",
463	key->offset);
464	return -EUCLEAN;
465	}
466
467	/* No such tree id */
468	if (unlikely(key->objectid == 0)) {
469	if (is_root_item)
470	generic_err(eb: leaf, slot, fmt: "invalid root id 0");
471	else
472	dir_item_err(eb: leaf, slot,
473	fmt: "invalid location key root id 0");
474	return -EUCLEAN;
475	}
476
477	/* DIR_ITEM/INDEX/INODE_REF is not allowed to point to non-fs trees */
478	if (unlikely(!is_fstree(key->objectid) && !is_root_item)) {
479	dir_item_err(eb: leaf, slot,
480	fmt: "invalid location key objectid, have %llu expect [%llu, %llu]",
481	key->objectid, BTRFS_FIRST_FREE_OBJECTID,
482	BTRFS_LAST_FREE_OBJECTID);
483	return -EUCLEAN;
484	}
485
486	/*
487	* ROOT_ITEM with non-zero offset means this is a snapshot, created at
488	* @offset transid.
489	* Furthermore, for location key in DIR_ITEM, its offset is always -1.
490	*
491	* So here we only check offset for reloc tree whose key->offset must
492	* be a valid tree.
493	*/
494	if (unlikely(key->objectid == BTRFS_TREE_RELOC_OBJECTID &&
495	key->offset == 0)) {
496	generic_err(eb: leaf, slot, fmt: "invalid root id 0 for reloc tree");
497	return -EUCLEAN;
498	}
499	return 0;
500	}
501
502	static int check_dir_item(struct extent_buffer *leaf,
503	struct btrfs_key *key, struct btrfs_key *prev_key,
504	int slot)
505	{
506	struct btrfs_fs_info *fs_info = leaf->fs_info;
507	struct btrfs_dir_item *di;
508	u32 item_size = btrfs_item_size(eb: leaf, slot);
509	u32 cur = 0;
510
511	if (unlikely(!check_prev_ino(leaf, key, slot, prev_key)))
512	return -EUCLEAN;
513
514	di = btrfs_item_ptr(leaf, slot, struct btrfs_dir_item);
515	while (cur < item_size) {
516	struct btrfs_key location_key;
517	u32 name_len;
518	u32 data_len;
519	u32 max_name_len;
520	u32 total_size;
521	u32 name_hash;
522	u8 dir_type;
523	int ret;
524
525	/* header itself should not cross item boundary */
526	if (unlikely(cur + sizeof(*di) > item_size)) {
527	dir_item_err(eb: leaf, slot,
528	fmt: "dir item header crosses item boundary, have %zu boundary %u",
529	cur + sizeof(*di), item_size);
530	return -EUCLEAN;
531	}
532
533	/* Location key check */
534	btrfs_dir_item_key_to_cpu(eb: leaf, item: di, cpu_key: &location_key);
535	if (location_key.type == BTRFS_ROOT_ITEM_KEY) {
536	ret = check_root_key(leaf, key: &location_key, slot);
537	if (unlikely(ret < 0))
538	return ret;
539	} else if (location_key.type == BTRFS_INODE_ITEM_KEY ||
540	location_key.type == 0) {
541	ret = check_inode_key(leaf, key: &location_key, slot);
542	if (unlikely(ret < 0))
543	return ret;
544	} else {
545	dir_item_err(eb: leaf, slot,
546	fmt: "invalid location key type, have %u, expect %u or %u",
547	location_key.type, BTRFS_ROOT_ITEM_KEY,
548	BTRFS_INODE_ITEM_KEY);
549	return -EUCLEAN;
550	}
551
552	/* dir type check */
553	dir_type = btrfs_dir_ftype(eb: leaf, item: di);
554	if (unlikely(dir_type >= BTRFS_FT_MAX)) {
555	dir_item_err(eb: leaf, slot,
556	fmt: "invalid dir item type, have %u expect [0, %u)",
557	dir_type, BTRFS_FT_MAX);
558	return -EUCLEAN;
559	}
560
561	if (unlikely(key->type == BTRFS_XATTR_ITEM_KEY &&
562	dir_type != BTRFS_FT_XATTR)) {
563	dir_item_err(eb: leaf, slot,
564	fmt: "invalid dir item type for XATTR key, have %u expect %u",
565	dir_type, BTRFS_FT_XATTR);
566	return -EUCLEAN;
567	}
568	if (unlikely(dir_type == BTRFS_FT_XATTR &&
569	key->type != BTRFS_XATTR_ITEM_KEY)) {
570	dir_item_err(eb: leaf, slot,
571	fmt: "xattr dir type found for non-XATTR key");
572	return -EUCLEAN;
573	}
574	if (dir_type == BTRFS_FT_XATTR)
575	max_name_len = XATTR_NAME_MAX;
576	else
577	max_name_len = BTRFS_NAME_LEN;
578
579	/* Name/data length check */
580	name_len = btrfs_dir_name_len(eb: leaf, s: di);
581	data_len = btrfs_dir_data_len(eb: leaf, s: di);
582	if (unlikely(name_len > max_name_len)) {
583	dir_item_err(eb: leaf, slot,
584	fmt: "dir item name len too long, have %u max %u",
585	name_len, max_name_len);
586	return -EUCLEAN;
587	}
588	if (unlikely(name_len + data_len > BTRFS_MAX_XATTR_SIZE(fs_info))) {
589	dir_item_err(eb: leaf, slot,
590	fmt: "dir item name and data len too long, have %u max %u",
591	name_len + data_len,
592	BTRFS_MAX_XATTR_SIZE(info: fs_info));
593	return -EUCLEAN;
594	}
595
596	if (unlikely(data_len && dir_type != BTRFS_FT_XATTR)) {
597	dir_item_err(eb: leaf, slot,
598	fmt: "dir item with invalid data len, have %u expect 0",
599	data_len);
600	return -EUCLEAN;
601	}
602
603	total_size = sizeof(*di) + name_len + data_len;
604
605	/* header and name/data should not cross item boundary */
606	if (unlikely(cur + total_size > item_size)) {
607	dir_item_err(eb: leaf, slot,
608	fmt: "dir item data crosses item boundary, have %u boundary %u",
609	cur + total_size, item_size);
610	return -EUCLEAN;
611	}
612
613	/*
614	* Special check for XATTR/DIR_ITEM, as key->offset is name
615	* hash, should match its name
616	*/
617	if (key->type == BTRFS_DIR_ITEM_KEY ||
618	key->type == BTRFS_XATTR_ITEM_KEY) {
619	char namebuf[max(BTRFS_NAME_LEN, XATTR_NAME_MAX)];
620
621	read_extent_buffer(eb: leaf, dst: namebuf,
622	start: (unsigned long)(di + 1), len: name_len);
623	name_hash = btrfs_name_hash(name: namebuf, len: name_len);
624	if (unlikely(key->offset != name_hash)) {
625	dir_item_err(eb: leaf, slot,
626	fmt: "name hash mismatch with key, have 0x%016x expect 0x%016llx",
627	name_hash, key->offset);
628	return -EUCLEAN;
629	}
630	}
631	cur += total_size;
632	di = (struct btrfs_dir_item *)((void *)di + total_size);
633	}
634	return 0;
635	}
636
637	__printf(3, 4)
638	__cold
639	static void block_group_err(const struct extent_buffer *eb, int slot,
640	const char *fmt, ...)
641	{
642	const struct btrfs_fs_info *fs_info = eb->fs_info;
643	struct btrfs_key key;
644	struct va_format vaf;
645	va_list args;
646
647	btrfs_item_key_to_cpu(eb, cpu_key: &key, nr: slot);
648	va_start(args, fmt);
649
650	vaf.fmt = fmt;
651	vaf.va = &args;
652
653	dump_page(folio_page(eb->folios[0], 0), reason: "eb page dump");
654	btrfs_crit(fs_info,
655	"corrupt %s: root=%llu block=%llu slot=%d bg_start=%llu bg_len=%llu, %pV",
656	btrfs_header_level(eb) == 0 ? "leaf" : "node",
657	btrfs_header_owner(eb), btrfs_header_bytenr(eb), slot,
658	key.objectid, key.offset, &vaf);
659	va_end(args);
660	}
661
662	static int check_block_group_item(struct extent_buffer *leaf,
663	struct btrfs_key *key, int slot)
664	{
665	struct btrfs_fs_info *fs_info = leaf->fs_info;
666	struct btrfs_block_group_item bgi;
667	u32 item_size = btrfs_item_size(eb: leaf, slot);
668	u64 chunk_objectid;
669	u64 flags;
670	u64 type;
671
672	/*
673	* Here we don't really care about alignment since extent allocator can
674	* handle it. We care more about the size.
675	*/
676	if (unlikely(key->offset == 0)) {
677	block_group_err(eb: leaf, slot,
678	fmt: "invalid block group size 0");
679	return -EUCLEAN;
680	}
681
682	if (unlikely(item_size != sizeof(bgi))) {
683	block_group_err(eb: leaf, slot,
684	fmt: "invalid item size, have %u expect %zu",
685	item_size, sizeof(bgi));
686	return -EUCLEAN;
687	}
688
689	read_extent_buffer(eb: leaf, dst: &bgi, btrfs_item_ptr_offset(leaf, slot),
690	len: sizeof(bgi));
691	chunk_objectid = btrfs_stack_block_group_chunk_objectid(s: &bgi);
692	if (btrfs_fs_incompat(fs_info, EXTENT_TREE_V2)) {
693	/*
694	* We don't init the nr_global_roots until we load the global
695	* roots, so this could be 0 at mount time. If it's 0 we'll
696	* just assume we're fine, and later we'll check against our
697	* actual value.
698	*/
699	if (unlikely(fs_info->nr_global_roots &&
700	chunk_objectid >= fs_info->nr_global_roots)) {
701	block_group_err(eb: leaf, slot,
702	fmt: "invalid block group global root id, have %llu, needs to be <= %llu",
703	chunk_objectid,
704	fs_info->nr_global_roots);
705	return -EUCLEAN;
706	}
707	} else if (unlikely(chunk_objectid != BTRFS_FIRST_CHUNK_TREE_OBJECTID)) {
708	block_group_err(eb: leaf, slot,
709	fmt: "invalid block group chunk objectid, have %llu expect %llu",
710	btrfs_stack_block_group_chunk_objectid(s: &bgi),
711	BTRFS_FIRST_CHUNK_TREE_OBJECTID);
712	return -EUCLEAN;
713	}
714
715	if (unlikely(btrfs_stack_block_group_used(&bgi) > key->offset)) {
716	block_group_err(eb: leaf, slot,
717	fmt: "invalid block group used, have %llu expect [0, %llu)",
718	btrfs_stack_block_group_used(s: &bgi), key->offset);
719	return -EUCLEAN;
720	}
721
722	flags = btrfs_stack_block_group_flags(s: &bgi);
723	if (unlikely(hweight64(flags & BTRFS_BLOCK_GROUP_PROFILE_MASK) > 1)) {
724	block_group_err(eb: leaf, slot,
725	fmt: "invalid profile flags, have 0x%llx (%lu bits set) expect no more than 1 bit set",
726	flags & BTRFS_BLOCK_GROUP_PROFILE_MASK,
727	hweight64(flags & BTRFS_BLOCK_GROUP_PROFILE_MASK));
728	return -EUCLEAN;
729	}
730
731	type = flags & BTRFS_BLOCK_GROUP_TYPE_MASK;
732	if (unlikely(type != BTRFS_BLOCK_GROUP_DATA &&
733	type != BTRFS_BLOCK_GROUP_METADATA &&
734	type != BTRFS_BLOCK_GROUP_SYSTEM &&
735	type != (BTRFS_BLOCK_GROUP_METADATA |
736	BTRFS_BLOCK_GROUP_DATA))) {
737	block_group_err(eb: leaf, slot,
738	fmt: "invalid type, have 0x%llx (%lu bits set) expect either 0x%llx, 0x%llx, 0x%llx or 0x%llx",
739	type, hweight64(type),
740	BTRFS_BLOCK_GROUP_DATA, BTRFS_BLOCK_GROUP_METADATA,
741	BTRFS_BLOCK_GROUP_SYSTEM,
742	BTRFS_BLOCK_GROUP_METADATA | BTRFS_BLOCK_GROUP_DATA);
743	return -EUCLEAN;
744	}
745	return 0;
746	}
747
748	__printf(4, 5)
749	__cold
750	static void chunk_err(const struct extent_buffer *leaf,
751	const struct btrfs_chunk *chunk, u64 logical,
752	const char *fmt, ...)
753	{
754	const struct btrfs_fs_info *fs_info = leaf->fs_info;
755	bool is_sb;
756	struct va_format vaf;
757	va_list args;
758	int i;
759	int slot = -1;
760
761	/* Only superblock eb is able to have such small offset */
762	is_sb = (leaf->start == BTRFS_SUPER_INFO_OFFSET);
763
764	if (!is_sb) {
765	/*
766	* Get the slot number by iterating through all slots, this
767	* would provide better readability.
768	*/
769	for (i = 0; i < btrfs_header_nritems(eb: leaf); i++) {
770	if (btrfs_item_ptr_offset(leaf, i) ==
771	(unsigned long)chunk) {
772	slot = i;
773	break;
774	}
775	}
776	}
777	va_start(args, fmt);
778	vaf.fmt = fmt;
779	vaf.va = &args;
780
781	if (is_sb)
782	btrfs_crit(fs_info,
783	"corrupt superblock syschunk array: chunk_start=%llu, %pV",
784	logical, &vaf);
785	else
786	btrfs_crit(fs_info,
787	"corrupt leaf: root=%llu block=%llu slot=%d chunk_start=%llu, %pV",
788	BTRFS_CHUNK_TREE_OBJECTID, leaf->start, slot,
789	logical, &vaf);
790	va_end(args);
791	}
792
793	/*
794	* The common chunk check which could also work on super block sys chunk array.
795	*
796	* Return -EUCLEAN if anything is corrupted.
797	* Return 0 if everything is OK.
798	*/
799	int btrfs_check_chunk_valid(struct extent_buffer *leaf,
800	struct btrfs_chunk *chunk, u64 logical)
801	{
802	struct btrfs_fs_info *fs_info = leaf->fs_info;
803	u64 length;
804	u64 chunk_end;
805	u64 stripe_len;
806	u16 num_stripes;
807	u16 sub_stripes;
808	u64 type;
809	u64 features;
810	bool mixed = false;
811	int raid_index;
812	int nparity;
813	int ncopies;
814
815	length = btrfs_chunk_length(eb: leaf, s: chunk);
816	stripe_len = btrfs_chunk_stripe_len(eb: leaf, s: chunk);
817	num_stripes = btrfs_chunk_num_stripes(eb: leaf, s: chunk);
818	sub_stripes = btrfs_chunk_sub_stripes(eb: leaf, s: chunk);
819	type = btrfs_chunk_type(eb: leaf, s: chunk);
820	raid_index = btrfs_bg_flags_to_raid_index(flags: type);
821	ncopies = btrfs_raid_array[raid_index].ncopies;
822	nparity = btrfs_raid_array[raid_index].nparity;
823
824	if (unlikely(!num_stripes)) {
825	chunk_err(leaf, chunk, logical,
826	fmt: "invalid chunk num_stripes, have %u", num_stripes);
827	return -EUCLEAN;
828	}
829	if (unlikely(num_stripes < ncopies)) {
830	chunk_err(leaf, chunk, logical,
831	fmt: "invalid chunk num_stripes < ncopies, have %u < %d",
832	num_stripes, ncopies);
833	return -EUCLEAN;
834	}
835	if (unlikely(nparity && num_stripes == nparity)) {
836	chunk_err(leaf, chunk, logical,
837	fmt: "invalid chunk num_stripes == nparity, have %u == %d",
838	num_stripes, nparity);
839	return -EUCLEAN;
840	}
841	if (unlikely(!IS_ALIGNED(logical, fs_info->sectorsize))) {
842	chunk_err(leaf, chunk, logical,
843	fmt: "invalid chunk logical, have %llu should aligned to %u",
844	logical, fs_info->sectorsize);
845	return -EUCLEAN;
846	}
847	if (unlikely(btrfs_chunk_sector_size(leaf, chunk) != fs_info->sectorsize)) {
848	chunk_err(leaf, chunk, logical,
849	fmt: "invalid chunk sectorsize, have %u expect %u",
850	btrfs_chunk_sector_size(eb: leaf, s: chunk),
851	fs_info->sectorsize);
852	return -EUCLEAN;
853	}
854	if (unlikely(!length || !IS_ALIGNED(length, fs_info->sectorsize))) {
855	chunk_err(leaf, chunk, logical,
856	fmt: "invalid chunk length, have %llu", length);
857	return -EUCLEAN;
858	}
859	if (unlikely(check_add_overflow(logical, length, &chunk_end))) {
860	chunk_err(leaf, chunk, logical,
861	fmt: "invalid chunk logical start and length, have logical start %llu length %llu",
862	logical, length);
863	return -EUCLEAN;
864	}
865	if (unlikely(!is_power_of_2(stripe_len) || stripe_len != BTRFS_STRIPE_LEN)) {
866	chunk_err(leaf, chunk, logical,
867	fmt: "invalid chunk stripe length: %llu",
868	stripe_len);
869	return -EUCLEAN;
870	}
871	/*
872	* We artificially limit the chunk size, so that the number of stripes
873	* inside a chunk can be fit into a U32. The current limit (256G) is
874	* way too large for real world usage anyway, and it's also much larger
875	* than our existing limit (10G).
876	*
877	* Thus it should be a good way to catch obvious bitflips.
878	*/
879	if (unlikely(length >= btrfs_stripe_nr_to_offset(U32_MAX))) {
880	chunk_err(leaf, chunk, logical,
881	fmt: "chunk length too large: have %llu limit %llu",
882	length, btrfs_stripe_nr_to_offset(U32_MAX));
883	return -EUCLEAN;
884	}
885	if (unlikely(type & ~(BTRFS_BLOCK_GROUP_TYPE_MASK |
886	BTRFS_BLOCK_GROUP_PROFILE_MASK))) {
887	chunk_err(leaf, chunk, logical,
888	fmt: "unrecognized chunk type: 0x%llx",
889	~(BTRFS_BLOCK_GROUP_TYPE_MASK |
890	BTRFS_BLOCK_GROUP_PROFILE_MASK) &
891	btrfs_chunk_type(eb: leaf, s: chunk));
892	return -EUCLEAN;
893	}
894
895	if (unlikely(!has_single_bit_set(type & BTRFS_BLOCK_GROUP_PROFILE_MASK) &&
896	(type & BTRFS_BLOCK_GROUP_PROFILE_MASK) != 0)) {
897	chunk_err(leaf, chunk, logical,
898	fmt: "invalid chunk profile flag: 0x%llx, expect 0 or 1 bit set",
899	type & BTRFS_BLOCK_GROUP_PROFILE_MASK);
900	return -EUCLEAN;
901	}
902	if (unlikely((type & BTRFS_BLOCK_GROUP_TYPE_MASK) == 0)) {
903	chunk_err(leaf, chunk, logical,
904	fmt: "missing chunk type flag, have 0x%llx one bit must be set in 0x%llx",
905	type, BTRFS_BLOCK_GROUP_TYPE_MASK);
906	return -EUCLEAN;
907	}
908
909	if (unlikely((type & BTRFS_BLOCK_GROUP_SYSTEM) &&
910	(type & (BTRFS_BLOCK_GROUP_METADATA |
911	BTRFS_BLOCK_GROUP_DATA)))) {
912	chunk_err(leaf, chunk, logical,
913	fmt: "system chunk with data or metadata type: 0x%llx",
914	type);
915	return -EUCLEAN;
916	}
917
918	features = btrfs_super_incompat_flags(s: fs_info->super_copy);
919	if (features & BTRFS_FEATURE_INCOMPAT_MIXED_GROUPS)
920	mixed = true;
921
922	if (!mixed) {
923	if (unlikely((type & BTRFS_BLOCK_GROUP_METADATA) &&
924	(type & BTRFS_BLOCK_GROUP_DATA))) {
925	chunk_err(leaf, chunk, logical,
926	fmt: "mixed chunk type in non-mixed mode: 0x%llx", type);
927	return -EUCLEAN;
928	}
929	}
930
931	if (unlikely((type & BTRFS_BLOCK_GROUP_RAID10 &&
932	sub_stripes != btrfs_raid_array[BTRFS_RAID_RAID10].sub_stripes) ||
933	(type & BTRFS_BLOCK_GROUP_RAID1 &&
934	num_stripes != btrfs_raid_array[BTRFS_RAID_RAID1].devs_min) ||
935	(type & BTRFS_BLOCK_GROUP_RAID1C3 &&
936	num_stripes != btrfs_raid_array[BTRFS_RAID_RAID1C3].devs_min) ||
937	(type & BTRFS_BLOCK_GROUP_RAID1C4 &&
938	num_stripes != btrfs_raid_array[BTRFS_RAID_RAID1C4].devs_min) ||
939	(type & BTRFS_BLOCK_GROUP_RAID5 &&
940	num_stripes < btrfs_raid_array[BTRFS_RAID_RAID5].devs_min) ||
941	(type & BTRFS_BLOCK_GROUP_RAID6 &&
942	num_stripes < btrfs_raid_array[BTRFS_RAID_RAID6].devs_min) ||
943	(type & BTRFS_BLOCK_GROUP_DUP &&
944	num_stripes != btrfs_raid_array[BTRFS_RAID_DUP].dev_stripes) ||
945	((type & BTRFS_BLOCK_GROUP_PROFILE_MASK) == 0 &&
946	num_stripes != btrfs_raid_array[BTRFS_RAID_SINGLE].dev_stripes))) {
947	chunk_err(leaf, chunk, logical,
948	fmt: "invalid num_stripes:sub_stripes %u:%u for profile %llu",
949	num_stripes, sub_stripes,
950	type & BTRFS_BLOCK_GROUP_PROFILE_MASK);
951	return -EUCLEAN;
952	}
953
954	return 0;
955	}
956
957	/*
958	* Enhanced version of chunk item checker.
959	*
960	* The common btrfs_check_chunk_valid() doesn't check item size since it needs
961	* to work on super block sys_chunk_array which doesn't have full item ptr.
962	*/
963	static int check_leaf_chunk_item(struct extent_buffer *leaf,
964	struct btrfs_chunk *chunk,
965	struct btrfs_key *key, int slot)
966	{
967	int num_stripes;
968
969	if (unlikely(btrfs_item_size(leaf, slot) < sizeof(struct btrfs_chunk))) {
970	chunk_err(leaf, chunk, logical: key->offset,
971	fmt: "invalid chunk item size: have %u expect [%zu, %u)",
972	btrfs_item_size(eb: leaf, slot),
973	sizeof(struct btrfs_chunk),
974	BTRFS_LEAF_DATA_SIZE(info: leaf->fs_info));
975	return -EUCLEAN;
976	}
977
978	num_stripes = btrfs_chunk_num_stripes(eb: leaf, s: chunk);
979	/* Let btrfs_check_chunk_valid() handle this error type */
980	if (num_stripes == 0)
981	goto out;
982
983	if (unlikely(btrfs_chunk_item_size(num_stripes) !=
984	btrfs_item_size(leaf, slot))) {
985	chunk_err(leaf, chunk, logical: key->offset,
986	fmt: "invalid chunk item size: have %u expect %lu",
987	btrfs_item_size(eb: leaf, slot),
988	btrfs_chunk_item_size(num_stripes));
989	return -EUCLEAN;
990	}
991	out:
992	return btrfs_check_chunk_valid(leaf, chunk, logical: key->offset);
993	}
994
995	__printf(3, 4)
996	__cold
997	static void dev_item_err(const struct extent_buffer *eb, int slot,
998	const char *fmt, ...)
999	{
1000	struct btrfs_key key;
1001	struct va_format vaf;
1002	va_list args;
1003
1004	btrfs_item_key_to_cpu(eb, cpu_key: &key, nr: slot);
1005	va_start(args, fmt);
1006
1007	vaf.fmt = fmt;
1008	vaf.va = &args;
1009
1010	dump_page(folio_page(eb->folios[0], 0), reason: "eb page dump");
1011	btrfs_crit(eb->fs_info,
1012	"corrupt %s: root=%llu block=%llu slot=%d devid=%llu %pV",
1013	btrfs_header_level(eb) == 0 ? "leaf" : "node",
1014	btrfs_header_owner(eb), btrfs_header_bytenr(eb), slot,
1015	key.objectid, &vaf);
1016	va_end(args);
1017	}
1018
1019	static int check_dev_item(struct extent_buffer *leaf,
1020	struct btrfs_key *key, int slot)
1021	{
1022	struct btrfs_dev_item *ditem;
1023	const u32 item_size = btrfs_item_size(eb: leaf, slot);
1024
1025	if (unlikely(key->objectid != BTRFS_DEV_ITEMS_OBJECTID)) {
1026	dev_item_err(eb: leaf, slot,
1027	fmt: "invalid objectid: has=%llu expect=%llu",
1028	key->objectid, BTRFS_DEV_ITEMS_OBJECTID);
1029	return -EUCLEAN;
1030	}
1031
1032	if (unlikely(item_size != sizeof(*ditem))) {
1033	dev_item_err(eb: leaf, slot, fmt: "invalid item size: has %u expect %zu",
1034	item_size, sizeof(*ditem));
1035	return -EUCLEAN;
1036	}
1037
1038	ditem = btrfs_item_ptr(leaf, slot, struct btrfs_dev_item);
1039	if (unlikely(btrfs_device_id(leaf, ditem) != key->offset)) {
1040	dev_item_err(eb: leaf, slot,
1041	fmt: "devid mismatch: key has=%llu item has=%llu",
1042	key->offset, btrfs_device_id(eb: leaf, s: ditem));
1043	return -EUCLEAN;
1044	}
1045
1046	/*
1047	* For device total_bytes, we don't have reliable way to check it, as
1048	* it can be 0 for device removal. Device size check can only be done
1049	* by dev extents check.
1050	*/
1051	if (unlikely(btrfs_device_bytes_used(leaf, ditem) >
1052	btrfs_device_total_bytes(leaf, ditem))) {
1053	dev_item_err(eb: leaf, slot,
1054	fmt: "invalid bytes used: have %llu expect [0, %llu]",
1055	btrfs_device_bytes_used(eb: leaf, s: ditem),
1056	btrfs_device_total_bytes(eb: leaf, s: ditem));
1057	return -EUCLEAN;
1058	}
1059	/*
1060	* Remaining members like io_align/type/gen/dev_group aren't really
1061	* utilized. Skip them to make later usage of them easier.
1062	*/
1063	return 0;
1064	}
1065
1066	static int check_inode_item(struct extent_buffer *leaf,
1067	struct btrfs_key *key, int slot)
1068	{
1069	struct btrfs_fs_info *fs_info = leaf->fs_info;
1070	struct btrfs_inode_item *iitem;
1071	u64 super_gen = btrfs_super_generation(s: fs_info->super_copy);
1072	u32 valid_mask = (S_IFMT | S_ISUID | S_ISGID | S_ISVTX | 0777);
1073	const u32 item_size = btrfs_item_size(eb: leaf, slot);
1074	u32 mode;
1075	int ret;
1076	u32 flags;
1077	u32 ro_flags;
1078
1079	ret = check_inode_key(leaf, key, slot);
1080	if (unlikely(ret < 0))
1081	return ret;
1082
1083	if (unlikely(item_size != sizeof(*iitem))) {
1084	generic_err(eb: leaf, slot, fmt: "invalid item size: has %u expect %zu",
1085	item_size, sizeof(*iitem));
1086	return -EUCLEAN;
1087	}
1088
1089	iitem = btrfs_item_ptr(leaf, slot, struct btrfs_inode_item);
1090
1091	/* Here we use super block generation + 1 to handle log tree */
1092	if (unlikely(btrfs_inode_generation(leaf, iitem) > super_gen + 1)) {
1093	inode_item_err(leaf, slot,
1094	"invalid inode generation: has %llu expect (0, %llu]",
1095	btrfs_inode_generation(leaf, iitem),
1096	super_gen + 1);
1097	return -EUCLEAN;
1098	}
1099	/* Note for ROOT_TREE_DIR_ITEM, mkfs could set its transid 0 */
1100	if (unlikely(btrfs_inode_transid(leaf, iitem) > super_gen + 1)) {
1101	inode_item_err(leaf, slot,
1102	"invalid inode transid: has %llu expect [0, %llu]",
1103	btrfs_inode_transid(leaf, iitem), super_gen + 1);
1104	return -EUCLEAN;
1105	}
1106
1107	/*
1108	* For size and nbytes it's better not to be too strict, as for dir
1109	* item its size/nbytes can easily get wrong, but doesn't affect
1110	* anything in the fs. So here we skip the check.
1111	*/
1112	mode = btrfs_inode_mode(eb: leaf, s: iitem);
1113	if (unlikely(mode & ~valid_mask)) {
1114	inode_item_err(leaf, slot,
1115	"unknown mode bit detected: 0x%x",
1116	mode & ~valid_mask);
1117	return -EUCLEAN;
1118	}
1119
1120	/*
1121	* S_IFMT is not bit mapped so we can't completely rely on
1122	* is_power_of_2/has_single_bit_set, but it can save us from checking
1123	* FIFO/CHR/DIR/REG. Only needs to check BLK, LNK and SOCKS
1124	*/
1125	if (!has_single_bit_set(n: mode & S_IFMT)) {
1126	if (unlikely(!S_ISLNK(mode) && !S_ISBLK(mode) && !S_ISSOCK(mode))) {
1127	inode_item_err(leaf, slot,
1128	"invalid mode: has 0%o expect valid S_IF* bit(s)",
1129	mode & S_IFMT);
1130	return -EUCLEAN;
1131	}
1132	}
1133	if (unlikely(S_ISDIR(mode) && btrfs_inode_nlink(leaf, iitem) > 1)) {
1134	inode_item_err(leaf, slot,
1135	"invalid nlink: has %u expect no more than 1 for dir",
1136	btrfs_inode_nlink(leaf, iitem));
1137	return -EUCLEAN;
1138	}
1139	btrfs_inode_split_flags(inode_item_flags: btrfs_inode_flags(eb: leaf, s: iitem), flags: &flags, ro_flags: &ro_flags);
1140	if (unlikely(flags & ~BTRFS_INODE_FLAG_MASK)) {
1141	inode_item_err(leaf, slot,
1142	"unknown incompat flags detected: 0x%x", flags);
1143	return -EUCLEAN;
1144	}
1145	if (unlikely(!sb_rdonly(fs_info->sb) &&
1146	(ro_flags & ~BTRFS_INODE_RO_FLAG_MASK))) {
1147	inode_item_err(leaf, slot,
1148	"unknown ro-compat flags detected on writeable mount: 0x%x",
1149	ro_flags);
1150	return -EUCLEAN;
1151	}
1152	return 0;
1153	}
1154
1155	static int check_root_item(struct extent_buffer *leaf, struct btrfs_key *key,
1156	int slot)
1157	{
1158	struct btrfs_fs_info *fs_info = leaf->fs_info;
1159	struct btrfs_root_item ri = { 0 };
1160	const u64 valid_root_flags = BTRFS_ROOT_SUBVOL_RDONLY |
1161	BTRFS_ROOT_SUBVOL_DEAD;
1162	int ret;
1163
1164	ret = check_root_key(leaf, key, slot);
1165	if (unlikely(ret < 0))
1166	return ret;
1167
1168	if (unlikely(btrfs_item_size(leaf, slot) != sizeof(ri) &&
1169	btrfs_item_size(leaf, slot) !=
1170	btrfs_legacy_root_item_size())) {
1171	generic_err(eb: leaf, slot,
1172	fmt: "invalid root item size, have %u expect %zu or %u",
1173	btrfs_item_size(eb: leaf, slot), sizeof(ri),
1174	btrfs_legacy_root_item_size());
1175	return -EUCLEAN;
1176	}
1177
1178	/*
1179	* For legacy root item, the members starting at generation_v2 will be
1180	* all filled with 0.
1181	* And since we allow geneartion_v2 as 0, it will still pass the check.
1182	*/
1183	read_extent_buffer(eb: leaf, dst: &ri, btrfs_item_ptr_offset(leaf, slot),
1184	len: btrfs_item_size(eb: leaf, slot));
1185
1186	/* Generation related */
1187	if (unlikely(btrfs_root_generation(&ri) >
1188	btrfs_super_generation(fs_info->super_copy) + 1)) {
1189	generic_err(eb: leaf, slot,
1190	fmt: "invalid root generation, have %llu expect (0, %llu]",
1191	btrfs_root_generation(s: &ri),
1192	btrfs_super_generation(s: fs_info->super_copy) + 1);
1193	return -EUCLEAN;
1194	}
1195	if (unlikely(btrfs_root_generation_v2(&ri) >
1196	btrfs_super_generation(fs_info->super_copy) + 1)) {
1197	generic_err(eb: leaf, slot,
1198	fmt: "invalid root v2 generation, have %llu expect (0, %llu]",
1199	btrfs_root_generation_v2(s: &ri),
1200	btrfs_super_generation(s: fs_info->super_copy) + 1);
1201	return -EUCLEAN;
1202	}
1203	if (unlikely(btrfs_root_last_snapshot(&ri) >
1204	btrfs_super_generation(fs_info->super_copy) + 1)) {
1205	generic_err(eb: leaf, slot,
1206	fmt: "invalid root last_snapshot, have %llu expect (0, %llu]",
1207	btrfs_root_last_snapshot(s: &ri),
1208	btrfs_super_generation(s: fs_info->super_copy) + 1);
1209	return -EUCLEAN;
1210	}
1211
1212	/* Alignment and level check */
1213	if (unlikely(!IS_ALIGNED(btrfs_root_bytenr(&ri), fs_info->sectorsize))) {
1214	generic_err(eb: leaf, slot,
1215	fmt: "invalid root bytenr, have %llu expect to be aligned to %u",
1216	btrfs_root_bytenr(s: &ri), fs_info->sectorsize);
1217	return -EUCLEAN;
1218	}
1219	if (unlikely(btrfs_root_level(&ri) >= BTRFS_MAX_LEVEL)) {
1220	generic_err(eb: leaf, slot,
1221	fmt: "invalid root level, have %u expect [0, %u]",
1222	btrfs_root_level(s: &ri), BTRFS_MAX_LEVEL - 1);
1223	return -EUCLEAN;
1224	}
1225	if (unlikely(btrfs_root_drop_level(&ri) >= BTRFS_MAX_LEVEL)) {
1226	generic_err(eb: leaf, slot,
1227	fmt: "invalid root level, have %u expect [0, %u]",
1228	btrfs_root_drop_level(s: &ri), BTRFS_MAX_LEVEL - 1);
1229	return -EUCLEAN;
1230	}
1231
1232	/* Flags check */
1233	if (unlikely(btrfs_root_flags(&ri) & ~valid_root_flags)) {
1234	generic_err(eb: leaf, slot,
1235	fmt: "invalid root flags, have 0x%llx expect mask 0x%llx",
1236	btrfs_root_flags(s: &ri), valid_root_flags);
1237	return -EUCLEAN;
1238	}
1239	return 0;
1240	}
1241
1242	__printf(3,4)
1243	__cold
1244	static void extent_err(const struct extent_buffer *eb, int slot,
1245	const char *fmt, ...)
1246	{
1247	struct btrfs_key key;
1248	struct va_format vaf;
1249	va_list args;
1250	u64 bytenr;
1251	u64 len;
1252
1253	btrfs_item_key_to_cpu(eb, cpu_key: &key, nr: slot);
1254	bytenr = key.objectid;
1255	if (key.type == BTRFS_METADATA_ITEM_KEY ||
1256	key.type == BTRFS_TREE_BLOCK_REF_KEY ||
1257	key.type == BTRFS_SHARED_BLOCK_REF_KEY)
1258	len = eb->fs_info->nodesize;
1259	else
1260	len = key.offset;
1261	va_start(args, fmt);
1262
1263	vaf.fmt = fmt;
1264	vaf.va = &args;
1265
1266	dump_page(folio_page(eb->folios[0], 0), reason: "eb page dump");
1267	btrfs_crit(eb->fs_info,
1268	"corrupt %s: block=%llu slot=%d extent bytenr=%llu len=%llu %pV",
1269	btrfs_header_level(eb) == 0 ? "leaf" : "node",
1270	eb->start, slot, bytenr, len, &vaf);
1271	va_end(args);
1272	}
1273
1274	static int check_extent_item(struct extent_buffer *leaf,
1275	struct btrfs_key *key, int slot,
1276	struct btrfs_key *prev_key)
1277	{
1278	struct btrfs_fs_info *fs_info = leaf->fs_info;
1279	struct btrfs_extent_item *ei;
1280	bool is_tree_block = false;
1281	unsigned long ptr; /* Current pointer inside inline refs */
1282	unsigned long end; /* Extent item end */
1283	const u32 item_size = btrfs_item_size(eb: leaf, slot);
1284	u8 last_type = 0;
1285	u64 last_seq = U64_MAX;
1286	u64 flags;
1287	u64 generation;
1288	u64 total_refs; /* Total refs in btrfs_extent_item */
1289	u64 inline_refs = 0; /* found total inline refs */
1290
1291	if (unlikely(key->type == BTRFS_METADATA_ITEM_KEY &&
1292	!btrfs_fs_incompat(fs_info, SKINNY_METADATA))) {
1293	generic_err(eb: leaf, slot,
1294	fmt: "invalid key type, METADATA_ITEM type invalid when SKINNY_METADATA feature disabled");
1295	return -EUCLEAN;
1296	}
1297	/* key->objectid is the bytenr for both key types */
1298	if (unlikely(!IS_ALIGNED(key->objectid, fs_info->sectorsize))) {
1299	generic_err(eb: leaf, slot,
1300	fmt: "invalid key objectid, have %llu expect to be aligned to %u",
1301	key->objectid, fs_info->sectorsize);
1302	return -EUCLEAN;
1303	}
1304
1305	/* key->offset is tree level for METADATA_ITEM_KEY */
1306	if (unlikely(key->type == BTRFS_METADATA_ITEM_KEY &&
1307	key->offset >= BTRFS_MAX_LEVEL)) {
1308	extent_err(eb: leaf, slot,
1309	fmt: "invalid tree level, have %llu expect [0, %u]",
1310	key->offset, BTRFS_MAX_LEVEL - 1);
1311	return -EUCLEAN;
1312	}
1313
1314	/*
1315	* EXTENT/METADATA_ITEM consists of:
1316	* 1) One btrfs_extent_item
1317	* Records the total refs, type and generation of the extent.
1318	*
1319	* 2) One btrfs_tree_block_info (for EXTENT_ITEM and tree backref only)
1320	* Records the first key and level of the tree block.
1321	*
1322	* 2) Zero or more btrfs_extent_inline_ref(s)
1323	* Each inline ref has one btrfs_extent_inline_ref shows:
1324	* 2.1) The ref type, one of the 4
1325	* TREE_BLOCK_REF Tree block only
1326	* SHARED_BLOCK_REF Tree block only
1327	* EXTENT_DATA_REF Data only
1328	* SHARED_DATA_REF Data only
1329	* 2.2) Ref type specific data
1330	* Either using btrfs_extent_inline_ref::offset, or specific
1331	* data structure.
1332	*
1333	* All above inline items should follow the order:
1334	*
1335	* - All btrfs_extent_inline_ref::type should be in an ascending
1336	* order
1337	*
1338	* - Within the same type, the items should follow a descending
1339	* order by their sequence number. The sequence number is
1340	* determined by:
1341	* * btrfs_extent_inline_ref::offset for all types other than
1342	* EXTENT_DATA_REF
1343	* * hash_extent_data_ref() for EXTENT_DATA_REF
1344	*/
1345	if (unlikely(item_size < sizeof(*ei))) {
1346	extent_err(eb: leaf, slot,
1347	fmt: "invalid item size, have %u expect [%zu, %u)",
1348	item_size, sizeof(*ei),
1349	BTRFS_LEAF_DATA_SIZE(info: fs_info));
1350	return -EUCLEAN;
1351	}
1352	end = item_size + btrfs_item_ptr_offset(leaf, slot);
1353
1354	/* Checks against extent_item */
1355	ei = btrfs_item_ptr(leaf, slot, struct btrfs_extent_item);
1356	flags = btrfs_extent_flags(eb: leaf, s: ei);
1357	total_refs = btrfs_extent_refs(eb: leaf, s: ei);
1358	generation = btrfs_extent_generation(eb: leaf, s: ei);
1359	if (unlikely(generation >
1360	btrfs_super_generation(fs_info->super_copy) + 1)) {
1361	extent_err(eb: leaf, slot,
1362	fmt: "invalid generation, have %llu expect (0, %llu]",
1363	generation,
1364	btrfs_super_generation(s: fs_info->super_copy) + 1);
1365	return -EUCLEAN;
1366	}
1367	if (unlikely(!has_single_bit_set(flags & (BTRFS_EXTENT_FLAG_DATA |
1368	BTRFS_EXTENT_FLAG_TREE_BLOCK)))) {
1369	extent_err(eb: leaf, slot,
1370	fmt: "invalid extent flag, have 0x%llx expect 1 bit set in 0x%llx",
1371	flags, BTRFS_EXTENT_FLAG_DATA |
1372	BTRFS_EXTENT_FLAG_TREE_BLOCK);
1373	return -EUCLEAN;
1374	}
1375	is_tree_block = !!(flags & BTRFS_EXTENT_FLAG_TREE_BLOCK);
1376	if (is_tree_block) {
1377	if (unlikely(key->type == BTRFS_EXTENT_ITEM_KEY &&
1378	key->offset != fs_info->nodesize)) {
1379	extent_err(eb: leaf, slot,
1380	fmt: "invalid extent length, have %llu expect %u",
1381	key->offset, fs_info->nodesize);
1382	return -EUCLEAN;
1383	}
1384	} else {
1385	if (unlikely(key->type != BTRFS_EXTENT_ITEM_KEY)) {
1386	extent_err(eb: leaf, slot,
1387	fmt: "invalid key type, have %u expect %u for data backref",
1388	key->type, BTRFS_EXTENT_ITEM_KEY);
1389	return -EUCLEAN;
1390	}
1391	if (unlikely(!IS_ALIGNED(key->offset, fs_info->sectorsize))) {
1392	extent_err(eb: leaf, slot,
1393	fmt: "invalid extent length, have %llu expect aligned to %u",
1394	key->offset, fs_info->sectorsize);
1395	return -EUCLEAN;
1396	}
1397	if (unlikely(flags & BTRFS_BLOCK_FLAG_FULL_BACKREF)) {
1398	extent_err(eb: leaf, slot,
1399	fmt: "invalid extent flag, data has full backref set");
1400	return -EUCLEAN;
1401	}
1402	}
1403	ptr = (unsigned long)(struct btrfs_extent_item *)(ei + 1);
1404
1405	/* Check the special case of btrfs_tree_block_info */
1406	if (is_tree_block && key->type != BTRFS_METADATA_ITEM_KEY) {
1407	struct btrfs_tree_block_info *info;
1408
1409	info = (struct btrfs_tree_block_info *)ptr;
1410	if (unlikely(btrfs_tree_block_level(leaf, info) >= BTRFS_MAX_LEVEL)) {
1411	extent_err(eb: leaf, slot,
1412	fmt: "invalid tree block info level, have %u expect [0, %u]",
1413	btrfs_tree_block_level(eb: leaf, s: info),
1414	BTRFS_MAX_LEVEL - 1);
1415	return -EUCLEAN;
1416	}
1417	ptr = (unsigned long)(struct btrfs_tree_block_info *)(info + 1);
1418	}
1419
1420	/* Check inline refs */
1421	while (ptr < end) {
1422	struct btrfs_extent_inline_ref *iref;
1423	struct btrfs_extent_data_ref *dref;
1424	struct btrfs_shared_data_ref *sref;
1425	u64 seq;
1426	u64 dref_offset;
1427	u64 inline_offset;
1428	u8 inline_type;
1429
1430	if (unlikely(ptr + sizeof(*iref) > end)) {
1431	extent_err(eb: leaf, slot,
1432	fmt: "inline ref item overflows extent item, ptr %lu iref size %zu end %lu",
1433	ptr, sizeof(*iref), end);
1434	return -EUCLEAN;
1435	}
1436	iref = (struct btrfs_extent_inline_ref *)ptr;
1437	inline_type = btrfs_extent_inline_ref_type(eb: leaf, s: iref);
1438	inline_offset = btrfs_extent_inline_ref_offset(eb: leaf, s: iref);
1439	seq = inline_offset;
1440	if (unlikely(ptr + btrfs_extent_inline_ref_size(inline_type) > end)) {
1441	extent_err(eb: leaf, slot,
1442	fmt: "inline ref item overflows extent item, ptr %lu iref size %u end %lu",
1443	ptr, btrfs_extent_inline_ref_size(type: inline_type), end);
1444	return -EUCLEAN;
1445	}
1446
1447	switch (inline_type) {
1448	/* inline_offset is subvolid of the owner, no need to check */
1449	case BTRFS_TREE_BLOCK_REF_KEY:
1450	inline_refs++;
1451	break;
1452	/* Contains parent bytenr */
1453	case BTRFS_SHARED_BLOCK_REF_KEY:
1454	if (unlikely(!IS_ALIGNED(inline_offset,
1455	fs_info->sectorsize))) {
1456	extent_err(eb: leaf, slot,
1457	fmt: "invalid tree parent bytenr, have %llu expect aligned to %u",
1458	inline_offset, fs_info->sectorsize);
1459	return -EUCLEAN;
1460	}
1461	inline_refs++;
1462	break;
1463	/*
1464	* Contains owner subvolid, owner key objectid, adjusted offset.
1465	* The only obvious corruption can happen in that offset.
1466	*/
1467	case BTRFS_EXTENT_DATA_REF_KEY:
1468	dref = (struct btrfs_extent_data_ref *)(&iref->offset);
1469	dref_offset = btrfs_extent_data_ref_offset(eb: leaf, s: dref);
1470	seq = hash_extent_data_ref(
1471	root_objectid: btrfs_extent_data_ref_root(eb: leaf, s: dref),
1472	owner: btrfs_extent_data_ref_objectid(eb: leaf, s: dref),
1473	offset: btrfs_extent_data_ref_offset(eb: leaf, s: dref));
1474	if (unlikely(!IS_ALIGNED(dref_offset,
1475	fs_info->sectorsize))) {
1476	extent_err(eb: leaf, slot,
1477	fmt: "invalid data ref offset, have %llu expect aligned to %u",
1478	dref_offset, fs_info->sectorsize);
1479	return -EUCLEAN;
1480	}
1481	inline_refs += btrfs_extent_data_ref_count(eb: leaf, s: dref);
1482	break;
1483	/* Contains parent bytenr and ref count */
1484	case BTRFS_SHARED_DATA_REF_KEY:
1485	sref = (struct btrfs_shared_data_ref *)(iref + 1);
1486	if (unlikely(!IS_ALIGNED(inline_offset,
1487	fs_info->sectorsize))) {
1488	extent_err(eb: leaf, slot,
1489	fmt: "invalid data parent bytenr, have %llu expect aligned to %u",
1490	inline_offset, fs_info->sectorsize);
1491	return -EUCLEAN;
1492	}
1493	inline_refs += btrfs_shared_data_ref_count(eb: leaf, s: sref);
1494	break;
1495	case BTRFS_EXTENT_OWNER_REF_KEY:
1496	WARN_ON(!btrfs_fs_incompat(fs_info, SIMPLE_QUOTA));
1497	break;
1498	default:
1499	extent_err(eb: leaf, slot, fmt: "unknown inline ref type: %u",
1500	inline_type);
1501	return -EUCLEAN;
1502	}
1503	if (inline_type < last_type) {
1504	extent_err(eb: leaf, slot,
1505	fmt: "inline ref out-of-order: has type %u, prev type %u",
1506	inline_type, last_type);
1507	return -EUCLEAN;
1508	}
1509	/* Type changed, allow the sequence starts from U64_MAX again. */
1510	if (inline_type > last_type)
1511	last_seq = U64_MAX;
1512	if (seq > last_seq) {
1513	extent_err(eb: leaf, slot,
1514	fmt: "inline ref out-of-order: has type %u offset %llu seq 0x%llx, prev type %u seq 0x%llx",
1515	inline_type, inline_offset, seq,
1516	last_type, last_seq);
1517	return -EUCLEAN;
1518	}
1519	last_type = inline_type;
1520	last_seq = seq;
1521	ptr += btrfs_extent_inline_ref_size(type: inline_type);
1522	}
1523	/* No padding is allowed */
1524	if (unlikely(ptr != end)) {
1525	extent_err(eb: leaf, slot,
1526	fmt: "invalid extent item size, padding bytes found");
1527	return -EUCLEAN;
1528	}
1529
1530	/* Finally, check the inline refs against total refs */
1531	if (unlikely(inline_refs > total_refs)) {
1532	extent_err(eb: leaf, slot,
1533	fmt: "invalid extent refs, have %llu expect >= inline %llu",
1534	total_refs, inline_refs);
1535	return -EUCLEAN;
1536	}
1537
1538	if ((prev_key->type == BTRFS_EXTENT_ITEM_KEY) ||
1539	(prev_key->type == BTRFS_METADATA_ITEM_KEY)) {
1540	u64 prev_end = prev_key->objectid;
1541
1542	if (prev_key->type == BTRFS_METADATA_ITEM_KEY)
1543	prev_end += fs_info->nodesize;
1544	else
1545	prev_end += prev_key->offset;
1546
1547	if (unlikely(prev_end > key->objectid)) {
1548	extent_err(eb: leaf, slot,
1549	fmt: "previous extent [%llu %u %llu] overlaps current extent [%llu %u %llu]",
1550	prev_key->objectid, prev_key->type,
1551	prev_key->offset, key->objectid, key->type,
1552	key->offset);
1553	return -EUCLEAN;
1554	}
1555	}
1556
1557	return 0;
1558	}
1559
1560	static int check_simple_keyed_refs(struct extent_buffer *leaf,
1561	struct btrfs_key *key, int slot)
1562	{
1563	u32 expect_item_size = 0;
1564
1565	if (key->type == BTRFS_SHARED_DATA_REF_KEY)
1566	expect_item_size = sizeof(struct btrfs_shared_data_ref);
1567
1568	if (unlikely(btrfs_item_size(leaf, slot) != expect_item_size)) {
1569	generic_err(eb: leaf, slot,
1570	fmt: "invalid item size, have %u expect %u for key type %u",
1571	btrfs_item_size(eb: leaf, slot),
1572	expect_item_size, key->type);
1573	return -EUCLEAN;
1574	}
1575	if (unlikely(!IS_ALIGNED(key->objectid, leaf->fs_info->sectorsize))) {
1576	generic_err(eb: leaf, slot,
1577	fmt: "invalid key objectid for shared block ref, have %llu expect aligned to %u",
1578	key->objectid, leaf->fs_info->sectorsize);
1579	return -EUCLEAN;
1580	}
1581	if (unlikely(key->type != BTRFS_TREE_BLOCK_REF_KEY &&
1582	!IS_ALIGNED(key->offset, leaf->fs_info->sectorsize))) {
1583	extent_err(eb: leaf, slot,
1584	fmt: "invalid tree parent bytenr, have %llu expect aligned to %u",
1585	key->offset, leaf->fs_info->sectorsize);
1586	return -EUCLEAN;
1587	}
1588	return 0;
1589	}
1590
1591	static int check_extent_data_ref(struct extent_buffer *leaf,
1592	struct btrfs_key *key, int slot)
1593	{
1594	struct btrfs_extent_data_ref *dref;
1595	unsigned long ptr = btrfs_item_ptr_offset(leaf, slot);
1596	const unsigned long end = ptr + btrfs_item_size(eb: leaf, slot);
1597
1598	if (unlikely(btrfs_item_size(leaf, slot) % sizeof(*dref) != 0)) {
1599	generic_err(eb: leaf, slot,
1600	fmt: "invalid item size, have %u expect aligned to %zu for key type %u",
1601	btrfs_item_size(eb: leaf, slot),
1602	sizeof(*dref), key->type);
1603	return -EUCLEAN;
1604	}
1605	if (unlikely(!IS_ALIGNED(key->objectid, leaf->fs_info->sectorsize))) {
1606	generic_err(eb: leaf, slot,
1607	fmt: "invalid key objectid for shared block ref, have %llu expect aligned to %u",
1608	key->objectid, leaf->fs_info->sectorsize);
1609	return -EUCLEAN;
1610	}
1611	for (; ptr < end; ptr += sizeof(*dref)) {
1612	u64 offset;
1613
1614	/*
1615	* We cannot check the extent_data_ref hash due to possible
1616	* overflow from the leaf due to hash collisions.
1617	*/
1618	dref = (struct btrfs_extent_data_ref *)ptr;
1619	offset = btrfs_extent_data_ref_offset(eb: leaf, s: dref);
1620	if (unlikely(!IS_ALIGNED(offset, leaf->fs_info->sectorsize))) {
1621	extent_err(eb: leaf, slot,
1622	fmt: "invalid extent data backref offset, have %llu expect aligned to %u",
1623	offset, leaf->fs_info->sectorsize);
1624	return -EUCLEAN;
1625	}
1626	}
1627	return 0;
1628	}
1629
1630	#define inode_ref_err(eb, slot, fmt, args...) \
1631	inode_item_err(eb, slot, fmt, ##args)
1632	static int check_inode_ref(struct extent_buffer *leaf,
1633	struct btrfs_key *key, struct btrfs_key *prev_key,
1634	int slot)
1635	{
1636	struct btrfs_inode_ref *iref;
1637	unsigned long ptr;
1638	unsigned long end;
1639
1640	if (unlikely(!check_prev_ino(leaf, key, slot, prev_key)))
1641	return -EUCLEAN;
1642	/* namelen can't be 0, so item_size == sizeof() is also invalid */
1643	if (unlikely(btrfs_item_size(leaf, slot) <= sizeof(*iref))) {
1644	inode_ref_err(leaf, slot,
1645	"invalid item size, have %u expect (%zu, %u)",
1646	btrfs_item_size(leaf, slot),
1647	sizeof(*iref), BTRFS_LEAF_DATA_SIZE(leaf->fs_info));
1648	return -EUCLEAN;
1649	}
1650
1651	ptr = btrfs_item_ptr_offset(leaf, slot);
1652	end = ptr + btrfs_item_size(eb: leaf, slot);
1653	while (ptr < end) {
1654	u16 namelen;
1655
1656	if (unlikely(ptr + sizeof(iref) > end)) {
1657	inode_ref_err(leaf, slot,
1658	"inode ref overflow, ptr %lu end %lu inode_ref_size %zu",
1659	ptr, end, sizeof(iref));
1660	return -EUCLEAN;
1661	}
1662
1663	iref = (struct btrfs_inode_ref *)ptr;
1664	namelen = btrfs_inode_ref_name_len(eb: leaf, s: iref);
1665	if (unlikely(ptr + sizeof(*iref) + namelen > end)) {
1666	inode_ref_err(leaf, slot,
1667	"inode ref overflow, ptr %lu end %lu namelen %u",
1668	ptr, end, namelen);
1669	return -EUCLEAN;
1670	}
1671
1672	/*
1673	* NOTE: In theory we should record all found index numbers
1674	* to find any duplicated indexes, but that will be too time
1675	* consuming for inodes with too many hard links.
1676	*/
1677	ptr += sizeof(*iref) + namelen;
1678	}
1679	return 0;
1680	}
1681
1682	static int check_raid_stripe_extent(const struct extent_buffer *leaf,
1683	const struct btrfs_key *key, int slot)
1684	{
1685	struct btrfs_stripe_extent *stripe_extent =
1686	btrfs_item_ptr(leaf, slot, struct btrfs_stripe_extent);
1687
1688	if (unlikely(!IS_ALIGNED(key->objectid, leaf->fs_info->sectorsize))) {
1689	generic_err(eb: leaf, slot,
1690	fmt: "invalid key objectid for raid stripe extent, have %llu expect aligned to %u",
1691	key->objectid, leaf->fs_info->sectorsize);
1692	return -EUCLEAN;
1693	}
1694
1695	if (unlikely(!btrfs_fs_incompat(leaf->fs_info, RAID_STRIPE_TREE))) {
1696	generic_err(eb: leaf, slot,
1697	fmt: "RAID_STRIPE_EXTENT present but RAID_STRIPE_TREE incompat bit unset");
1698	return -EUCLEAN;
1699	}
1700
1701	switch (btrfs_stripe_extent_encoding(eb: leaf, s: stripe_extent)) {
1702	case BTRFS_STRIPE_RAID0:
1703	case BTRFS_STRIPE_RAID1:
1704	case BTRFS_STRIPE_DUP:
1705	case BTRFS_STRIPE_RAID10:
1706	case BTRFS_STRIPE_RAID5:
1707	case BTRFS_STRIPE_RAID6:
1708	case BTRFS_STRIPE_RAID1C3:
1709	case BTRFS_STRIPE_RAID1C4:
1710	break;
1711	default:
1712	generic_err(eb: leaf, slot, fmt: "invalid raid stripe encoding %u",
1713	btrfs_stripe_extent_encoding(eb: leaf, s: stripe_extent));
1714	return -EUCLEAN;
1715	}
1716
1717	return 0;
1718	}
1719
1720	/*
1721	* Common point to switch the item-specific validation.
1722	*/
1723	static enum btrfs_tree_block_status check_leaf_item(struct extent_buffer *leaf,
1724	struct btrfs_key *key,
1725	int slot,
1726	struct btrfs_key *prev_key)
1727	{
1728	int ret = 0;
1729	struct btrfs_chunk *chunk;
1730
1731	switch (key->type) {
1732	case BTRFS_EXTENT_DATA_KEY:
1733	ret = check_extent_data_item(leaf, key, slot, prev_key);
1734	break;
1735	case BTRFS_EXTENT_CSUM_KEY:
1736	ret = check_csum_item(leaf, key, slot, prev_key);
1737	break;
1738	case BTRFS_DIR_ITEM_KEY:
1739	case BTRFS_DIR_INDEX_KEY:
1740	case BTRFS_XATTR_ITEM_KEY:
1741	ret = check_dir_item(leaf, key, prev_key, slot);
1742	break;
1743	case BTRFS_INODE_REF_KEY:
1744	ret = check_inode_ref(leaf, key, prev_key, slot);
1745	break;
1746	case BTRFS_BLOCK_GROUP_ITEM_KEY:
1747	ret = check_block_group_item(leaf, key, slot);
1748	break;
1749	case BTRFS_CHUNK_ITEM_KEY:
1750	chunk = btrfs_item_ptr(leaf, slot, struct btrfs_chunk);
1751	ret = check_leaf_chunk_item(leaf, chunk, key, slot);
1752	break;
1753	case BTRFS_DEV_ITEM_KEY:
1754	ret = check_dev_item(leaf, key, slot);
1755	break;
1756	case BTRFS_INODE_ITEM_KEY:
1757	ret = check_inode_item(leaf, key, slot);
1758	break;
1759	case BTRFS_ROOT_ITEM_KEY:
1760	ret = check_root_item(leaf, key, slot);
1761	break;
1762	case BTRFS_EXTENT_ITEM_KEY:
1763	case BTRFS_METADATA_ITEM_KEY:
1764	ret = check_extent_item(leaf, key, slot, prev_key);
1765	break;
1766	case BTRFS_TREE_BLOCK_REF_KEY:
1767	case BTRFS_SHARED_DATA_REF_KEY:
1768	case BTRFS_SHARED_BLOCK_REF_KEY:
1769	ret = check_simple_keyed_refs(leaf, key, slot);
1770	break;
1771	case BTRFS_EXTENT_DATA_REF_KEY:
1772	ret = check_extent_data_ref(leaf, key, slot);
1773	break;
1774	case BTRFS_RAID_STRIPE_KEY:
1775	ret = check_raid_stripe_extent(leaf, key, slot);
1776	break;
1777	}
1778
1779	if (ret)
1780	return BTRFS_TREE_BLOCK_INVALID_ITEM;
1781	return BTRFS_TREE_BLOCK_CLEAN;
1782	}
1783
1784	enum btrfs_tree_block_status __btrfs_check_leaf(struct extent_buffer *leaf)
1785	{
1786	struct btrfs_fs_info *fs_info = leaf->fs_info;
1787	/* No valid key type is 0, so all key should be larger than this key */
1788	struct btrfs_key prev_key = {0, 0, 0};
1789	struct btrfs_key key;
1790	u32 nritems = btrfs_header_nritems(eb: leaf);
1791	int slot;
1792
1793	if (unlikely(btrfs_header_level(leaf) != 0)) {
1794	generic_err(eb: leaf, slot: 0,
1795	fmt: "invalid level for leaf, have %d expect 0",
1796	btrfs_header_level(eb: leaf));
1797	return BTRFS_TREE_BLOCK_INVALID_LEVEL;
1798	}
1799
1800	/*
1801	* Extent buffers from a relocation tree have a owner field that
1802	* corresponds to the subvolume tree they are based on. So just from an
1803	* extent buffer alone we can not find out what is the id of the
1804	* corresponding subvolume tree, so we can not figure out if the extent
1805	* buffer corresponds to the root of the relocation tree or not. So
1806	* skip this check for relocation trees.
1807	*/
1808	if (nritems == 0 && !btrfs_header_flag(eb: leaf, BTRFS_HEADER_FLAG_RELOC)) {
1809	u64 owner = btrfs_header_owner(eb: leaf);
1810
1811	/* These trees must never be empty */
1812	if (unlikely(owner == BTRFS_ROOT_TREE_OBJECTID ||
1813	owner == BTRFS_CHUNK_TREE_OBJECTID ||
1814	owner == BTRFS_DEV_TREE_OBJECTID ||
1815	owner == BTRFS_FS_TREE_OBJECTID ||
1816	owner == BTRFS_DATA_RELOC_TREE_OBJECTID)) {
1817	generic_err(eb: leaf, slot: 0,
1818	fmt: "invalid root, root %llu must never be empty",
1819	owner);
1820	return BTRFS_TREE_BLOCK_INVALID_NRITEMS;
1821	}
1822
1823	/* Unknown tree */
1824	if (unlikely(owner == 0)) {
1825	generic_err(eb: leaf, slot: 0,
1826	fmt: "invalid owner, root 0 is not defined");
1827	return BTRFS_TREE_BLOCK_INVALID_OWNER;
1828	}
1829
1830	/* EXTENT_TREE_V2 can have empty extent trees. */
1831	if (btrfs_fs_incompat(fs_info, EXTENT_TREE_V2))
1832	return BTRFS_TREE_BLOCK_CLEAN;
1833
1834	if (unlikely(owner == BTRFS_EXTENT_TREE_OBJECTID)) {
1835	generic_err(eb: leaf, slot: 0,
1836	fmt: "invalid root, root %llu must never be empty",
1837	owner);
1838	return BTRFS_TREE_BLOCK_INVALID_NRITEMS;
1839	}
1840
1841	return BTRFS_TREE_BLOCK_CLEAN;
1842	}
1843
1844	if (unlikely(nritems == 0))
1845	return BTRFS_TREE_BLOCK_CLEAN;
1846
1847	/*
1848	* Check the following things to make sure this is a good leaf, and
1849	* leaf users won't need to bother with similar sanity checks:
1850	*
1851	* 1) key ordering
1852	* 2) item offset and size
1853	* No overlap, no hole, all inside the leaf.
1854	* 3) item content
1855	* If possible, do comprehensive sanity check.
1856	* NOTE: All checks must only rely on the item data itself.
1857	*/
1858	for (slot = 0; slot < nritems; slot++) {
1859	u32 item_end_expected;
1860	u64 item_data_end;
1861
1862	btrfs_item_key_to_cpu(eb: leaf, cpu_key: &key, nr: slot);
1863
1864	/* Make sure the keys are in the right order */
1865	if (unlikely(btrfs_comp_cpu_keys(&prev_key, &key) >= 0)) {
1866	generic_err(eb: leaf, slot,
1867	fmt: "bad key order, prev (%llu %u %llu) current (%llu %u %llu)",
1868	prev_key.objectid, prev_key.type,
1869	prev_key.offset, key.objectid, key.type,
1870	key.offset);
1871	return BTRFS_TREE_BLOCK_BAD_KEY_ORDER;
1872	}
1873
1874	item_data_end = (u64)btrfs_item_offset(eb: leaf, slot) +
1875	btrfs_item_size(eb: leaf, slot);
1876	/*
1877	* Make sure the offset and ends are right, remember that the
1878	* item data starts at the end of the leaf and grows towards the
1879	* front.
1880	*/
1881	if (slot == 0)
1882	item_end_expected = BTRFS_LEAF_DATA_SIZE(info: fs_info);
1883	else
1884	item_end_expected = btrfs_item_offset(eb: leaf,
1885	slot: slot - 1);
1886	if (unlikely(item_data_end != item_end_expected)) {
1887	generic_err(eb: leaf, slot,
1888	fmt: "unexpected item end, have %llu expect %u",
1889	item_data_end, item_end_expected);
1890	return BTRFS_TREE_BLOCK_INVALID_OFFSETS;
1891	}
1892
1893	/*
1894	* Check to make sure that we don't point outside of the leaf,
1895	* just in case all the items are consistent to each other, but
1896	* all point outside of the leaf.
1897	*/
1898	if (unlikely(item_data_end > BTRFS_LEAF_DATA_SIZE(fs_info))) {
1899	generic_err(eb: leaf, slot,
1900	fmt: "slot end outside of leaf, have %llu expect range [0, %u]",
1901	item_data_end, BTRFS_LEAF_DATA_SIZE(info: fs_info));
1902	return BTRFS_TREE_BLOCK_INVALID_OFFSETS;
1903	}
1904
1905	/* Also check if the item pointer overlaps with btrfs item. */
1906	if (unlikely(btrfs_item_ptr_offset(leaf, slot) <
1907	btrfs_item_nr_offset(leaf, slot) + sizeof(struct btrfs_item))) {
1908	generic_err(eb: leaf, slot,
1909	fmt: "slot overlaps with its data, item end %lu data start %lu",
1910	btrfs_item_nr_offset(eb: leaf, nr: slot) +
1911	sizeof(struct btrfs_item),
1912	btrfs_item_ptr_offset(leaf, slot));
1913	return BTRFS_TREE_BLOCK_INVALID_OFFSETS;
1914	}
1915
1916	/*
1917	* We only want to do this if WRITTEN is set, otherwise the leaf
1918	* may be in some intermediate state and won't appear valid.
1919	*/
1920	if (btrfs_header_flag(eb: leaf, BTRFS_HEADER_FLAG_WRITTEN)) {
1921	enum btrfs_tree_block_status ret;
1922
1923	/*
1924	* Check if the item size and content meet other
1925	* criteria
1926	*/
1927	ret = check_leaf_item(leaf, key: &key, slot, prev_key: &prev_key);
1928	if (unlikely(ret != BTRFS_TREE_BLOCK_CLEAN))
1929	return ret;
1930	}
1931
1932	prev_key.objectid = key.objectid;
1933	prev_key.type = key.type;
1934	prev_key.offset = key.offset;
1935	}
1936
1937	return BTRFS_TREE_BLOCK_CLEAN;
1938	}
1939
1940	int btrfs_check_leaf(struct extent_buffer *leaf)
1941	{
1942	enum btrfs_tree_block_status ret;
1943
1944	ret = __btrfs_check_leaf(leaf);
1945	if (unlikely(ret != BTRFS_TREE_BLOCK_CLEAN))
1946	return -EUCLEAN;
1947	return 0;
1948	}
1949	ALLOW_ERROR_INJECTION(btrfs_check_leaf, ERRNO);
1950
1951	enum btrfs_tree_block_status __btrfs_check_node(struct extent_buffer *node)
1952	{
1953	struct btrfs_fs_info *fs_info = node->fs_info;
1954	unsigned long nr = btrfs_header_nritems(eb: node);
1955	struct btrfs_key key, next_key;
1956	int slot;
1957	int level = btrfs_header_level(eb: node);
1958	u64 bytenr;
1959
1960	if (unlikely(level <= 0 || level >= BTRFS_MAX_LEVEL)) {
1961	generic_err(eb: node, slot: 0,
1962	fmt: "invalid level for node, have %d expect [1, %d]",
1963	level, BTRFS_MAX_LEVEL - 1);
1964	return BTRFS_TREE_BLOCK_INVALID_LEVEL;
1965	}
1966	if (unlikely(nr == 0 || nr > BTRFS_NODEPTRS_PER_BLOCK(fs_info))) {
1967	btrfs_crit(fs_info,
1968	"corrupt node: root=%llu block=%llu, nritems too %s, have %lu expect range [1,%u]",
1969	btrfs_header_owner(node), node->start,
1970	nr == 0 ? "small" : "large", nr,
1971	BTRFS_NODEPTRS_PER_BLOCK(fs_info));
1972	return BTRFS_TREE_BLOCK_INVALID_NRITEMS;
1973	}
1974
1975	for (slot = 0; slot < nr - 1; slot++) {
1976	bytenr = btrfs_node_blockptr(eb: node, nr: slot);
1977	btrfs_node_key_to_cpu(eb: node, cpu_key: &key, nr: slot);
1978	btrfs_node_key_to_cpu(eb: node, cpu_key: &next_key, nr: slot + 1);
1979
1980	if (unlikely(!bytenr)) {
1981	generic_err(eb: node, slot,
1982	fmt: "invalid NULL node pointer");
1983	return BTRFS_TREE_BLOCK_INVALID_BLOCKPTR;
1984	}
1985	if (unlikely(!IS_ALIGNED(bytenr, fs_info->sectorsize))) {
1986	generic_err(eb: node, slot,
1987	fmt: "unaligned pointer, have %llu should be aligned to %u",
1988	bytenr, fs_info->sectorsize);
1989	return BTRFS_TREE_BLOCK_INVALID_BLOCKPTR;
1990	}
1991
1992	if (unlikely(btrfs_comp_cpu_keys(&key, &next_key) >= 0)) {
1993	generic_err(eb: node, slot,
1994	fmt: "bad key order, current (%llu %u %llu) next (%llu %u %llu)",
1995	key.objectid, key.type, key.offset,
1996	next_key.objectid, next_key.type,
1997	next_key.offset);
1998	return BTRFS_TREE_BLOCK_BAD_KEY_ORDER;
1999	}
2000	}
2001	return BTRFS_TREE_BLOCK_CLEAN;
2002	}
2003
2004	int btrfs_check_node(struct extent_buffer *node)
2005	{
2006	enum btrfs_tree_block_status ret;
2007
2008	ret = __btrfs_check_node(node);
2009	if (unlikely(ret != BTRFS_TREE_BLOCK_CLEAN))
2010	return -EUCLEAN;
2011	return 0;
2012	}
2013	ALLOW_ERROR_INJECTION(btrfs_check_node, ERRNO);
2014
2015	int btrfs_check_eb_owner(const struct extent_buffer *eb, u64 root_owner)
2016	{
2017	const bool is_subvol = is_fstree(rootid: root_owner);
2018	const u64 eb_owner = btrfs_header_owner(eb);
2019
2020	/*
2021	* Skip dummy fs, as selftests don't create unique ebs for each dummy
2022	* root.
2023	*/
2024	if (test_bit(BTRFS_FS_STATE_DUMMY_FS_INFO, &eb->fs_info->fs_state))
2025	return 0;
2026	/*
2027	* There are several call sites (backref walking, qgroup, and data
2028	* reloc) passing 0 as @root_owner, as they are not holding the
2029	* tree root. In that case, we can not do a reliable ownership check,
2030	* so just exit.
2031	*/
2032	if (root_owner == 0)
2033	return 0;
2034	/*
2035	* These trees use key.offset as their owner, our callers don't have
2036	* the extra capacity to pass key.offset here. So we just skip them.
2037	*/
2038	if (root_owner == BTRFS_TREE_LOG_OBJECTID ||
2039	root_owner == BTRFS_TREE_RELOC_OBJECTID)
2040	return 0;
2041
2042	if (!is_subvol) {
2043	/* For non-subvolume trees, the eb owner should match root owner */
2044	if (unlikely(root_owner != eb_owner)) {
2045	btrfs_crit(eb->fs_info,
2046	"corrupted %s, root=%llu block=%llu owner mismatch, have %llu expect %llu",
2047	btrfs_header_level(eb) == 0 ? "leaf" : "node",
2048	root_owner, btrfs_header_bytenr(eb), eb_owner,
2049	root_owner);
2050	return -EUCLEAN;
2051	}
2052	return 0;
2053	}
2054
2055	/*
2056	* For subvolume trees, owners can mismatch, but they should all belong
2057	* to subvolume trees.
2058	*/
2059	if (unlikely(is_subvol != is_fstree(eb_owner))) {
2060	btrfs_crit(eb->fs_info,
2061	"corrupted %s, root=%llu block=%llu owner mismatch, have %llu expect [%llu, %llu]",
2062	btrfs_header_level(eb) == 0 ? "leaf" : "node",
2063	root_owner, btrfs_header_bytenr(eb), eb_owner,
2064	BTRFS_FIRST_FREE_OBJECTID, BTRFS_LAST_FREE_OBJECTID);
2065	return -EUCLEAN;
2066	}
2067	return 0;
2068	}
2069
2070	int btrfs_verify_level_key(struct extent_buffer *eb, int level,
2071	struct btrfs_key *first_key, u64 parent_transid)
2072	{
2073	struct btrfs_fs_info *fs_info = eb->fs_info;
2074	int found_level;
2075	struct btrfs_key found_key;
2076	int ret;
2077
2078	found_level = btrfs_header_level(eb);
2079	if (found_level != level) {
2080	WARN(IS_ENABLED(CONFIG_BTRFS_DEBUG),
2081	KERN_ERR "BTRFS: tree level check failed\n");
2082	btrfs_err(fs_info,
2083	"tree level mismatch detected, bytenr=%llu level expected=%u has=%u",
2084	eb->start, level, found_level);
2085	return -EIO;
2086	}
2087
2088	if (!first_key)
2089	return 0;
2090
2091	/*
2092	* For live tree block (new tree blocks in current transaction),
2093	* we need proper lock context to avoid race, which is impossible here.
2094	* So we only checks tree blocks which is read from disk, whose
2095	* generation <= fs_info->last_trans_committed.
2096	*/
2097	if (btrfs_header_generation(eb) > btrfs_get_last_trans_committed(fs_info))
2098	return 0;
2099
2100	/* We have @first_key, so this @eb must have at least one item */
2101	if (btrfs_header_nritems(eb) == 0) {
2102	btrfs_err(fs_info,
2103	"invalid tree nritems, bytenr=%llu nritems=0 expect >0",
2104	eb->start);
2105	WARN_ON(IS_ENABLED(CONFIG_BTRFS_DEBUG));
2106	return -EUCLEAN;
2107	}
2108
2109	if (found_level)
2110	btrfs_node_key_to_cpu(eb, cpu_key: &found_key, nr: 0);
2111	else
2112	btrfs_item_key_to_cpu(eb, cpu_key: &found_key, nr: 0);
2113	ret = btrfs_comp_cpu_keys(k1: first_key, k2: &found_key);
2114
2115	if (ret) {
2116	WARN(IS_ENABLED(CONFIG_BTRFS_DEBUG),
2117	KERN_ERR "BTRFS: tree first key check failed\n");
2118	btrfs_err(fs_info,
2119	"tree first key mismatch detected, bytenr=%llu parent_transid=%llu key expected=(%llu,%u,%llu) has=(%llu,%u,%llu)",
2120	eb->start, parent_transid, first_key->objectid,
2121	first_key->type, first_key->offset,
2122	found_key.objectid, found_key.type,
2123	found_key.offset);
2124	}
2125	return ret;
2126	}
2127