1 // SPDX-License-Identifier: GPL-2.0+
3 * Copyright (C) 2017 Oracle. All Rights Reserved.
4 * Author: Darrick J. Wong <darrick.wong@oracle.com>
8 #include "xfs_shared.h"
9 #include "xfs_format.h"
10 #include "xfs_trans_resv.h"
11 #include "xfs_mount.h"
12 #include "xfs_log_format.h"
13 #include "xfs_trans.h"
14 #include "xfs_inode.h"
15 #include "xfs_quota.h"
17 #include "scrub/scrub.h"
18 #include "scrub/common.h"
20 /* Convert a scrub type code to a DQ flag, or return 0 if error. */
21 static inline xfs_dqtype_t
25 switch (sc->sm->sm_type) {
26 case XFS_SCRUB_TYPE_UQUOTA:
27 return XFS_DQTYPE_USER;
28 case XFS_SCRUB_TYPE_GQUOTA:
29 return XFS_DQTYPE_GROUP;
30 case XFS_SCRUB_TYPE_PQUOTA:
31 return XFS_DQTYPE_PROJ;
37 /* Set us up to scrub a quota. */
45 if (!XFS_IS_QUOTA_ON(sc->mp))
48 dqtype = xchk_quota_to_dqtype(sc);
52 if (!xfs_this_quota_on(sc->mp, dqtype))
55 error = xchk_setup_fs(sc);
58 sc->ip = xfs_quota_inode(sc->mp, dqtype);
59 xfs_ilock(sc->ip, XFS_ILOCK_EXCL);
60 sc->ilock_flags = XFS_ILOCK_EXCL;
66 struct xchk_quota_info {
71 /* Scrub the fields in an individual quota item. */
78 struct xchk_quota_info *sqi = priv;
79 struct xfs_scrub *sc = sqi->sc;
80 struct xfs_mount *mp = sc->mp;
81 struct xfs_quotainfo *qi = mp->m_quotainfo;
86 if (xchk_should_terminate(sc, &error))
90 * Except for the root dquot, the actual dquot we got must either have
91 * the same or higher id as we saw before.
93 offset = dq->q_id / qi->qi_dqperchunk;
94 if (dq->q_id && dq->q_id <= sqi->last_id)
95 xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, offset);
97 sqi->last_id = dq->q_id;
100 * Warn if the hard limits are larger than the fs.
101 * Administrators can do this, though in production this seems
102 * suspect, which is why we flag it for review.
104 * Complain about corruption if the soft limit is greater than
107 if (dq->q_blk.hardlimit > mp->m_sb.sb_dblocks)
108 xchk_fblock_set_warning(sc, XFS_DATA_FORK, offset);
109 if (dq->q_blk.softlimit > dq->q_blk.hardlimit)
110 xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, offset);
112 if (dq->q_ino.hardlimit > M_IGEO(mp)->maxicount)
113 xchk_fblock_set_warning(sc, XFS_DATA_FORK, offset);
114 if (dq->q_ino.softlimit > dq->q_ino.hardlimit)
115 xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, offset);
117 if (dq->q_rtb.hardlimit > mp->m_sb.sb_rblocks)
118 xchk_fblock_set_warning(sc, XFS_DATA_FORK, offset);
119 if (dq->q_rtb.softlimit > dq->q_rtb.hardlimit)
120 xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, offset);
122 /* Check the resource counts. */
123 fs_icount = percpu_counter_sum(&mp->m_icount);
126 * Check that usage doesn't exceed physical limits. However, on
127 * a reflink filesystem we're allowed to exceed physical space
128 * if there are no quota limits.
130 if (xfs_has_reflink(mp)) {
131 if (mp->m_sb.sb_dblocks < dq->q_blk.count)
132 xchk_fblock_set_warning(sc, XFS_DATA_FORK,
135 if (mp->m_sb.sb_dblocks < dq->q_blk.count)
136 xchk_fblock_set_corrupt(sc, XFS_DATA_FORK,
139 if (dq->q_ino.count > fs_icount || dq->q_rtb.count > mp->m_sb.sb_rblocks)
140 xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, offset);
143 * We can violate the hard limits if the admin suddenly sets a
144 * lower limit than the actual usage. However, we flag it for
150 if (dq->q_blk.hardlimit != 0 &&
151 dq->q_blk.count > dq->q_blk.hardlimit)
152 xchk_fblock_set_warning(sc, XFS_DATA_FORK, offset);
154 if (dq->q_ino.hardlimit != 0 &&
155 dq->q_ino.count > dq->q_ino.hardlimit)
156 xchk_fblock_set_warning(sc, XFS_DATA_FORK, offset);
158 if (dq->q_rtb.hardlimit != 0 &&
159 dq->q_rtb.count > dq->q_rtb.hardlimit)
160 xchk_fblock_set_warning(sc, XFS_DATA_FORK, offset);
163 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
169 /* Check the quota's data fork. */
171 xchk_quota_data_fork(
172 struct xfs_scrub *sc)
174 struct xfs_bmbt_irec irec = { 0 };
175 struct xfs_iext_cursor icur;
176 struct xfs_quotainfo *qi = sc->mp->m_quotainfo;
177 struct xfs_ifork *ifp;
178 xfs_fileoff_t max_dqid_off;
181 /* Invoke the fork scrubber. */
182 error = xchk_metadata_inode_forks(sc);
183 if (error || (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT))
186 /* Check for data fork problems that apply only to quota files. */
187 max_dqid_off = ((xfs_dqid_t)-1) / qi->qi_dqperchunk;
188 ifp = xfs_ifork_ptr(sc->ip, XFS_DATA_FORK);
189 for_each_xfs_iext(ifp, &icur, &irec) {
190 if (xchk_should_terminate(sc, &error))
193 * delalloc extents or blocks mapped above the highest
194 * quota id shouldn't happen.
196 if (isnullstartblock(irec.br_startblock) ||
197 irec.br_startoff > max_dqid_off ||
198 irec.br_startoff + irec.br_blockcount - 1 > max_dqid_off) {
199 xchk_fblock_set_corrupt(sc, XFS_DATA_FORK,
208 /* Scrub all of a quota type's items. */
211 struct xfs_scrub *sc)
213 struct xchk_quota_info sqi;
214 struct xfs_mount *mp = sc->mp;
215 struct xfs_quotainfo *qi = mp->m_quotainfo;
219 dqtype = xchk_quota_to_dqtype(sc);
221 /* Look for problem extents. */
222 error = xchk_quota_data_fork(sc);
225 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
229 * Check all the quota items. Now that we've checked the quota inode
230 * data fork we have to drop ILOCK_EXCL to use the regular dquot
233 xfs_iunlock(sc->ip, sc->ilock_flags);
237 error = xfs_qm_dqiterate(mp, dqtype, xchk_quota_item, &sqi);
238 sc->ilock_flags = XFS_ILOCK_EXCL;
239 xfs_ilock(sc->ip, sc->ilock_flags);
240 if (error == -ECANCELED)
242 if (!xchk_fblock_process_error(sc, XFS_DATA_FORK,
243 sqi.last_id * qi->qi_dqperchunk, &error))