diff mbox

[25/30] xfs: scrub directory freespace

Message ID 150777260602.1724.16339769636569418352.stgit@magnolia (mailing list archive)
State Superseded
Headers show

Commit Message

Darrick J. Wong Oct. 12, 2017, 1:43 a.m. UTC
From: Darrick J. Wong <darrick.wong@oracle.com>

Check the free space information in a directory.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
---
 fs/xfs/scrub/dir.c |  425 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 425 insertions(+)



--
To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Dave Chinner Oct. 16, 2017, 4:49 a.m. UTC | #1
On Wed, Oct 11, 2017 at 06:43:26PM -0700, Darrick J. Wong wrote:
> From: Darrick J. Wong <darrick.wong@oracle.com>
> 
> Check the free space information in a directory.

....

> diff --git a/fs/xfs/scrub/dir.c b/fs/xfs/scrub/dir.c
> index e2a8f90..a41310f 100644
> --- a/fs/xfs/scrub/dir.c
> +++ b/fs/xfs/scrub/dir.c
> @@ -250,6 +250,426 @@ xfs_scrub_dir_rec(
>  	return error;
>  }
>  
> +/*
> + * Is this unused entry either in the bestfree or smaller than all of them?
> + * We assume the bestfrees are sorted longest to shortest, and that there
> + * aren't any bogus entries.

s/We assume/We've already checked/

> + */
> +static inline void
> +xfs_scrub_directory_check_free_entry(
> +	struct xfs_scrub_context	*sc,
> +	xfs_dablk_t			lblk,
> +	struct xfs_dir2_data_free	*bf,
> +	struct xfs_dir2_data_unused	*dup)

....

> +	while (ptr < endptr) {
> +		dup = (struct xfs_dir2_data_unused *)ptr;
> +		/* Skip real entries */
> +		if (dup->freetag != cpu_to_be16(XFS_DIR2_DATA_FREE_TAG)) {
> +			struct xfs_dir2_data_entry	*dep;
> +
> +			dep = (struct xfs_dir2_data_entry *)ptr;
> +			newlen = d_ops->data_entsize(dep->namelen);
> +			if (newlen <= 0) {
> +				xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK,
> +						lblk);
> +				goto out_buf;
> +			}
> +			ptr += newlen;
> +			if (endptr < ptr)
> +				xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK,
> +					      lblk);
> +			continue;
> +		}
> +
> +		/* Spot check this free entry */
> +		tag = be16_to_cpu(*xfs_dir2_data_unused_tag_p(dup));
> +		if (tag != ((char *)dup - (char *)bp->b_addr))
> +			xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk);
> +
> +		/*
> +		 * Either this entry is a bestfree or it's smaller than
> +		 * any of the bestfrees.
> +		 */
> +		xfs_scrub_directory_check_free_entry(sc, lblk, bf, dup);
> +
> +		/* Move on. */
> +		newlen = be16_to_cpu(dup->length);
> +		if (newlen <= 0) {
> +			xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk);
> +			goto out_buf;
> +		}
> +		ptr += newlen;
> +		if (endptr < ptr)
> +			xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk);

I'd prefer this matches the loop logic order. ie.

		if (ptr >= endptr)

> +		else
> +			nr_frees++;
> +	}
> +
> +	/* Did we see at least as many free slots as there are bestfrees? */
> +	if (nr_frees < nr_bestfrees)
> +		xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk);
> +out_buf:
> +	xfs_trans_brelse(sc->tp, bp);
> +out:
> +	return error;
> +}
> +
> +/*
> + * Does the free space length in the free space index block ($len) match
> + * the longest length in the directory data block's bestfree array?
> + * Assume that we've already checked that the data block's bestfree
> + * array is in order.
> + */
> +static inline void
> +xfs_scrub_directory_check_freesp(

No need for inline here, the compiler will do that automatically if
appropriate.

> +	struct xfs_scrub_context	*sc,
> +	xfs_dablk_t			lblk,
> +	struct xfs_buf			*dbp,
> +	unsigned int			len)
> +{
> +	struct xfs_dir2_data_free	*bf;
> +	struct xfs_dir2_data_free	*dfp;
> +	int				offset;
> +
> +	if (len == 0)
> +		return;
> +
> +	bf = sc->ip->d_ops->data_bestfree_p(dbp->b_addr);
> +	for (dfp = &bf[0]; dfp < &bf[XFS_DIR2_DATA_FD_COUNT]; dfp++) {
> +		offset = be16_to_cpu(dfp->offset);
> +		if (offset == 0)
> +			break;
> +		if (len == be16_to_cpu(dfp->length))
> +			return;
> +		/* Didn't find the best length in the bestfree data */
> +		break;
> +	}
> +
> +	xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk);
> +}
> +
> +/* Check free space info in a directory leaf1 block. */
> +STATIC int
> +xfs_scrub_directory_leaf1_bestfree(
> +	struct xfs_scrub_context	*sc,
> +	struct xfs_da_args		*args,
> +	xfs_dablk_t			lblk)
> +{
> +	struct xfs_dir2_leaf_tail	*ltp;
> +	struct xfs_buf			*dbp;
> +	struct xfs_buf			*bp;
> +	struct xfs_mount		*mp = sc->mp;
> +	__be16				*bestp;
> +	__u16				best;
> +	int				i;
> +	int				error;
> +
> +	/*
> +	 * Read the free space block.  The verifier will check for hash
> +	 * value ordering problems and check the stale entry count.
> +	 */
> +	error = xfs_dir3_leaf_read(sc->tp, sc->ip, lblk, -1, &bp);
> +	if (!xfs_scrub_fblock_process_error(sc, XFS_DATA_FORK, lblk, &error))
> +		goto out;
> +
> +	/* Check all the entries. */
> +	ltp = xfs_dir2_leaf_tail_p(mp->m_dir_geo, bp->b_addr);
> +	bestp = xfs_dir2_leaf_bests_p(ltp);
> +	for (i = 0; i < be32_to_cpu(ltp->bestcount); i++, bestp++) {
> +		best = be16_to_cpu(*bestp);
> +		if (best == NULLDATAOFF)
> +			continue;

Count stale entries, check if matches hdr->stale ?

> +		error = xfs_dir3_data_read(sc->tp, sc->ip,
> +				i * args->geo->fsbcount, -1, &dbp);
> +		if (!xfs_scrub_fblock_process_error(sc, XFS_DATA_FORK, lblk,
> +				&error))
> +			continue;
> +		xfs_scrub_directory_check_freesp(sc, lblk, dbp, best);
> +		xfs_trans_brelse(sc->tp, dbp);
> +	}
> +out:
> +	return error;
> +}
> +
> +/* Check free space info in a directory freespace block. */
> +STATIC int
> +xfs_scrub_directory_free_bestfree(
> +	struct xfs_scrub_context	*sc,
> +	struct xfs_da_args		*args,
> +	xfs_dablk_t			lblk)
> +{
> +	struct xfs_dir3_icfree_hdr	freehdr;
> +	struct xfs_buf			*dbp;
> +	struct xfs_buf			*bp;
> +	__be16				*bestp;
> +	__be16				best;
> +	int				i;
> +	int				error;
> +
> +	/* Read the free space block */
> +	error = xfs_dir2_free_read(sc->tp, sc->ip, lblk, &bp);
> +	if (!xfs_scrub_fblock_process_error(sc, XFS_DATA_FORK, lblk, &error))
> +		goto out;
> +
> +	/* Check all the entries. */
> +	sc->ip->d_ops->free_hdr_from_disk(&freehdr, bp->b_addr);
> +	bestp = sc->ip->d_ops->free_bests_p(bp->b_addr);
> +	for (i = 0; i < freehdr.nvalid; i++, bestp++) {
> +		best = be16_to_cpu(*bestp);
> +		if (best == NULLDATAOFF)
> +			continue;

Count stale entries, check freehdr.nvalid + stale = freehdr.nused?

Cheers,

Dave.
Darrick J. Wong Oct. 16, 2017, 10:37 p.m. UTC | #2
On Mon, Oct 16, 2017 at 03:49:21PM +1100, Dave Chinner wrote:
> On Wed, Oct 11, 2017 at 06:43:26PM -0700, Darrick J. Wong wrote:
> > From: Darrick J. Wong <darrick.wong@oracle.com>
> > 
> > Check the free space information in a directory.
> 
> ....
> 
> > diff --git a/fs/xfs/scrub/dir.c b/fs/xfs/scrub/dir.c
> > index e2a8f90..a41310f 100644
> > --- a/fs/xfs/scrub/dir.c
> > +++ b/fs/xfs/scrub/dir.c
> > @@ -250,6 +250,426 @@ xfs_scrub_dir_rec(
> >  	return error;
> >  }
> >  
> > +/*
> > + * Is this unused entry either in the bestfree or smaller than all of them?
> > + * We assume the bestfrees are sorted longest to shortest, and that there
> > + * aren't any bogus entries.
> 
> s/We assume/We've already checked/

Ok.

> > + */
> > +static inline void
> > +xfs_scrub_directory_check_free_entry(
> > +	struct xfs_scrub_context	*sc,
> > +	xfs_dablk_t			lblk,
> > +	struct xfs_dir2_data_free	*bf,
> > +	struct xfs_dir2_data_unused	*dup)
> 
> ....
> 
> > +	while (ptr < endptr) {
> > +		dup = (struct xfs_dir2_data_unused *)ptr;
> > +		/* Skip real entries */
> > +		if (dup->freetag != cpu_to_be16(XFS_DIR2_DATA_FREE_TAG)) {
> > +			struct xfs_dir2_data_entry	*dep;
> > +
> > +			dep = (struct xfs_dir2_data_entry *)ptr;
> > +			newlen = d_ops->data_entsize(dep->namelen);
> > +			if (newlen <= 0) {
> > +				xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK,
> > +						lblk);
> > +				goto out_buf;
> > +			}
> > +			ptr += newlen;
> > +			if (endptr < ptr)
> > +				xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK,
> > +					      lblk);
> > +			continue;
> > +		}
> > +
> > +		/* Spot check this free entry */
> > +		tag = be16_to_cpu(*xfs_dir2_data_unused_tag_p(dup));
> > +		if (tag != ((char *)dup - (char *)bp->b_addr))
> > +			xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk);
> > +
> > +		/*
> > +		 * Either this entry is a bestfree or it's smaller than
> > +		 * any of the bestfrees.
> > +		 */
> > +		xfs_scrub_directory_check_free_entry(sc, lblk, bf, dup);
> > +
> > +		/* Move on. */
> > +		newlen = be16_to_cpu(dup->length);
> > +		if (newlen <= 0) {
> > +			xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk);
> > +			goto out_buf;
> > +		}
> > +		ptr += newlen;
> > +		if (endptr < ptr)
> > +			xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk);
> 
> I'd prefer this matches the loop logic order. ie.
> 
> 		if (ptr >= endptr)
> 

Ok.  That check can be lifted out of the loop anyway.

> > +		else
> > +			nr_frees++;
> > +	}
> > +
> > +	/* Did we see at least as many free slots as there are bestfrees? */
> > +	if (nr_frees < nr_bestfrees)
> > +		xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk);
> > +out_buf:
> > +	xfs_trans_brelse(sc->tp, bp);
> > +out:
> > +	return error;
> > +}
> > +
> > +/*
> > + * Does the free space length in the free space index block ($len) match
> > + * the longest length in the directory data block's bestfree array?
> > + * Assume that we've already checked that the data block's bestfree
> > + * array is in order.
> > + */
> > +static inline void
> > +xfs_scrub_directory_check_freesp(
> 
> No need for inline here, the compiler will do that automatically if
> appropriate.

Ok.  I'll make it STATIC like everything else here.

> > +	struct xfs_scrub_context	*sc,
> > +	xfs_dablk_t			lblk,
> > +	struct xfs_buf			*dbp,
> > +	unsigned int			len)
> > +{
> > +	struct xfs_dir2_data_free	*bf;
> > +	struct xfs_dir2_data_free	*dfp;
> > +	int				offset;
> > +
> > +	if (len == 0)
> > +		return;
> > +
> > +	bf = sc->ip->d_ops->data_bestfree_p(dbp->b_addr);
> > +	for (dfp = &bf[0]; dfp < &bf[XFS_DIR2_DATA_FD_COUNT]; dfp++) {
> > +		offset = be16_to_cpu(dfp->offset);
> > +		if (offset == 0)
> > +			break;
> > +		if (len == be16_to_cpu(dfp->length))
> > +			return;
> > +		/* Didn't find the best length in the bestfree data */
> > +		break;
> > +	}
> > +
> > +	xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk);
> > +}
> > +
> > +/* Check free space info in a directory leaf1 block. */
> > +STATIC int
> > +xfs_scrub_directory_leaf1_bestfree(
> > +	struct xfs_scrub_context	*sc,
> > +	struct xfs_da_args		*args,
> > +	xfs_dablk_t			lblk)
> > +{
> > +	struct xfs_dir2_leaf_tail	*ltp;
> > +	struct xfs_buf			*dbp;
> > +	struct xfs_buf			*bp;
> > +	struct xfs_mount		*mp = sc->mp;
> > +	__be16				*bestp;
> > +	__u16				best;
> > +	int				i;
> > +	int				error;
> > +
> > +	/*
> > +	 * Read the free space block.  The verifier will check for hash
> > +	 * value ordering problems and check the stale entry count.
> > +	 */
> > +	error = xfs_dir3_leaf_read(sc->tp, sc->ip, lblk, -1, &bp);
> > +	if (!xfs_scrub_fblock_process_error(sc, XFS_DATA_FORK, lblk, &error))
> > +		goto out;
> > +
> > +	/* Check all the entries. */
> > +	ltp = xfs_dir2_leaf_tail_p(mp->m_dir_geo, bp->b_addr);
> > +	bestp = xfs_dir2_leaf_bests_p(ltp);
> > +	for (i = 0; i < be32_to_cpu(ltp->bestcount); i++, bestp++) {
> > +		best = be16_to_cpu(*bestp);
> > +		if (best == NULLDATAOFF)
> > +			continue;
> 
> Count stale entries, check if matches hdr->stale ?

This should already be done by xfs_dir3_leaf_read ->
xfs_dir3_leaf1_read_verify -> __read_verify -> xfs_dir3_leaf_verify ->
xfs_dir3_leaf_check_int, right?

> 
> > +		error = xfs_dir3_data_read(sc->tp, sc->ip,
> > +				i * args->geo->fsbcount, -1, &dbp);
> > +		if (!xfs_scrub_fblock_process_error(sc, XFS_DATA_FORK, lblk,
> > +				&error))
> > +			continue;
> > +		xfs_scrub_directory_check_freesp(sc, lblk, dbp, best);
> > +		xfs_trans_brelse(sc->tp, dbp);
> > +	}
> > +out:
> > +	return error;
> > +}
> > +
> > +/* Check free space info in a directory freespace block. */
> > +STATIC int
> > +xfs_scrub_directory_free_bestfree(
> > +	struct xfs_scrub_context	*sc,
> > +	struct xfs_da_args		*args,
> > +	xfs_dablk_t			lblk)
> > +{
> > +	struct xfs_dir3_icfree_hdr	freehdr;
> > +	struct xfs_buf			*dbp;
> > +	struct xfs_buf			*bp;
> > +	__be16				*bestp;
> > +	__be16				best;
> > +	int				i;
> > +	int				error;
> > +
> > +	/* Read the free space block */
> > +	error = xfs_dir2_free_read(sc->tp, sc->ip, lblk, &bp);
> > +	if (!xfs_scrub_fblock_process_error(sc, XFS_DATA_FORK, lblk, &error))
> > +		goto out;
> > +
> > +	/* Check all the entries. */
> > +	sc->ip->d_ops->free_hdr_from_disk(&freehdr, bp->b_addr);
> > +	bestp = sc->ip->d_ops->free_bests_p(bp->b_addr);
> > +	for (i = 0; i < freehdr.nvalid; i++, bestp++) {
> > +		best = be16_to_cpu(*bestp);
> > +		if (best == NULLDATAOFF)
> > +			continue;
> 
> Count stale entries, check freehdr.nvalid + stale = freehdr.nused?

Aha, yes, that needs to be checked.

Also that for loop needs to be terminated on i < freehdr.nused.

--D

> Cheers,
> 
> Dave.
> -- 
> Dave Chinner
> david@fromorbit.com
> --
> To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Darrick J. Wong Oct. 16, 2017, 11:11 p.m. UTC | #3
On Mon, Oct 16, 2017 at 03:37:08PM -0700, Darrick J. Wong wrote:
> On Mon, Oct 16, 2017 at 03:49:21PM +1100, Dave Chinner wrote:
> > On Wed, Oct 11, 2017 at 06:43:26PM -0700, Darrick J. Wong wrote:
> > > From: Darrick J. Wong <darrick.wong@oracle.com>
> > > 
> > > Check the free space information in a directory.
> > 
> > ....
> > 
> > > diff --git a/fs/xfs/scrub/dir.c b/fs/xfs/scrub/dir.c
> > > index e2a8f90..a41310f 100644
> > > --- a/fs/xfs/scrub/dir.c
> > > +++ b/fs/xfs/scrub/dir.c
> > > @@ -250,6 +250,426 @@ xfs_scrub_dir_rec(
> > >  	return error;
> > >  }
> > >  
> > > +/*
> > > + * Is this unused entry either in the bestfree or smaller than all of them?
> > > + * We assume the bestfrees are sorted longest to shortest, and that there
> > > + * aren't any bogus entries.
> > 
> > s/We assume/We've already checked/
> 
> Ok.
> 
> > > + */
> > > +static inline void
> > > +xfs_scrub_directory_check_free_entry(
> > > +	struct xfs_scrub_context	*sc,
> > > +	xfs_dablk_t			lblk,
> > > +	struct xfs_dir2_data_free	*bf,
> > > +	struct xfs_dir2_data_unused	*dup)
> > 
> > ....
> > 
> > > +	while (ptr < endptr) {
> > > +		dup = (struct xfs_dir2_data_unused *)ptr;
> > > +		/* Skip real entries */
> > > +		if (dup->freetag != cpu_to_be16(XFS_DIR2_DATA_FREE_TAG)) {
> > > +			struct xfs_dir2_data_entry	*dep;
> > > +
> > > +			dep = (struct xfs_dir2_data_entry *)ptr;
> > > +			newlen = d_ops->data_entsize(dep->namelen);
> > > +			if (newlen <= 0) {
> > > +				xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK,
> > > +						lblk);
> > > +				goto out_buf;
> > > +			}
> > > +			ptr += newlen;
> > > +			if (endptr < ptr)
> > > +				xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK,
> > > +					      lblk);
> > > +			continue;
> > > +		}
> > > +
> > > +		/* Spot check this free entry */
> > > +		tag = be16_to_cpu(*xfs_dir2_data_unused_tag_p(dup));
> > > +		if (tag != ((char *)dup - (char *)bp->b_addr))
> > > +			xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk);
> > > +
> > > +		/*
> > > +		 * Either this entry is a bestfree or it's smaller than
> > > +		 * any of the bestfrees.
> > > +		 */
> > > +		xfs_scrub_directory_check_free_entry(sc, lblk, bf, dup);
> > > +
> > > +		/* Move on. */
> > > +		newlen = be16_to_cpu(dup->length);
> > > +		if (newlen <= 0) {
> > > +			xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk);
> > > +			goto out_buf;
> > > +		}
> > > +		ptr += newlen;
> > > +		if (endptr < ptr)
> > > +			xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk);
> > 
> > I'd prefer this matches the loop logic order. ie.
> > 
> > 		if (ptr >= endptr)
> > 
> 
> Ok.  That check can be lifted out of the loop anyway.
> 
> > > +		else
> > > +			nr_frees++;
> > > +	}
> > > +
> > > +	/* Did we see at least as many free slots as there are bestfrees? */
> > > +	if (nr_frees < nr_bestfrees)
> > > +		xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk);
> > > +out_buf:
> > > +	xfs_trans_brelse(sc->tp, bp);
> > > +out:
> > > +	return error;
> > > +}
> > > +
> > > +/*
> > > + * Does the free space length in the free space index block ($len) match
> > > + * the longest length in the directory data block's bestfree array?
> > > + * Assume that we've already checked that the data block's bestfree
> > > + * array is in order.
> > > + */
> > > +static inline void
> > > +xfs_scrub_directory_check_freesp(
> > 
> > No need for inline here, the compiler will do that automatically if
> > appropriate.
> 
> Ok.  I'll make it STATIC like everything else here.
> 
> > > +	struct xfs_scrub_context	*sc,
> > > +	xfs_dablk_t			lblk,
> > > +	struct xfs_buf			*dbp,
> > > +	unsigned int			len)
> > > +{
> > > +	struct xfs_dir2_data_free	*bf;
> > > +	struct xfs_dir2_data_free	*dfp;
> > > +	int				offset;
> > > +
> > > +	if (len == 0)
> > > +		return;
> > > +
> > > +	bf = sc->ip->d_ops->data_bestfree_p(dbp->b_addr);
> > > +	for (dfp = &bf[0]; dfp < &bf[XFS_DIR2_DATA_FD_COUNT]; dfp++) {
> > > +		offset = be16_to_cpu(dfp->offset);
> > > +		if (offset == 0)
> > > +			break;
> > > +		if (len == be16_to_cpu(dfp->length))
> > > +			return;
> > > +		/* Didn't find the best length in the bestfree data */
> > > +		break;
> > > +	}
> > > +
> > > +	xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk);
> > > +}
> > > +
> > > +/* Check free space info in a directory leaf1 block. */
> > > +STATIC int
> > > +xfs_scrub_directory_leaf1_bestfree(
> > > +	struct xfs_scrub_context	*sc,
> > > +	struct xfs_da_args		*args,
> > > +	xfs_dablk_t			lblk)
> > > +{
> > > +	struct xfs_dir2_leaf_tail	*ltp;
> > > +	struct xfs_buf			*dbp;
> > > +	struct xfs_buf			*bp;
> > > +	struct xfs_mount		*mp = sc->mp;
> > > +	__be16				*bestp;
> > > +	__u16				best;
> > > +	int				i;
> > > +	int				error;
> > > +
> > > +	/*
> > > +	 * Read the free space block.  The verifier will check for hash
> > > +	 * value ordering problems and check the stale entry count.
> > > +	 */
> > > +	error = xfs_dir3_leaf_read(sc->tp, sc->ip, lblk, -1, &bp);
> > > +	if (!xfs_scrub_fblock_process_error(sc, XFS_DATA_FORK, lblk, &error))
> > > +		goto out;
> > > +
> > > +	/* Check all the entries. */
> > > +	ltp = xfs_dir2_leaf_tail_p(mp->m_dir_geo, bp->b_addr);
> > > +	bestp = xfs_dir2_leaf_bests_p(ltp);
> > > +	for (i = 0; i < be32_to_cpu(ltp->bestcount); i++, bestp++) {
> > > +		best = be16_to_cpu(*bestp);
> > > +		if (best == NULLDATAOFF)
> > > +			continue;
> > 
> > Count stale entries, check if matches hdr->stale ?
> 
> This should already be done by xfs_dir3_leaf_read ->
> xfs_dir3_leaf1_read_verify -> __read_verify -> xfs_dir3_leaf_verify ->
> xfs_dir3_leaf_check_int, right?
> 
> > 
> > > +		error = xfs_dir3_data_read(sc->tp, sc->ip,
> > > +				i * args->geo->fsbcount, -1, &dbp);
> > > +		if (!xfs_scrub_fblock_process_error(sc, XFS_DATA_FORK, lblk,
> > > +				&error))
> > > +			continue;
> > > +		xfs_scrub_directory_check_freesp(sc, lblk, dbp, best);
> > > +		xfs_trans_brelse(sc->tp, dbp);
> > > +	}
> > > +out:
> > > +	return error;
> > > +}
> > > +
> > > +/* Check free space info in a directory freespace block. */
> > > +STATIC int
> > > +xfs_scrub_directory_free_bestfree(
> > > +	struct xfs_scrub_context	*sc,
> > > +	struct xfs_da_args		*args,
> > > +	xfs_dablk_t			lblk)
> > > +{
> > > +	struct xfs_dir3_icfree_hdr	freehdr;
> > > +	struct xfs_buf			*dbp;
> > > +	struct xfs_buf			*bp;
> > > +	__be16				*bestp;
> > > +	__be16				best;
> > > +	int				i;
> > > +	int				error;
> > > +
> > > +	/* Read the free space block */
> > > +	error = xfs_dir2_free_read(sc->tp, sc->ip, lblk, &bp);
> > > +	if (!xfs_scrub_fblock_process_error(sc, XFS_DATA_FORK, lblk, &error))
> > > +		goto out;
> > > +
> > > +	/* Check all the entries. */
> > > +	sc->ip->d_ops->free_hdr_from_disk(&freehdr, bp->b_addr);
> > > +	bestp = sc->ip->d_ops->free_bests_p(bp->b_addr);
> > > +	for (i = 0; i < freehdr.nvalid; i++, bestp++) {
> > > +		best = be16_to_cpu(*bestp);
> > > +		if (best == NULLDATAOFF)
> > > +			continue;
> > 
> > Count stale entries, check freehdr.nvalid + stale = freehdr.nused?
> 
> Aha, yes, that needs to be checked.
> 
> Also that for loop needs to be terminated on i < freehdr.nused.

(Er... NAK on that last sentence; it's the documentation that are wrong.)

--D

> 
> --D
> 
> > Cheers,
> > 
> > Dave.
> > -- 
> > Dave Chinner
> > david@fromorbit.com
> > --
> > To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
> > the body of a message to majordomo@vger.kernel.org
> > More majordomo info at  http://vger.kernel.org/majordomo-info.html
> --
> To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Dave Chinner Oct. 16, 2017, 11:14 p.m. UTC | #4
On Mon, Oct 16, 2017 at 03:37:08PM -0700, Darrick J. Wong wrote:
> On Mon, Oct 16, 2017 at 03:49:21PM +1100, Dave Chinner wrote:
> > On Wed, Oct 11, 2017 at 06:43:26PM -0700, Darrick J. Wong wrote:
> > > From: Darrick J. Wong <darrick.wong@oracle.com>
> > > 
> > > Check the free space information in a directory.
> > 
> > ....
> > 
> > > +/* Check free space info in a directory leaf1 block. */
> > > +STATIC int
> > > +xfs_scrub_directory_leaf1_bestfree(
> > > +	struct xfs_scrub_context	*sc,
> > > +	struct xfs_da_args		*args,
> > > +	xfs_dablk_t			lblk)
> > > +{
> > > +	struct xfs_dir2_leaf_tail	*ltp;
> > > +	struct xfs_buf			*dbp;
> > > +	struct xfs_buf			*bp;
> > > +	struct xfs_mount		*mp = sc->mp;
> > > +	__be16				*bestp;
> > > +	__u16				best;
> > > +	int				i;
> > > +	int				error;
> > > +
> > > +	/*
> > > +	 * Read the free space block.  The verifier will check for hash
> > > +	 * value ordering problems and check the stale entry count.
> > > +	 */
> > > +	error = xfs_dir3_leaf_read(sc->tp, sc->ip, lblk, -1, &bp);
> > > +	if (!xfs_scrub_fblock_process_error(sc, XFS_DATA_FORK, lblk, &error))
> > > +		goto out;
> > > +
> > > +	/* Check all the entries. */
> > > +	ltp = xfs_dir2_leaf_tail_p(mp->m_dir_geo, bp->b_addr);
> > > +	bestp = xfs_dir2_leaf_bests_p(ltp);
> > > +	for (i = 0; i < be32_to_cpu(ltp->bestcount); i++, bestp++) {
> > > +		best = be16_to_cpu(*bestp);
> > > +		if (best == NULLDATAOFF)
> > > +			continue;
> > 
> > Count stale entries, check if matches hdr->stale ?
> 
> This should already be done by xfs_dir3_leaf_read ->
> xfs_dir3_leaf1_read_verify -> __read_verify -> xfs_dir3_leaf_verify ->
> xfs_dir3_leaf_check_int, right?

True. However, it's simple to do and we're already iterating over
all the structures necessary and detecting the case necessary to
check it, so it doesn't hurt and might catch in-core corruptions
before they hit the write verifier?

And it makes it do the same checks as the free_bestfree checks
below....

> > > +		if (!xfs_scrub_fblock_process_error(sc, XFS_DATA_FORK, lblk,
> > > +				&error))
> > > +			continue;
> > > +		xfs_scrub_directory_check_freesp(sc, lblk, dbp, best);
> > > +		xfs_trans_brelse(sc->tp, dbp);
> > > +	}
> > > +out:
> > > +	return error;
> > > +}
> > > +
> > > +/* Check free space info in a directory freespace block. */
> > > +STATIC int
> > > +xfs_scrub_directory_free_bestfree(
> > > +	struct xfs_scrub_context	*sc,
> > > +	struct xfs_da_args		*args,
> > > +	xfs_dablk_t			lblk)
> > > +{
> > > +	struct xfs_dir3_icfree_hdr	freehdr;
> > > +	struct xfs_buf			*dbp;
> > > +	struct xfs_buf			*bp;
> > > +	__be16				*bestp;
> > > +	__be16				best;
> > > +	int				i;
> > > +	int				error;
> > > +
> > > +	/* Read the free space block */
> > > +	error = xfs_dir2_free_read(sc->tp, sc->ip, lblk, &bp);
> > > +	if (!xfs_scrub_fblock_process_error(sc, XFS_DATA_FORK, lblk, &error))
> > > +		goto out;
> > > +
> > > +	/* Check all the entries. */
> > > +	sc->ip->d_ops->free_hdr_from_disk(&freehdr, bp->b_addr);
> > > +	bestp = sc->ip->d_ops->free_bests_p(bp->b_addr);
> > > +	for (i = 0; i < freehdr.nvalid; i++, bestp++) {
> > > +		best = be16_to_cpu(*bestp);
> > > +		if (best == NULLDATAOFF)
> > > +			continue;
> > 
> > Count stale entries, check freehdr.nvalid + stale = freehdr.nused?
> 
> Aha, yes, that needs to be checked.
> 
> Also that for loop needs to be terminated on i < freehdr.nused.

Good catch - I missed that, too :P

Cheers,

Dave.
Darrick J. Wong Oct. 16, 2017, 11:38 p.m. UTC | #5
On Tue, Oct 17, 2017 at 10:14:13AM +1100, Dave Chinner wrote:
> On Mon, Oct 16, 2017 at 03:37:08PM -0700, Darrick J. Wong wrote:
> > On Mon, Oct 16, 2017 at 03:49:21PM +1100, Dave Chinner wrote:
> > > On Wed, Oct 11, 2017 at 06:43:26PM -0700, Darrick J. Wong wrote:
> > > > From: Darrick J. Wong <darrick.wong@oracle.com>
> > > > 
> > > > Check the free space information in a directory.
> > > 
> > > ....
> > > 
> > > > +/* Check free space info in a directory leaf1 block. */
> > > > +STATIC int
> > > > +xfs_scrub_directory_leaf1_bestfree(
> > > > +	struct xfs_scrub_context	*sc,
> > > > +	struct xfs_da_args		*args,
> > > > +	xfs_dablk_t			lblk)
> > > > +{
> > > > +	struct xfs_dir2_leaf_tail	*ltp;
> > > > +	struct xfs_buf			*dbp;
> > > > +	struct xfs_buf			*bp;
> > > > +	struct xfs_mount		*mp = sc->mp;
> > > > +	__be16				*bestp;
> > > > +	__u16				best;
> > > > +	int				i;
> > > > +	int				error;
> > > > +
> > > > +	/*
> > > > +	 * Read the free space block.  The verifier will check for hash
> > > > +	 * value ordering problems and check the stale entry count.
> > > > +	 */
> > > > +	error = xfs_dir3_leaf_read(sc->tp, sc->ip, lblk, -1, &bp);
> > > > +	if (!xfs_scrub_fblock_process_error(sc, XFS_DATA_FORK, lblk, &error))
> > > > +		goto out;
> > > > +
> > > > +	/* Check all the entries. */
> > > > +	ltp = xfs_dir2_leaf_tail_p(mp->m_dir_geo, bp->b_addr);
> > > > +	bestp = xfs_dir2_leaf_bests_p(ltp);
> > > > +	for (i = 0; i < be32_to_cpu(ltp->bestcount); i++, bestp++) {
> > > > +		best = be16_to_cpu(*bestp);
> > > > +		if (best == NULLDATAOFF)
> > > > +			continue;
> > > 
> > > Count stale entries, check if matches hdr->stale ?
> > 
> > This should already be done by xfs_dir3_leaf_read ->
> > xfs_dir3_leaf1_read_verify -> __read_verify -> xfs_dir3_leaf_verify ->
> > xfs_dir3_leaf_check_int, right?
> 
> True. However, it's simple to do and we're already iterating over
> all the structures necessary and detecting the case necessary to
> check it, so it doesn't hurt and might catch in-core corruptions
> before they hit the write verifier?

Yes, though the verifier rework series will (in addition to printing
instruction pointer addresses of the failing verifier checks) expose the
structure verification code via a new b_ops function pointer, and then
enhances scrub to call it.

(That said, from a completeness standpoint I don't mind duplicating the
code...)

> And it makes it do the same checks as the free_bestfree checks
> below....
> 
> > > > +		if (!xfs_scrub_fblock_process_error(sc, XFS_DATA_FORK, lblk,
> > > > +				&error))
> > > > +			continue;
> > > > +		xfs_scrub_directory_check_freesp(sc, lblk, dbp, best);
> > > > +		xfs_trans_brelse(sc->tp, dbp);
> > > > +	}
> > > > +out:
> > > > +	return error;
> > > > +}
> > > > +
> > > > +/* Check free space info in a directory freespace block. */
> > > > +STATIC int
> > > > +xfs_scrub_directory_free_bestfree(
> > > > +	struct xfs_scrub_context	*sc,
> > > > +	struct xfs_da_args		*args,
> > > > +	xfs_dablk_t			lblk)
> > > > +{
> > > > +	struct xfs_dir3_icfree_hdr	freehdr;
> > > > +	struct xfs_buf			*dbp;
> > > > +	struct xfs_buf			*bp;
> > > > +	__be16				*bestp;
> > > > +	__be16				best;
> > > > +	int				i;
> > > > +	int				error;
> > > > +
> > > > +	/* Read the free space block */
> > > > +	error = xfs_dir2_free_read(sc->tp, sc->ip, lblk, &bp);
> > > > +	if (!xfs_scrub_fblock_process_error(sc, XFS_DATA_FORK, lblk, &error))
> > > > +		goto out;
> > > > +
> > > > +	/* Check all the entries. */
> > > > +	sc->ip->d_ops->free_hdr_from_disk(&freehdr, bp->b_addr);
> > > > +	bestp = sc->ip->d_ops->free_bests_p(bp->b_addr);
> > > > +	for (i = 0; i < freehdr.nvalid; i++, bestp++) {
> > > > +		best = be16_to_cpu(*bestp);
> > > > +		if (best == NULLDATAOFF)
> > > > +			continue;
> > > 
> > > Count stale entries, check freehdr.nvalid + stale = freehdr.nused?
> > 
> > Aha, yes, that needs to be checked.
> > 
> > Also that for loop needs to be terminated on i < freehdr.nused.
> 
> Good catch - I missed that, too :P

Well.... the documentation says that nused is the number of entries that
have been filled out and nvalid is the number of entries that aren't
0xFFFF, but....

fhdr.firstdb = 0
fhdr.nvalid = 11
fhdr.nused = 9
fbests[0-10] = 0:0x60 1:0x8 3:0x10 4:0xffff 5:0x10 6:0x8 7:0x10 8:0xffff
9:0x180 10:0xe10

So the documentation is wrong w.r.t. whatever libxfs writes to disk. :)

"The freeindex’s hdr.nvalid should always be the same as the number of
allocated data directory blocks containing name/inode data and will
always be less than or equal to hdr.nused. The value of hdr.nused should
be the same as the index of the last data directory block plus one (i.e.
when the last data block is freed, nused and nvalid are decremented)."

--D

> 
> Cheers,
> 
> Dave.
> -- 
> Dave Chinner
> david@fromorbit.com
> --
> To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/fs/xfs/scrub/dir.c b/fs/xfs/scrub/dir.c
index e2a8f90..a41310f 100644
--- a/fs/xfs/scrub/dir.c
+++ b/fs/xfs/scrub/dir.c
@@ -250,6 +250,426 @@  xfs_scrub_dir_rec(
 	return error;
 }
 
+/*
+ * Is this unused entry either in the bestfree or smaller than all of them?
+ * We assume the bestfrees are sorted longest to shortest, and that there
+ * aren't any bogus entries.
+ */
+static inline void
+xfs_scrub_directory_check_free_entry(
+	struct xfs_scrub_context	*sc,
+	xfs_dablk_t			lblk,
+	struct xfs_dir2_data_free	*bf,
+	struct xfs_dir2_data_unused	*dup)
+{
+	struct xfs_dir2_data_free	*dfp;
+	unsigned int			dup_length;
+
+	dup_length = be16_to_cpu(dup->length);
+
+	/* Unused entry is shorter than any of the bestfrees */
+	if (dup_length < be16_to_cpu(bf[XFS_DIR2_DATA_FD_COUNT - 1].length))
+		return;
+
+	for (dfp = &bf[XFS_DIR2_DATA_FD_COUNT - 1]; dfp >= bf; dfp--)
+		if (dup_length == be16_to_cpu(dfp->length))
+			return;
+
+	/* Unused entry should be in the bestfrees but wasn't found. */
+	xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk);
+}
+
+/* Check free space info in a directory data block. */
+STATIC int
+xfs_scrub_directory_data_bestfree(
+	struct xfs_scrub_context	*sc,
+	xfs_dablk_t			lblk,
+	bool				is_block)
+{
+	struct xfs_dir2_data_unused	*dup;
+	struct xfs_dir2_data_free	*dfp;
+	struct xfs_buf			*bp;
+	struct xfs_dir2_data_free	*bf;
+	struct xfs_mount		*mp = sc->mp;
+	const struct xfs_dir_ops	*d_ops;
+	char				*ptr;
+	char				*endptr;
+	u16				tag;
+	unsigned int			nr_bestfrees = 0;
+	unsigned int			nr_frees = 0;
+	unsigned int			smallest_bestfree;
+	int				newlen;
+	int				offset;
+	int				error;
+
+	d_ops = sc->ip->d_ops;
+
+	if (is_block) {
+		/* dir block format */
+		if (lblk != XFS_B_TO_FSBT(mp, XFS_DIR2_DATA_OFFSET))
+			xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk);
+		error = xfs_dir3_block_read(sc->tp, sc->ip, &bp);
+	} else {
+		/* dir data format */
+		error = xfs_dir3_data_read(sc->tp, sc->ip, lblk, -1, &bp);
+	}
+	if (!xfs_scrub_fblock_process_error(sc, XFS_DATA_FORK, lblk, &error))
+		goto out;
+
+	/* Do the bestfrees correspond to actual free space? */
+	bf = d_ops->data_bestfree_p(bp->b_addr);
+	smallest_bestfree = UINT_MAX;
+	for (dfp = &bf[0]; dfp < &bf[XFS_DIR2_DATA_FD_COUNT]; dfp++) {
+		offset = be16_to_cpu(dfp->offset);
+		if (offset == 0)
+			continue;
+		if (offset >= mp->m_dir_geo->blksize) {
+			xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk);
+			goto out_buf;
+		}
+		dup = (struct xfs_dir2_data_unused *)(bp->b_addr + offset);
+		tag = be16_to_cpu(*xfs_dir2_data_unused_tag_p(dup));
+
+		/* bestfree doesn't match the entry it points at? */
+		if (dup->freetag != cpu_to_be16(XFS_DIR2_DATA_FREE_TAG) ||
+		    be16_to_cpu(dup->length) != be16_to_cpu(dfp->length) ||
+		    tag != ((char *)dup - (char *)bp->b_addr)) {
+			xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk);
+			goto out_buf;
+		}
+
+		/* bestfree records should be ordered largest to smallest */
+		if (smallest_bestfree < be16_to_cpu(dfp->length)) {
+			xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk);
+			goto out_buf;
+		}
+
+		smallest_bestfree = be16_to_cpu(dfp->length);
+		nr_bestfrees++;
+	}
+
+	/* Make sure the bestfrees are actually the best free spaces. */
+	ptr = (char *)d_ops->data_entry_p(bp->b_addr);
+	if (is_block) {
+		struct xfs_dir2_block_tail	*btp;
+
+		btp = xfs_dir2_block_tail_p(mp->m_dir_geo, bp->b_addr);
+		endptr = (char *)xfs_dir2_block_leaf_p(btp);
+	} else
+		endptr = (char *)bp->b_addr + BBTOB(bp->b_length);
+	while (ptr < endptr) {
+		dup = (struct xfs_dir2_data_unused *)ptr;
+		/* Skip real entries */
+		if (dup->freetag != cpu_to_be16(XFS_DIR2_DATA_FREE_TAG)) {
+			struct xfs_dir2_data_entry	*dep;
+
+			dep = (struct xfs_dir2_data_entry *)ptr;
+			newlen = d_ops->data_entsize(dep->namelen);
+			if (newlen <= 0) {
+				xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK,
+						lblk);
+				goto out_buf;
+			}
+			ptr += newlen;
+			if (endptr < ptr)
+				xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK,
+					      lblk);
+			continue;
+		}
+
+		/* Spot check this free entry */
+		tag = be16_to_cpu(*xfs_dir2_data_unused_tag_p(dup));
+		if (tag != ((char *)dup - (char *)bp->b_addr))
+			xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk);
+
+		/*
+		 * Either this entry is a bestfree or it's smaller than
+		 * any of the bestfrees.
+		 */
+		xfs_scrub_directory_check_free_entry(sc, lblk, bf, dup);
+
+		/* Move on. */
+		newlen = be16_to_cpu(dup->length);
+		if (newlen <= 0) {
+			xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk);
+			goto out_buf;
+		}
+		ptr += newlen;
+		if (endptr < ptr)
+			xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk);
+		else
+			nr_frees++;
+	}
+
+	/* Did we see at least as many free slots as there are bestfrees? */
+	if (nr_frees < nr_bestfrees)
+		xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk);
+out_buf:
+	xfs_trans_brelse(sc->tp, bp);
+out:
+	return error;
+}
+
+/*
+ * Does the free space length in the free space index block ($len) match
+ * the longest length in the directory data block's bestfree array?
+ * Assume that we've already checked that the data block's bestfree
+ * array is in order.
+ */
+static inline void
+xfs_scrub_directory_check_freesp(
+	struct xfs_scrub_context	*sc,
+	xfs_dablk_t			lblk,
+	struct xfs_buf			*dbp,
+	unsigned int			len)
+{
+	struct xfs_dir2_data_free	*bf;
+	struct xfs_dir2_data_free	*dfp;
+	int				offset;
+
+	if (len == 0)
+		return;
+
+	bf = sc->ip->d_ops->data_bestfree_p(dbp->b_addr);
+	for (dfp = &bf[0]; dfp < &bf[XFS_DIR2_DATA_FD_COUNT]; dfp++) {
+		offset = be16_to_cpu(dfp->offset);
+		if (offset == 0)
+			break;
+		if (len == be16_to_cpu(dfp->length))
+			return;
+		/* Didn't find the best length in the bestfree data */
+		break;
+	}
+
+	xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk);
+}
+
+/* Check free space info in a directory leaf1 block. */
+STATIC int
+xfs_scrub_directory_leaf1_bestfree(
+	struct xfs_scrub_context	*sc,
+	struct xfs_da_args		*args,
+	xfs_dablk_t			lblk)
+{
+	struct xfs_dir2_leaf_tail	*ltp;
+	struct xfs_buf			*dbp;
+	struct xfs_buf			*bp;
+	struct xfs_mount		*mp = sc->mp;
+	__be16				*bestp;
+	__u16				best;
+	int				i;
+	int				error;
+
+	/*
+	 * Read the free space block.  The verifier will check for hash
+	 * value ordering problems and check the stale entry count.
+	 */
+	error = xfs_dir3_leaf_read(sc->tp, sc->ip, lblk, -1, &bp);
+	if (!xfs_scrub_fblock_process_error(sc, XFS_DATA_FORK, lblk, &error))
+		goto out;
+
+	/* Check all the entries. */
+	ltp = xfs_dir2_leaf_tail_p(mp->m_dir_geo, bp->b_addr);
+	bestp = xfs_dir2_leaf_bests_p(ltp);
+	for (i = 0; i < be32_to_cpu(ltp->bestcount); i++, bestp++) {
+		best = be16_to_cpu(*bestp);
+		if (best == NULLDATAOFF)
+			continue;
+		error = xfs_dir3_data_read(sc->tp, sc->ip,
+				i * args->geo->fsbcount, -1, &dbp);
+		if (!xfs_scrub_fblock_process_error(sc, XFS_DATA_FORK, lblk,
+				&error))
+			continue;
+		xfs_scrub_directory_check_freesp(sc, lblk, dbp, best);
+		xfs_trans_brelse(sc->tp, dbp);
+	}
+out:
+	return error;
+}
+
+/* Check free space info in a directory freespace block. */
+STATIC int
+xfs_scrub_directory_free_bestfree(
+	struct xfs_scrub_context	*sc,
+	struct xfs_da_args		*args,
+	xfs_dablk_t			lblk)
+{
+	struct xfs_dir3_icfree_hdr	freehdr;
+	struct xfs_buf			*dbp;
+	struct xfs_buf			*bp;
+	__be16				*bestp;
+	__be16				best;
+	int				i;
+	int				error;
+
+	/* Read the free space block */
+	error = xfs_dir2_free_read(sc->tp, sc->ip, lblk, &bp);
+	if (!xfs_scrub_fblock_process_error(sc, XFS_DATA_FORK, lblk, &error))
+		goto out;
+
+	/* Check all the entries. */
+	sc->ip->d_ops->free_hdr_from_disk(&freehdr, bp->b_addr);
+	bestp = sc->ip->d_ops->free_bests_p(bp->b_addr);
+	for (i = 0; i < freehdr.nvalid; i++, bestp++) {
+		best = be16_to_cpu(*bestp);
+		if (best == NULLDATAOFF)
+			continue;
+		error = xfs_dir3_data_read(sc->tp, sc->ip,
+				(freehdr.firstdb + i) * args->geo->fsbcount,
+				-1, &dbp);
+		if (!xfs_scrub_fblock_process_error(sc, XFS_DATA_FORK, lblk,
+				&error))
+			continue;
+		xfs_scrub_directory_check_freesp(sc, lblk, dbp, best);
+		xfs_trans_brelse(sc->tp, dbp);
+	}
+out:
+	return error;
+}
+
+/* Check free space information in directories. */
+STATIC int
+xfs_scrub_directory_blocks(
+	struct xfs_scrub_context	*sc)
+{
+	struct xfs_bmbt_irec		got;
+	struct xfs_da_args		args;
+	struct xfs_ifork		*ifp;
+	struct xfs_mount		*mp = sc->mp;
+	xfs_fileoff_t			leaf_lblk;
+	xfs_fileoff_t			free_lblk;
+	xfs_fileoff_t			lblk;
+	xfs_extnum_t			idx;
+	bool				found;
+	int				is_block = 0;
+	int				error;
+
+	/* Ignore local format directories. */
+	if (sc->ip->i_d.di_format != XFS_DINODE_FMT_EXTENTS &&
+	    sc->ip->i_d.di_format != XFS_DINODE_FMT_BTREE)
+		return 0;
+
+	ifp = XFS_IFORK_PTR(sc->ip, XFS_DATA_FORK);
+	lblk = XFS_B_TO_FSB(mp, XFS_DIR2_DATA_OFFSET);
+	leaf_lblk = XFS_B_TO_FSB(mp, XFS_DIR2_LEAF_OFFSET);
+	free_lblk = XFS_B_TO_FSB(mp, XFS_DIR2_FREE_OFFSET);
+
+	/* Is this a block dir? */
+	args.dp = sc->ip;
+	args.geo = mp->m_dir_geo;
+	args.trans = sc->tp;
+	error = xfs_dir2_isblock(&args, &is_block);
+	if (!xfs_scrub_fblock_process_error(sc, XFS_DATA_FORK, lblk, &error))
+		goto out;
+
+	/* Iterate all the data extents in the directory... */
+	found = xfs_iext_lookup_extent(sc->ip, ifp, lblk, &idx, &got);
+	while (found) {
+		/* Block directories only have a single block at offset 0. */
+		if (is_block &&
+		    (got.br_startoff > 0 ||
+		     got.br_blockcount != args.geo->fsbcount)) {
+			xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK,
+					got.br_startoff);
+			break;
+		}
+
+		/* No more data blocks... */
+		if (got.br_startoff >= leaf_lblk)
+			break;
+
+		/*
+		 * Check each data block's bestfree data.
+		 *
+		 * Iterate all the fsbcount-aligned block offsets in
+		 * this directory.  The directory block reading code is
+		 * smart enough to do its own bmap lookups to handle
+		 * discontiguous directory blocks.  When we're done
+		 * with the extent record, re-query the bmap at the
+		 * next fsbcount-aligned offset to avoid redundant
+		 * block checks.
+		 */
+		for (lblk = roundup((xfs_dablk_t)got.br_startoff,
+				args.geo->fsbcount);
+		     lblk < got.br_startoff + got.br_blockcount;
+		     lblk += args.geo->fsbcount) {
+			error = xfs_scrub_directory_data_bestfree(sc, lblk,
+					is_block);
+			if (error)
+				goto out;
+		}
+		lblk = roundup((xfs_dablk_t)got.br_startoff + got.br_blockcount,
+				args.geo->fsbcount);
+		found = xfs_iext_lookup_extent(sc->ip, ifp, lblk, &idx, &got);
+	}
+
+	if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
+		goto out;
+
+	/* Look for a leaf1 block, which has free info. */
+	if (xfs_iext_lookup_extent(sc->ip, ifp, leaf_lblk, &idx, &got) &&
+	    got.br_startoff == leaf_lblk &&
+	    got.br_blockcount == args.geo->fsbcount &&
+	    !xfs_iext_get_extent(ifp, ++idx, &got)) {
+		if (is_block) {
+			xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk);
+			goto out;
+		}
+		error = xfs_scrub_directory_leaf1_bestfree(sc, &args,
+				leaf_lblk);
+		if (error)
+			goto out;
+	}
+
+	if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
+		goto out;
+
+	/* Scan for free blocks */
+	lblk = free_lblk;
+	found = xfs_iext_lookup_extent(sc->ip, ifp, lblk, &idx, &got);
+	while (found) {
+		/*
+		 * Dirs can't have blocks mapped above 2^32.
+		 * Single-block dirs shouldn't even be here.
+		 */
+		lblk = got.br_startoff;
+		if (lblk & ~0xFFFFFFFFULL) {
+			xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk);
+			goto out;
+		}
+		if (is_block) {
+			xfs_scrub_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk);
+			goto out;
+		}
+
+		/*
+		 * Check each dir free block's bestfree data.
+		 *
+		 * Iterate all the fsbcount-aligned block offsets in
+		 * this directory.  The directory block reading code is
+		 * smart enough to do its own bmap lookups to handle
+		 * discontiguous directory blocks.  When we're done
+		 * with the extent record, re-query the bmap at the
+		 * next fsbcount-aligned offset to avoid redundant
+		 * block checks.
+		 */
+		for (lblk = roundup((xfs_dablk_t)got.br_startoff,
+				args.geo->fsbcount);
+		     lblk < got.br_startoff + got.br_blockcount;
+		     lblk += args.geo->fsbcount) {
+			error = xfs_scrub_directory_free_bestfree(sc, &args,
+					lblk);
+			if (error)
+				goto out;
+		}
+		lblk = roundup((xfs_dablk_t)got.br_startoff + got.br_blockcount,
+				args.geo->fsbcount);
+		found = xfs_iext_lookup_extent(sc->ip, ifp, lblk, &idx, &got);
+	}
+out:
+	return error;
+}
+
 /* Scrub a whole directory. */
 int
 xfs_scrub_directory(
@@ -278,6 +698,11 @@  xfs_scrub_directory(
 	if (error)
 		return error;
 
+	/* Check the freespace. */
+	error = xfs_scrub_directory_blocks(sc);
+	if (error)
+		return error;
+
 	/*
 	 * Check that every dirent we see can also be looked up by hash.
 	 * Userspace usually asks for a 32k buffer, so we will too.