1 | // SPDX-License-Identifier: GPL-2.0 |
2 | /* |
3 | * quota.c - CephFS quota |
4 | * |
5 | * Copyright (C) 2017-2018 SUSE |
6 | */ |
7 | |
8 | #include <linux/statfs.h> |
9 | |
10 | #include "super.h" |
11 | #include "mds_client.h" |
12 | |
13 | void ceph_adjust_quota_realms_count(struct inode *inode, bool inc) |
14 | { |
15 | struct ceph_mds_client *mdsc = ceph_sb_to_mdsc(sb: inode->i_sb); |
16 | if (inc) |
17 | atomic64_inc(v: &mdsc->quotarealms_count); |
18 | else |
19 | atomic64_dec(v: &mdsc->quotarealms_count); |
20 | } |
21 | |
22 | static inline bool ceph_has_realms_with_quotas(struct inode *inode) |
23 | { |
24 | struct super_block *sb = inode->i_sb; |
25 | struct ceph_mds_client *mdsc = ceph_sb_to_mdsc(sb); |
26 | struct inode *root = d_inode(dentry: sb->s_root); |
27 | |
28 | if (atomic64_read(v: &mdsc->quotarealms_count) > 0) |
29 | return true; |
30 | /* if root is the real CephFS root, we don't have quota realms */ |
31 | if (root && ceph_ino(inode: root) == CEPH_INO_ROOT) |
32 | return false; |
33 | /* MDS stray dirs have no quota realms */ |
34 | if (ceph_vino_is_reserved(vino: ceph_inode(inode)->i_vino)) |
35 | return false; |
36 | /* otherwise, we can't know for sure */ |
37 | return true; |
38 | } |
39 | |
40 | void ceph_handle_quota(struct ceph_mds_client *mdsc, |
41 | struct ceph_mds_session *session, |
42 | struct ceph_msg *msg) |
43 | { |
44 | struct super_block *sb = mdsc->fsc->sb; |
45 | struct ceph_mds_quota *h = msg->front.iov_base; |
46 | struct ceph_vino vino; |
47 | struct inode *inode; |
48 | struct ceph_inode_info *ci; |
49 | |
50 | if (!ceph_inc_mds_stopping_blocker(mdsc, session)) |
51 | return; |
52 | |
53 | if (msg->front.iov_len < sizeof(*h)) { |
54 | pr_err("%s corrupt message mds%d len %d\n" , __func__, |
55 | session->s_mds, (int)msg->front.iov_len); |
56 | ceph_msg_dump(msg); |
57 | goto out; |
58 | } |
59 | |
60 | /* lookup inode */ |
61 | vino.ino = le64_to_cpu(h->ino); |
62 | vino.snap = CEPH_NOSNAP; |
63 | inode = ceph_find_inode(sb, vino); |
64 | if (!inode) { |
65 | pr_warn("Failed to find inode %llu\n" , vino.ino); |
66 | goto out; |
67 | } |
68 | ci = ceph_inode(inode); |
69 | |
70 | spin_lock(lock: &ci->i_ceph_lock); |
71 | ci->i_rbytes = le64_to_cpu(h->rbytes); |
72 | ci->i_rfiles = le64_to_cpu(h->rfiles); |
73 | ci->i_rsubdirs = le64_to_cpu(h->rsubdirs); |
74 | __ceph_update_quota(ci, le64_to_cpu(h->max_bytes), |
75 | le64_to_cpu(h->max_files)); |
76 | spin_unlock(lock: &ci->i_ceph_lock); |
77 | |
78 | iput(inode); |
79 | out: |
80 | ceph_dec_mds_stopping_blocker(mdsc); |
81 | } |
82 | |
83 | static struct ceph_quotarealm_inode * |
84 | find_quotarealm_inode(struct ceph_mds_client *mdsc, u64 ino) |
85 | { |
86 | struct ceph_quotarealm_inode *qri = NULL; |
87 | struct rb_node **node, *parent = NULL; |
88 | |
89 | mutex_lock(&mdsc->quotarealms_inodes_mutex); |
90 | node = &(mdsc->quotarealms_inodes.rb_node); |
91 | while (*node) { |
92 | parent = *node; |
93 | qri = container_of(*node, struct ceph_quotarealm_inode, node); |
94 | |
95 | if (ino < qri->ino) |
96 | node = &((*node)->rb_left); |
97 | else if (ino > qri->ino) |
98 | node = &((*node)->rb_right); |
99 | else |
100 | break; |
101 | } |
102 | if (!qri || (qri->ino != ino)) { |
103 | /* Not found, create a new one and insert it */ |
104 | qri = kmalloc(size: sizeof(*qri), GFP_KERNEL); |
105 | if (qri) { |
106 | qri->ino = ino; |
107 | qri->inode = NULL; |
108 | qri->timeout = 0; |
109 | mutex_init(&qri->mutex); |
110 | rb_link_node(node: &qri->node, parent, rb_link: node); |
111 | rb_insert_color(&qri->node, &mdsc->quotarealms_inodes); |
112 | } else |
113 | pr_warn("Failed to alloc quotarealms_inode\n" ); |
114 | } |
115 | mutex_unlock(lock: &mdsc->quotarealms_inodes_mutex); |
116 | |
117 | return qri; |
118 | } |
119 | |
120 | /* |
121 | * This function will try to lookup a realm inode which isn't visible in the |
122 | * filesystem mountpoint. A list of these kind of inodes (not visible) is |
123 | * maintained in the mdsc and freed only when the filesystem is umounted. |
124 | * |
125 | * Note that these inodes are kept in this list even if the lookup fails, which |
126 | * allows to prevent useless lookup requests. |
127 | */ |
128 | static struct inode *lookup_quotarealm_inode(struct ceph_mds_client *mdsc, |
129 | struct super_block *sb, |
130 | struct ceph_snap_realm *realm) |
131 | { |
132 | struct ceph_quotarealm_inode *qri; |
133 | struct inode *in; |
134 | |
135 | qri = find_quotarealm_inode(mdsc, ino: realm->ino); |
136 | if (!qri) |
137 | return NULL; |
138 | |
139 | mutex_lock(&qri->mutex); |
140 | if (qri->inode && ceph_is_any_caps(inode: qri->inode)) { |
141 | /* A request has already returned the inode */ |
142 | mutex_unlock(lock: &qri->mutex); |
143 | return qri->inode; |
144 | } |
145 | /* Check if this inode lookup has failed recently */ |
146 | if (qri->timeout && |
147 | time_before_eq(jiffies, qri->timeout)) { |
148 | mutex_unlock(lock: &qri->mutex); |
149 | return NULL; |
150 | } |
151 | if (qri->inode) { |
152 | /* get caps */ |
153 | int ret = __ceph_do_getattr(inode: qri->inode, NULL, |
154 | CEPH_STAT_CAP_INODE, force: true); |
155 | if (ret >= 0) |
156 | in = qri->inode; |
157 | else |
158 | in = ERR_PTR(error: ret); |
159 | } else { |
160 | in = ceph_lookup_inode(sb, ino: realm->ino); |
161 | } |
162 | |
163 | if (IS_ERR(ptr: in)) { |
164 | dout("Can't lookup inode %llx (err: %ld)\n" , |
165 | realm->ino, PTR_ERR(in)); |
166 | qri->timeout = jiffies + msecs_to_jiffies(m: 60 * 1000); /* XXX */ |
167 | } else { |
168 | qri->timeout = 0; |
169 | qri->inode = in; |
170 | } |
171 | mutex_unlock(lock: &qri->mutex); |
172 | |
173 | return in; |
174 | } |
175 | |
176 | void ceph_cleanup_quotarealms_inodes(struct ceph_mds_client *mdsc) |
177 | { |
178 | struct ceph_quotarealm_inode *qri; |
179 | struct rb_node *node; |
180 | |
181 | /* |
182 | * It should now be safe to clean quotarealms_inode tree without holding |
183 | * mdsc->quotarealms_inodes_mutex... |
184 | */ |
185 | mutex_lock(&mdsc->quotarealms_inodes_mutex); |
186 | while (!RB_EMPTY_ROOT(&mdsc->quotarealms_inodes)) { |
187 | node = rb_first(&mdsc->quotarealms_inodes); |
188 | qri = rb_entry(node, struct ceph_quotarealm_inode, node); |
189 | rb_erase(node, &mdsc->quotarealms_inodes); |
190 | iput(qri->inode); |
191 | kfree(objp: qri); |
192 | } |
193 | mutex_unlock(lock: &mdsc->quotarealms_inodes_mutex); |
194 | } |
195 | |
196 | /* |
197 | * This function walks through the snaprealm for an inode and returns the |
198 | * ceph_snap_realm for the first snaprealm that has quotas set (max_files, |
199 | * max_bytes, or any, depending on the 'which_quota' argument). If the root is |
200 | * reached, return the root ceph_snap_realm instead. |
201 | * |
202 | * Note that the caller is responsible for calling ceph_put_snap_realm() on the |
203 | * returned realm. |
204 | * |
205 | * Callers of this function need to hold mdsc->snap_rwsem. However, if there's |
206 | * a need to do an inode lookup, this rwsem will be temporarily dropped. Hence |
207 | * the 'retry' argument: if rwsem needs to be dropped and 'retry' is 'false' |
208 | * this function will return -EAGAIN; otherwise, the snaprealms walk-through |
209 | * will be restarted. |
210 | */ |
211 | static struct ceph_snap_realm *get_quota_realm(struct ceph_mds_client *mdsc, |
212 | struct inode *inode, |
213 | enum quota_get_realm which_quota, |
214 | bool retry) |
215 | { |
216 | struct ceph_inode_info *ci = NULL; |
217 | struct ceph_snap_realm *realm, *next; |
218 | struct inode *in; |
219 | bool has_quota; |
220 | |
221 | if (ceph_snap(inode) != CEPH_NOSNAP) |
222 | return NULL; |
223 | |
224 | restart: |
225 | realm = ceph_inode(inode)->i_snap_realm; |
226 | if (realm) |
227 | ceph_get_snap_realm(mdsc, realm); |
228 | else |
229 | pr_err_ratelimited("get_quota_realm: ino (%llx.%llx) " |
230 | "null i_snap_realm\n" , ceph_vinop(inode)); |
231 | while (realm) { |
232 | bool has_inode; |
233 | |
234 | spin_lock(lock: &realm->inodes_with_caps_lock); |
235 | has_inode = realm->inode; |
236 | in = has_inode ? igrab(realm->inode) : NULL; |
237 | spin_unlock(lock: &realm->inodes_with_caps_lock); |
238 | if (has_inode && !in) |
239 | break; |
240 | if (!in) { |
241 | up_read(sem: &mdsc->snap_rwsem); |
242 | in = lookup_quotarealm_inode(mdsc, sb: inode->i_sb, realm); |
243 | down_read(sem: &mdsc->snap_rwsem); |
244 | if (IS_ERR_OR_NULL(ptr: in)) |
245 | break; |
246 | ceph_put_snap_realm(mdsc, realm); |
247 | if (!retry) |
248 | return ERR_PTR(error: -EAGAIN); |
249 | goto restart; |
250 | } |
251 | |
252 | ci = ceph_inode(inode: in); |
253 | has_quota = __ceph_has_quota(ci, which: which_quota); |
254 | iput(in); |
255 | |
256 | next = realm->parent; |
257 | if (has_quota || !next) |
258 | return realm; |
259 | |
260 | ceph_get_snap_realm(mdsc, realm: next); |
261 | ceph_put_snap_realm(mdsc, realm); |
262 | realm = next; |
263 | } |
264 | if (realm) |
265 | ceph_put_snap_realm(mdsc, realm); |
266 | |
267 | return NULL; |
268 | } |
269 | |
270 | bool ceph_quota_is_same_realm(struct inode *old, struct inode *new) |
271 | { |
272 | struct ceph_mds_client *mdsc = ceph_sb_to_mdsc(sb: old->i_sb); |
273 | struct ceph_snap_realm *old_realm, *new_realm; |
274 | bool is_same; |
275 | |
276 | restart: |
277 | /* |
278 | * We need to lookup 2 quota realms atomically, i.e. with snap_rwsem. |
279 | * However, get_quota_realm may drop it temporarily. By setting the |
280 | * 'retry' parameter to 'false', we'll get -EAGAIN if the rwsem was |
281 | * dropped and we can then restart the whole operation. |
282 | */ |
283 | down_read(sem: &mdsc->snap_rwsem); |
284 | old_realm = get_quota_realm(mdsc, inode: old, which_quota: QUOTA_GET_ANY, retry: true); |
285 | new_realm = get_quota_realm(mdsc, inode: new, which_quota: QUOTA_GET_ANY, retry: false); |
286 | if (PTR_ERR(ptr: new_realm) == -EAGAIN) { |
287 | up_read(sem: &mdsc->snap_rwsem); |
288 | if (old_realm) |
289 | ceph_put_snap_realm(mdsc, realm: old_realm); |
290 | goto restart; |
291 | } |
292 | is_same = (old_realm == new_realm); |
293 | up_read(sem: &mdsc->snap_rwsem); |
294 | |
295 | if (old_realm) |
296 | ceph_put_snap_realm(mdsc, realm: old_realm); |
297 | if (new_realm) |
298 | ceph_put_snap_realm(mdsc, realm: new_realm); |
299 | |
300 | return is_same; |
301 | } |
302 | |
303 | enum quota_check_op { |
304 | QUOTA_CHECK_MAX_FILES_OP, /* check quota max_files limit */ |
305 | QUOTA_CHECK_MAX_BYTES_OP, /* check quota max_files limit */ |
306 | QUOTA_CHECK_MAX_BYTES_APPROACHING_OP /* check if quota max_files |
307 | limit is approaching */ |
308 | }; |
309 | |
310 | /* |
311 | * check_quota_exceeded() will walk up the snaprealm hierarchy and, for each |
312 | * realm, it will execute quota check operation defined by the 'op' parameter. |
313 | * The snaprealm walk is interrupted if the quota check detects that the quota |
314 | * is exceeded or if the root inode is reached. |
315 | */ |
316 | static bool check_quota_exceeded(struct inode *inode, enum quota_check_op op, |
317 | loff_t delta) |
318 | { |
319 | struct ceph_mds_client *mdsc = ceph_sb_to_mdsc(sb: inode->i_sb); |
320 | struct ceph_inode_info *ci; |
321 | struct ceph_snap_realm *realm, *next; |
322 | struct inode *in; |
323 | u64 max, rvalue; |
324 | bool exceeded = false; |
325 | |
326 | if (ceph_snap(inode) != CEPH_NOSNAP) |
327 | return false; |
328 | |
329 | down_read(sem: &mdsc->snap_rwsem); |
330 | restart: |
331 | realm = ceph_inode(inode)->i_snap_realm; |
332 | if (realm) |
333 | ceph_get_snap_realm(mdsc, realm); |
334 | else |
335 | pr_err_ratelimited("check_quota_exceeded: ino (%llx.%llx) " |
336 | "null i_snap_realm\n" , ceph_vinop(inode)); |
337 | while (realm) { |
338 | bool has_inode; |
339 | |
340 | spin_lock(lock: &realm->inodes_with_caps_lock); |
341 | has_inode = realm->inode; |
342 | in = has_inode ? igrab(realm->inode) : NULL; |
343 | spin_unlock(lock: &realm->inodes_with_caps_lock); |
344 | if (has_inode && !in) |
345 | break; |
346 | if (!in) { |
347 | up_read(sem: &mdsc->snap_rwsem); |
348 | in = lookup_quotarealm_inode(mdsc, sb: inode->i_sb, realm); |
349 | down_read(sem: &mdsc->snap_rwsem); |
350 | if (IS_ERR_OR_NULL(ptr: in)) |
351 | break; |
352 | ceph_put_snap_realm(mdsc, realm); |
353 | goto restart; |
354 | } |
355 | ci = ceph_inode(inode: in); |
356 | spin_lock(lock: &ci->i_ceph_lock); |
357 | if (op == QUOTA_CHECK_MAX_FILES_OP) { |
358 | max = ci->i_max_files; |
359 | rvalue = ci->i_rfiles + ci->i_rsubdirs; |
360 | } else { |
361 | max = ci->i_max_bytes; |
362 | rvalue = ci->i_rbytes; |
363 | } |
364 | spin_unlock(lock: &ci->i_ceph_lock); |
365 | switch (op) { |
366 | case QUOTA_CHECK_MAX_FILES_OP: |
367 | case QUOTA_CHECK_MAX_BYTES_OP: |
368 | exceeded = (max && (rvalue + delta > max)); |
369 | break; |
370 | case QUOTA_CHECK_MAX_BYTES_APPROACHING_OP: |
371 | if (max) { |
372 | if (rvalue >= max) |
373 | exceeded = true; |
374 | else { |
375 | /* |
376 | * when we're writing more that 1/16th |
377 | * of the available space |
378 | */ |
379 | exceeded = |
380 | (((max - rvalue) >> 4) < delta); |
381 | } |
382 | } |
383 | break; |
384 | default: |
385 | /* Shouldn't happen */ |
386 | pr_warn("Invalid quota check op (%d)\n" , op); |
387 | exceeded = true; /* Just break the loop */ |
388 | } |
389 | iput(in); |
390 | |
391 | next = realm->parent; |
392 | if (exceeded || !next) |
393 | break; |
394 | ceph_get_snap_realm(mdsc, realm: next); |
395 | ceph_put_snap_realm(mdsc, realm); |
396 | realm = next; |
397 | } |
398 | if (realm) |
399 | ceph_put_snap_realm(mdsc, realm); |
400 | up_read(sem: &mdsc->snap_rwsem); |
401 | |
402 | return exceeded; |
403 | } |
404 | |
405 | /* |
406 | * ceph_quota_is_max_files_exceeded - check if we can create a new file |
407 | * @inode: directory where a new file is being created |
408 | * |
409 | * This functions returns true is max_files quota allows a new file to be |
410 | * created. It is necessary to walk through the snaprealm hierarchy (until the |
411 | * FS root) to check all realms with quotas set. |
412 | */ |
413 | bool ceph_quota_is_max_files_exceeded(struct inode *inode) |
414 | { |
415 | if (!ceph_has_realms_with_quotas(inode)) |
416 | return false; |
417 | |
418 | WARN_ON(!S_ISDIR(inode->i_mode)); |
419 | |
420 | return check_quota_exceeded(inode, op: QUOTA_CHECK_MAX_FILES_OP, delta: 1); |
421 | } |
422 | |
423 | /* |
424 | * ceph_quota_is_max_bytes_exceeded - check if we can write to a file |
425 | * @inode: inode being written |
426 | * @newsize: new size if write succeeds |
427 | * |
428 | * This functions returns true is max_bytes quota allows a file size to reach |
429 | * @newsize; it returns false otherwise. |
430 | */ |
431 | bool ceph_quota_is_max_bytes_exceeded(struct inode *inode, loff_t newsize) |
432 | { |
433 | loff_t size = i_size_read(inode); |
434 | |
435 | if (!ceph_has_realms_with_quotas(inode)) |
436 | return false; |
437 | |
438 | /* return immediately if we're decreasing file size */ |
439 | if (newsize <= size) |
440 | return false; |
441 | |
442 | return check_quota_exceeded(inode, op: QUOTA_CHECK_MAX_BYTES_OP, delta: (newsize - size)); |
443 | } |
444 | |
445 | /* |
446 | * ceph_quota_is_max_bytes_approaching - check if we're reaching max_bytes |
447 | * @inode: inode being written |
448 | * @newsize: new size if write succeeds |
449 | * |
450 | * This function returns true if the new file size @newsize will be consuming |
451 | * more than 1/16th of the available quota space; it returns false otherwise. |
452 | */ |
453 | bool ceph_quota_is_max_bytes_approaching(struct inode *inode, loff_t newsize) |
454 | { |
455 | loff_t size = ceph_inode(inode)->i_reported_size; |
456 | |
457 | if (!ceph_has_realms_with_quotas(inode)) |
458 | return false; |
459 | |
460 | /* return immediately if we're decreasing file size */ |
461 | if (newsize <= size) |
462 | return false; |
463 | |
464 | return check_quota_exceeded(inode, op: QUOTA_CHECK_MAX_BYTES_APPROACHING_OP, |
465 | delta: (newsize - size)); |
466 | } |
467 | |
468 | /* |
469 | * ceph_quota_update_statfs - if root has quota update statfs with quota status |
470 | * @fsc: filesystem client instance |
471 | * @buf: statfs to update |
472 | * |
473 | * If the mounted filesystem root has max_bytes quota set, update the filesystem |
474 | * statistics with the quota status. |
475 | * |
476 | * This function returns true if the stats have been updated, false otherwise. |
477 | */ |
478 | bool ceph_quota_update_statfs(struct ceph_fs_client *fsc, struct kstatfs *buf) |
479 | { |
480 | struct ceph_mds_client *mdsc = fsc->mdsc; |
481 | struct ceph_inode_info *ci; |
482 | struct ceph_snap_realm *realm; |
483 | struct inode *in; |
484 | u64 total = 0, used, free; |
485 | bool is_updated = false; |
486 | |
487 | down_read(sem: &mdsc->snap_rwsem); |
488 | realm = get_quota_realm(mdsc, inode: d_inode(dentry: fsc->sb->s_root), |
489 | which_quota: QUOTA_GET_MAX_BYTES, retry: true); |
490 | up_read(sem: &mdsc->snap_rwsem); |
491 | if (!realm) |
492 | return false; |
493 | |
494 | spin_lock(lock: &realm->inodes_with_caps_lock); |
495 | in = realm->inode ? igrab(realm->inode) : NULL; |
496 | spin_unlock(lock: &realm->inodes_with_caps_lock); |
497 | if (in) { |
498 | ci = ceph_inode(inode: in); |
499 | spin_lock(lock: &ci->i_ceph_lock); |
500 | if (ci->i_max_bytes) { |
501 | total = ci->i_max_bytes >> CEPH_BLOCK_SHIFT; |
502 | used = ci->i_rbytes >> CEPH_BLOCK_SHIFT; |
503 | /* For quota size less than 4MB, use 4KB block size */ |
504 | if (!total) { |
505 | total = ci->i_max_bytes >> CEPH_4K_BLOCK_SHIFT; |
506 | used = ci->i_rbytes >> CEPH_4K_BLOCK_SHIFT; |
507 | buf->f_frsize = 1 << CEPH_4K_BLOCK_SHIFT; |
508 | } |
509 | /* It is possible for a quota to be exceeded. |
510 | * Report 'zero' in that case |
511 | */ |
512 | free = total > used ? total - used : 0; |
513 | /* For quota size less than 4KB, report the |
514 | * total=used=4KB,free=0 when quota is full |
515 | * and total=free=4KB, used=0 otherwise */ |
516 | if (!total) { |
517 | total = 1; |
518 | free = ci->i_max_bytes > ci->i_rbytes ? 1 : 0; |
519 | buf->f_frsize = 1 << CEPH_4K_BLOCK_SHIFT; |
520 | } |
521 | } |
522 | spin_unlock(lock: &ci->i_ceph_lock); |
523 | if (total) { |
524 | buf->f_blocks = total; |
525 | buf->f_bfree = free; |
526 | buf->f_bavail = free; |
527 | is_updated = true; |
528 | } |
529 | iput(in); |
530 | } |
531 | ceph_put_snap_realm(mdsc, realm); |
532 | |
533 | return is_updated; |
534 | } |
535 | |
536 | |