btrfs-corrupt-block.c

   1 /*
   2  * Copyright (C) 2009 Oracle.  All rights reserved.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public
   6  * License v2 as published by the Free Software Foundation.
   7  *
   8  * This program is distributed in the hope that it will be useful,
   9  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  11  * General Public License for more details.
  12  *
  13  * You should have received a copy of the GNU General Public
  14  * License along with this program; if not, write to the
  15  * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
  16  * Boston, MA 021110-1307, USA.
  17  */
  18
  19 #define _XOPEN_SOURCE 500
  20 #define _GNU_SOURCE 1
  21 #include <stdio.h>
  22 #include <stdlib.h>
  23 #include <fcntl.h>
  24 #include <unistd.h>
  25 #include <getopt.h>
  26 #include "kerncompat.h"
  27 #include "ctree.h"
  28 #include "volumes.h"
  29 #include "disk-io.h"
  30 #include "print-tree.h"
  31 #include "transaction.h"
  32 #include "list.h"
  33 #include "version.h"
  34 #include "utils.h"
  35
  36 #define FIELD_BUF_LEN 80
  37
  38 struct extent_buffer *debug_corrupt_block(struct btrfs_root *root, u64 bytenr,
  39                                      u32 blocksize, u64 copy)
  40 {
  41         int ret;
  42         struct extent_buffer *eb;
  43         u64 length;
  44         struct btrfs_multi_bio *multi = NULL;
  45         struct btrfs_device *device;
  46         int num_copies;
  47         int mirror_num = 1;
  48
  49         eb = btrfs_find_create_tree_block(root, bytenr, blocksize);
  50         if (!eb)
  51                 return NULL;
  52
  53         length = blocksize;
  54         while (1) {
  55                 ret = btrfs_map_block(&root->fs_info->mapping_tree, READ,
  56                                       eb->start, &length, &multi,
  57                                       mirror_num, NULL);
  58                 BUG_ON(ret);
  59                 device = multi->stripes[0].dev;
  60                 eb->fd = device->fd;
  61                 device->total_ios++;
  62                 eb->dev_bytenr = multi->stripes[0].physical;
  63
  64                 fprintf(stdout,
  65                         "mirror %d logical %llu physical %llu device %s\n",
  66                         mirror_num, (unsigned long long)bytenr,
  67                         (unsigned long long)eb->dev_bytenr, device->name);
  68                 kfree(multi);
  69
  70                 if (!copy || mirror_num == copy) {
  71                         ret = read_extent_from_disk(eb, 0, eb->len);
  72                         printf("corrupting %llu copy %d\n", eb->start,
  73                                mirror_num);
  74                         memset(eb->data, 0, eb->len);
  75                         write_extent_to_disk(eb);
  76                         fsync(eb->fd);
  77                 }
  78
  79                 num_copies = btrfs_num_copies(&root->fs_info->mapping_tree,
  80                                               eb->start, eb->len);
  81                 if (num_copies == 1)
  82                         break;
  83
  84                 mirror_num++;
  85                 if (mirror_num > num_copies)
  86                         break;
  87         }
  88         return eb;
  89 }
  90
  91 static void print_usage(void)
  92 {
  93         fprintf(stderr, "usage: btrfs-corrupt-block [options] device\n");
  94         fprintf(stderr, "\t-l Logical extent to be corrupted\n");
  95         fprintf(stderr, "\t-c Copy of the extent to be corrupted"
  96                 " (usually 1 or 2, default: 0)\n");
  97         fprintf(stderr, "\t-b Number of bytes to be corrupted\n");
  98         fprintf(stderr, "\t-e Extent to be corrupted\n");
  99         fprintf(stderr, "\t-E The whole extent tree to be corrupted\n");
 100         fprintf(stderr, "\t-u Given chunk item to be corrupted\n");
 101         fprintf(stderr, "\t-U The whole chunk tree to be corrupted\n");
 102         fprintf(stderr, "\t-i The inode item to corrupt (must also specify "
 103                 "the field to corrupt)\n");
 104         fprintf(stderr, "\t-x The file extent item to corrupt (must also "
 105                 "specify -i for the inode and -f for the field to corrupt)\n");
 106         fprintf(stderr, "\t-m The metadata block to corrupt (must also "
 107                 "specify -f for the field to corrupt)\n");
 108         fprintf(stderr, "\t-K The key to corrupt in the format "
 109                 "<num>,<num>,<num> (must also specify -f for the field)\n");
 110         fprintf(stderr, "\t-f The field in the item to corrupt\n");
 111         exit(1);
 112 }
 113
 114 static void corrupt_keys(struct btrfs_trans_handle *trans,
 115                          struct btrfs_root *root,
 116                          struct extent_buffer *eb)
 117 {
 118         int slot;
 119         int bad_slot;
 120         int nr;
 121         struct btrfs_disk_key bad_key;;
 122
 123         nr = btrfs_header_nritems(eb);
 124         if (nr == 0)
 125                 return;
 126
 127         slot = rand() % nr;
 128         bad_slot = rand() % nr;
 129
 130         if (bad_slot == slot)
 131                 return;
 132
 133         fprintf(stderr,
 134                 "corrupting keys in block %llu slot %d swapping with %d\n",
 135                 (unsigned long long)eb->start, slot, bad_slot);
 136
 137         if (btrfs_header_level(eb) == 0) {
 138                 btrfs_item_key(eb, &bad_key, bad_slot);
 139                 btrfs_set_item_key(eb, &bad_key, slot);
 140         } else {
 141                 btrfs_node_key(eb, &bad_key, bad_slot);
 142                 btrfs_set_node_key(eb, &bad_key, slot);
 143         }
 144         btrfs_mark_buffer_dirty(eb);
 145         if (!trans) {
 146                 u16 csum_size =
 147                         btrfs_super_csum_size(root->fs_info->super_copy);
 148                 csum_tree_block_size(eb, csum_size, 0);
 149                 write_extent_to_disk(eb);
 150         }
 151 }
 152
 153
 154 static int corrupt_keys_in_block(struct btrfs_root *root, u64 bytenr)
 155 {
 156         struct extent_buffer *eb;
 157
 158         eb = read_tree_block(root, bytenr, root->leafsize, 0);
 159         if (!eb)
 160                 return -EIO;;
 161
 162         corrupt_keys(NULL, root, eb);
 163         free_extent_buffer(eb);
 164         return 0;
 165 }
 166
 167 static int corrupt_extent(struct btrfs_trans_handle *trans,
 168                           struct btrfs_root *root, u64 bytenr, u64 copy)
 169 {
 170         struct btrfs_key key;
 171         struct extent_buffer *leaf;
 172         u32 item_size;
 173         unsigned long ptr;
 174         struct btrfs_path *path;
 175         int ret;
 176         int slot;
 177         int should_del = rand() % 3;
 178
 179         path = btrfs_alloc_path();
 180         if (!path)
 181                 return -ENOMEM;
 182
 183         key.objectid = bytenr;
 184         key.type = (u8)-1;
 185         key.offset = (u64)-1;
 186
 187         while(1) {
 188                 ret = btrfs_search_slot(trans, root->fs_info->extent_root,
 189                                         &key, path, -1, 1);
 190                 if (ret < 0)
 191                         break;
 192
 193                 if (ret > 0) {
 194                         if (path->slots[0] == 0)
 195                                 break;
 196                         path->slots[0]--;
 197                         ret = 0;
 198                 }
 199                 leaf = path->nodes[0];
 200                 slot = path->slots[0];
 201                 btrfs_item_key_to_cpu(leaf, &key, slot);
 202                 if (key.objectid != bytenr)
 203                         break;
 204
 205                 if (key.type != BTRFS_EXTENT_ITEM_KEY &&
 206                     key.type != BTRFS_TREE_BLOCK_REF_KEY &&
 207                     key.type != BTRFS_EXTENT_DATA_REF_KEY &&
 208                     key.type != BTRFS_EXTENT_REF_V0_KEY &&
 209                     key.type != BTRFS_SHARED_BLOCK_REF_KEY &&
 210                     key.type != BTRFS_SHARED_DATA_REF_KEY)
 211                         goto next;
 212
 213                 if (should_del) {
 214                         fprintf(stderr,
 215                                 "deleting extent record: key %llu %u %llu\n",
 216                                 key.objectid, key.type, key.offset);
 217
 218                         if (key.type == BTRFS_EXTENT_ITEM_KEY) {
 219                                 /* make sure this extent doesn't get
 220                                  * reused for other purposes */
 221                                 btrfs_pin_extent(root->fs_info,
 222                                                  key.objectid, key.offset);
 223                         }
 224
 225                         btrfs_del_item(trans, root, path);
 226                 } else {
 227                         fprintf(stderr,
 228                                 "corrupting extent record: key %llu %u %llu\n",
 229                                 key.objectid, key.type, key.offset);
 230                         ptr = btrfs_item_ptr_offset(leaf, slot);
 231                         item_size = btrfs_item_size_nr(leaf, slot);
 232                         memset_extent_buffer(leaf, 0, ptr, item_size);
 233                         btrfs_mark_buffer_dirty(leaf);
 234                 }
 235 next:
 236                 btrfs_release_path(path);
 237
 238                 if (key.offset > 0)
 239                         key.offset--;
 240                 if (key.offset == 0)
 241                         break;
 242         }
 243
 244         btrfs_free_path(path);
 245         return 0;
 246 }
 247
 248 static void btrfs_corrupt_extent_leaf(struct btrfs_trans_handle *trans,
 249                                       struct btrfs_root *root,
 250                                       struct extent_buffer *eb)
 251 {
 252         u32 nr = btrfs_header_nritems(eb);
 253         u32 victim = rand() % nr;
 254         u64 objectid;
 255         struct btrfs_key key;
 256
 257         btrfs_item_key_to_cpu(eb, &key, victim);
 258         objectid = key.objectid;
 259         corrupt_extent(trans, root, objectid, 1);
 260 }
 261
 262 static void btrfs_corrupt_extent_tree(struct btrfs_trans_handle *trans,
 263                                       struct btrfs_root *root,
 264                                       struct extent_buffer *eb)
 265 {
 266         int i;
 267
 268         if (!eb)
 269                 return;
 270
 271         if (btrfs_is_leaf(eb)) {
 272                 btrfs_corrupt_extent_leaf(trans, root, eb);
 273                 return;
 274         }
 275
 276         if (btrfs_header_level(eb) == 1 && eb != root->node) {
 277                 if (rand() % 5)
 278                         return;
 279         }
 280
 281         for (i = 0; i < btrfs_header_nritems(eb); i++) {
 282                 struct extent_buffer *next;
 283
 284                 next = read_tree_block(root, btrfs_node_blockptr(eb, i),
 285                                        root->leafsize,
 286                                        btrfs_node_ptr_generation(eb, i));
 287                 if (!next)
 288                         continue;
 289                 btrfs_corrupt_extent_tree(trans, root, next);
 290                 free_extent_buffer(next);
 291         }
 292 }
 293
 294 enum btrfs_inode_field {
 295         BTRFS_INODE_FIELD_ISIZE,
 296         BTRFS_INODE_FIELD_BAD,
 297 };
 298
 299 enum btrfs_file_extent_field {
 300         BTRFS_FILE_EXTENT_DISK_BYTENR,
 301         BTRFS_FILE_EXTENT_BAD,
 302 };
 303
 304 enum btrfs_metadata_block_field {
 305         BTRFS_METADATA_BLOCK_GENERATION,
 306         BTRFS_METADATA_BLOCK_BAD,
 307 };
 308
 309 enum btrfs_key_field {
 310         BTRFS_KEY_OBJECTID,
 311         BTRFS_KEY_TYPE,
 312         BTRFS_KEY_OFFSET,
 313         BTRFS_KEY_BAD,
 314 };
 315
 316 static enum btrfs_inode_field convert_inode_field(char *field)
 317 {
 318         if (!strncmp(field, "isize", FIELD_BUF_LEN))
 319                 return BTRFS_INODE_FIELD_ISIZE;
 320         return BTRFS_INODE_FIELD_BAD;
 321 }
 322
 323 static enum btrfs_file_extent_field convert_file_extent_field(char *field)
 324 {
 325         if (!strncmp(field, "disk_bytenr", FIELD_BUF_LEN))
 326                 return BTRFS_FILE_EXTENT_DISK_BYTENR;
 327         return BTRFS_FILE_EXTENT_BAD;
 328 }
 329
 330 static enum btrfs_metadata_block_field
 331 convert_metadata_block_field(char *field)
 332 {
 333         if (!strncmp(field, "generation", FIELD_BUF_LEN))
 334                 return BTRFS_METADATA_BLOCK_GENERATION;
 335         return BTRFS_METADATA_BLOCK_BAD;
 336 }
 337
 338 static enum btrfs_key_field convert_key_field(char *field)
 339 {
 340         if (!strncmp(field, "objectid", FIELD_BUF_LEN))
 341                 return BTRFS_KEY_OBJECTID;
 342         if (!strncmp(field, "type", FIELD_BUF_LEN))
 343                 return BTRFS_KEY_TYPE;
 344         if (!strncmp(field, "offset", FIELD_BUF_LEN))
 345                 return BTRFS_KEY_OFFSET;
 346         return BTRFS_KEY_BAD;
 347 }
 348
 349 static u64 generate_u64(u64 orig)
 350 {
 351         u64 ret;
 352         do {
 353                 ret = rand();
 354         } while (ret == orig);
 355         return ret;
 356 }
 357
 358 static u8 generate_u8(u8 orig)
 359 {
 360         u8 ret;
 361         do {
 362                 ret = rand();
 363         } while (ret == orig);
 364         return ret;
 365 }
 366
 367 static int corrupt_key(struct btrfs_root *root, struct btrfs_key *key,
 368                        char *field)
 369 {
 370         enum btrfs_key_field corrupt_field = convert_key_field(field);
 371         struct btrfs_path *path;
 372         struct btrfs_trans_handle *trans;
 373         int ret;
 374
 375         root = root->fs_info->fs_root;
 376         if (corrupt_field == BTRFS_KEY_BAD) {
 377                 fprintf(stderr, "Invalid field %s\n", field);
 378                 return -EINVAL;
 379         }
 380
 381         path = btrfs_alloc_path();
 382         if (!path)
 383                 return -ENOMEM;
 384
 385         trans = btrfs_start_transaction(root, 1);
 386         if (IS_ERR(trans)) {
 387                 btrfs_free_path(path);
 388                 return PTR_ERR(trans);
 389         }
 390
 391         ret = btrfs_search_slot(trans, root, key, path, 0, 1);
 392         if (ret < 0)
 393                 goto out;
 394         if (ret > 0) {
 395                 fprintf(stderr, "Couldn't find the key to corrupt\n");
 396                 ret = -ENOENT;
 397                 goto out;
 398         }
 399
 400         switch (corrupt_field) {
 401         case BTRFS_KEY_OBJECTID:
 402                 key->objectid = generate_u64(key->objectid);
 403                 break;
 404         case BTRFS_KEY_TYPE:
 405                 key->type = generate_u8(key->type);
 406                 break;
 407         case BTRFS_KEY_OFFSET:
 408                 key->offset = generate_u64(key->objectid);
 409                 break;
 410         default:
 411                 fprintf(stderr, "Invalid field %s, %d\n", field,
 412                         corrupt_field);
 413                 ret = -EINVAL;
 414                 goto out;
 415         }
 416
 417         btrfs_set_item_key_unsafe(root, path, key);
 418 out:
 419         btrfs_free_path(path);
 420         btrfs_commit_transaction(trans, root);
 421         return ret;
 422 }
 423
 424
 425 static int corrupt_inode(struct btrfs_trans_handle *trans,
 426                          struct btrfs_root *root, u64 inode, char *field)
 427 {
 428         struct btrfs_inode_item *ei;
 429         struct btrfs_path *path;
 430         struct btrfs_key key;
 431         enum btrfs_inode_field corrupt_field = convert_inode_field(field);
 432         u64 bogus;
 433         u64 orig;
 434         int ret;
 435
 436         if (corrupt_field == BTRFS_INODE_FIELD_BAD) {
 437                 fprintf(stderr, "Invalid field %s\n", field);
 438                 return -EINVAL;
 439         }
 440
 441         key.objectid = inode;
 442         key.type = BTRFS_INODE_ITEM_KEY;
 443         key.offset = (u64)-1;
 444
 445         path = btrfs_alloc_path();
 446         if (!path)
 447                 return -ENOMEM;
 448
 449         ret = btrfs_search_slot(trans, root, &key, path, 0, 1);
 450         if (ret < 0)
 451                 goto out;
 452         if (ret) {
 453                 if (!path->slots[0]) {
 454                         fprintf(stderr, "Couldn't find inode %Lu\n", inode);
 455                         ret = -ENOENT;
 456                         goto out;
 457                 }
 458                 path->slots[0]--;
 459                 ret = 0;
 460         }
 461
 462         btrfs_item_key_to_cpu(path->nodes[0], &key, path->slots[0]);
 463         if (key.objectid != inode) {
 464                 fprintf(stderr, "Couldn't find inode %Lu\n", inode);
 465                 ret = -ENOENT;
 466                 goto out;
 467         }
 468
 469         ei = btrfs_item_ptr(path->nodes[0], path->slots[0],
 470                             struct btrfs_inode_item);
 471         switch (corrupt_field) {
 472         case BTRFS_INODE_FIELD_ISIZE:
 473                 orig = btrfs_inode_size(path->nodes[0], ei);
 474                 bogus = generate_u64(orig);
 475                 btrfs_set_inode_size(path->nodes[0], ei, bogus);
 476                 break;
 477         default:
 478                 ret = -EINVAL;
 479                 break;
 480         }
 481         btrfs_mark_buffer_dirty(path->nodes[0]);
 482 out:
 483         btrfs_free_path(path);
 484         return ret;
 485 }
 486
 487 static int corrupt_file_extent(struct btrfs_trans_handle *trans,
 488                                struct btrfs_root *root, u64 inode, u64 extent,
 489                                char *field)
 490 {
 491         struct btrfs_file_extent_item *fi;
 492         struct btrfs_path *path;
 493         struct btrfs_key key;
 494         enum btrfs_file_extent_field corrupt_field;
 495         u64 bogus;
 496         u64 orig;
 497         int ret = 0;
 498
 499         corrupt_field = convert_file_extent_field(field);
 500         if (corrupt_field == BTRFS_FILE_EXTENT_BAD) {
 501                 fprintf(stderr, "Invalid field %s\n", field);
 502                 return -EINVAL;
 503         }
 504
 505         key.objectid = inode;
 506         key.type = BTRFS_EXTENT_DATA_KEY;
 507         key.offset = extent;
 508
 509         path = btrfs_alloc_path();
 510         if (!path)
 511                 return -ENOMEM;
 512
 513         ret = btrfs_search_slot(trans, root, &key, path, 0, 1);
 514         if (ret < 0)
 515                 goto out;
 516         if (ret) {
 517                 fprintf(stderr, "Couldn't find extent %llu for inode %llu\n",
 518                         extent, inode);
 519                 ret = -ENOENT;
 520                 goto out;
 521         }
 522
 523         fi = btrfs_item_ptr(path->nodes[0], path->slots[0],
 524                             struct btrfs_file_extent_item);
 525         switch (corrupt_field) {
 526         case BTRFS_FILE_EXTENT_DISK_BYTENR:
 527                 orig = btrfs_file_extent_disk_bytenr(path->nodes[0], fi);
 528                 bogus = generate_u64(orig);
 529                 btrfs_set_file_extent_disk_bytenr(path->nodes[0], fi, bogus);
 530                 break;
 531         default:
 532                 ret = -EINVAL;
 533                 break;
 534         }
 535         btrfs_mark_buffer_dirty(path->nodes[0]);
 536 out:
 537         btrfs_free_path(path);
 538         return ret;
 539 }
 540
 541 static int corrupt_metadata_block(struct btrfs_root *root, u64 block,
 542                                   char *field)
 543 {
 544         struct btrfs_trans_handle *trans;
 545         struct btrfs_path *path;
 546         struct extent_buffer *eb;
 547         struct btrfs_key key, root_key;
 548         enum btrfs_metadata_block_field corrupt_field;
 549         u64 root_objectid;
 550         u64 orig, bogus;
 551         u8 level;
 552         int ret;
 553
 554         corrupt_field = convert_metadata_block_field(field);
 555         if (corrupt_field == BTRFS_METADATA_BLOCK_BAD) {
 556                 fprintf(stderr, "Invalid field %s\n", field);
 557                 return -EINVAL;
 558         }
 559
 560         eb = read_tree_block(root, block, root->leafsize, 0);
 561         if (!eb) {
 562                 fprintf(stderr, "Couldn't read in tree block %s\n", field);
 563                 return -EINVAL;
 564         }
 565         root_objectid = btrfs_header_owner(eb);
 566         level = btrfs_header_level(eb);
 567         if (level)
 568                 btrfs_node_key_to_cpu(eb, &key, 0);
 569         else
 570                 btrfs_item_key_to_cpu(eb, &key, 0);
 571         free_extent_buffer(eb);
 572
 573         root_key.objectid = root_objectid;
 574         root_key.type = BTRFS_ROOT_ITEM_KEY;
 575         root_key.offset = (u64)-1;
 576
 577         root = btrfs_read_fs_root(root->fs_info, &root_key);
 578         if (IS_ERR(root)) {
 579                 fprintf(stderr, "Couldn't finde owner root %llu\n",
 580                         key.objectid);
 581                 return PTR_ERR(root);
 582         }
 583
 584         path = btrfs_alloc_path();
 585         if (!path)
 586                 return -ENOMEM;
 587
 588         trans = btrfs_start_transaction(root, 1);
 589         if (IS_ERR(trans)) {
 590                 btrfs_free_path(path);
 591                 fprintf(stderr, "Couldn't start transaction %ld\n",
 592                         PTR_ERR(trans));
 593                 return PTR_ERR(trans);
 594         }
 595
 596         path->lowest_level = level;
 597         ret = btrfs_search_slot(trans, root, &key, path, 0, 1);
 598         if (ret < 0) {
 599                 fprintf(stderr, "Error searching to node %d\n", ret);
 600                 goto out;
 601         }
 602         eb = path->nodes[level];
 603
 604         ret = 0;
 605         switch (corrupt_field) {
 606         case BTRFS_METADATA_BLOCK_GENERATION:
 607                 orig = btrfs_header_generation(eb);
 608                 bogus = generate_u64(orig);
 609                 btrfs_set_header_generation(eb, bogus);
 610                 break;
 611         default:
 612                 ret = -EINVAL;
 613                 break;
 614         }
 615         btrfs_mark_buffer_dirty(path->nodes[level]);
 616 out:
 617         btrfs_commit_transaction(trans, root);
 618         btrfs_free_path(path);
 619         return ret;
 620 }
 621
 622 static struct option long_options[] = {
 623         /* { "byte-count", 1, NULL, 'b' }, */
 624         { "logical", 1, NULL, 'l' },
 625         { "copy", 1, NULL, 'c' },
 626         { "bytes", 1, NULL, 'b' },
 627         { "extent-record", 0, NULL, 'e' },
 628         { "extent-tree", 0, NULL, 'E' },
 629         { "keys", 0, NULL, 'k' },
 630         { "chunk-record", 0, NULL, 'u' },
 631         { "chunk-tree", 0, NULL, 'U' },
 632         { "inode", 1, NULL, 'i'},
 633         { "file-extent", 1, NULL, 'x'},
 634         { "metadata-block", 1, NULL, 'm'},
 635         { "field", 1, NULL, 'f'},
 636         { "key", 1, NULL, 'K'},
 637         { 0, 0, 0, 0}
 638 };
 639
 640 /* corrupt item using NO cow.
 641  * Because chunk recover will recover based on whole partition scaning,
 642  * If using COW, chunk recover will use the old item to recover,
 643  * which is still OK but we want to check the ability to rebuild chunk
 644  * not only restore the old ones */
 645 int corrupt_item_nocow(struct btrfs_trans_handle *trans,
 646                        struct btrfs_root *root, struct btrfs_path *path,
 647                        int del)
 648 {
 649         int ret = 0;
 650         struct btrfs_key key;
 651         struct extent_buffer *leaf;
 652         unsigned long ptr;
 653         int slot;
 654         u32 item_size;
 655
 656         leaf = path->nodes[0];
 657         slot = path->slots[0];
 658         /* Not deleting the first item of a leaf to keep leaf structure */
 659         if (slot == 0)
 660                 del = 0;
 661         /* Only accept valid eb */
 662         BUG_ON(!leaf->data || slot >= btrfs_header_nritems(leaf));
 663         btrfs_item_key_to_cpu(leaf, &key, slot);
 664         if (del) {
 665                 fprintf(stdout, "Deleting key and data [%llu, %u, %llu].\n",
 666                         key.objectid, key.type, key.offset);
 667                 btrfs_del_item(trans, root, path);
 668         } else {
 669                 fprintf(stdout, "Corrupting key and data [%llu, %u, %llu].\n",
 670                         key.objectid, key.type, key.offset);
 671                 ptr = btrfs_item_ptr_offset(leaf, slot);
 672                 item_size = btrfs_item_size_nr(leaf, slot);
 673                 memset_extent_buffer(leaf, 0, ptr, item_size);
 674                 btrfs_mark_buffer_dirty(leaf);
 675         }
 676         return ret;
 677 }
 678 int corrupt_chunk_tree(struct btrfs_trans_handle *trans,
 679                        struct btrfs_root *root)
 680 {
 681         int ret;
 682         int del;
 683         int slot;
 684         struct btrfs_path *path;
 685         struct btrfs_key key;
 686         struct btrfs_key found_key;
 687         struct extent_buffer *leaf;
 688
 689         path = btrfs_alloc_path();
 690         if (!path)
 691                 return -ENOMEM;
 692
 693         key.objectid = (u64)-1;
 694         key.offset = (u64)-1;
 695         key.type = (u8)-1;
 696
 697         /* Here, cow and ins_len must equals 0 for the following reasons:
 698          * 1) chunk recover is based on disk scanning, so COW should be
 699          *    disabled in case the original chunk being scanned and
 700          *    recovered using the old chunk.
 701          * 2) if cow = 0, ins_len must also be set to 0, or BUG_ON will be
 702          *    triggered.
 703          */
 704         ret = btrfs_search_slot(trans, root, &key, path, 0, 0);
 705         BUG_ON(ret == 0);
 706         if (ret < 0) {
 707                 fprintf(stderr, "Error searching tree\n");
 708                 goto free_out;
 709         }
 710         /* corrupt/del dev_item first */
 711         while (!btrfs_previous_item(root, path, 0, BTRFS_DEV_ITEM_KEY)) {
 712                 slot = path->slots[0];
 713                 leaf = path->nodes[0];
 714                 del = rand() % 3;
 715                 /* Never delete the first item to keep the leaf structure */
 716                 if (path->slots[0] == 0)
 717                         del = 0;
 718                 ret = corrupt_item_nocow(trans, root, path, del);
 719                 if (ret)
 720                         goto free_out;
 721         }
 722         btrfs_release_path(path);
 723
 724         /* Here, cow and ins_len must equals 0 for the following reasons:
 725          * 1) chunk recover is based on disk scanning, so COW should be
 726          *    disabled in case the original chunk being scanned and
 727          *    recovered using the old chunk.
 728          * 2) if cow = 0, ins_len must also be set to 0, or BUG_ON will be
 729          *    triggered.
 730          */
 731         ret = btrfs_search_slot(trans, root, &key, path, 0, 0);
 732         BUG_ON(ret == 0);
 733         if (ret < 0) {
 734                 fprintf(stderr, "Error searching tree\n");
 735                 goto free_out;
 736         }
 737         /* corrupt/del chunk then*/
 738         while (!btrfs_previous_item(root, path, 0, BTRFS_CHUNK_ITEM_KEY)) {
 739                 slot = path->slots[0];
 740                 leaf = path->nodes[0];
 741                 del = rand() % 3;
 742                 btrfs_item_key_to_cpu(leaf, &found_key, slot);
 743                 ret = corrupt_item_nocow(trans, root, path, del);
 744                 if (ret)
 745                         goto free_out;
 746         }
 747 free_out:
 748         btrfs_free_path(path);
 749         return ret;
 750 }
 751 int find_chunk_offset(struct btrfs_root *root,
 752                       struct btrfs_path *path, u64 offset)
 753 {
 754         struct btrfs_key key;
 755         int ret;
 756
 757         key.objectid = BTRFS_FIRST_CHUNK_TREE_OBJECTID;
 758         key.type = BTRFS_CHUNK_ITEM_KEY;
 759         key.offset = offset;
 760
 761         /* Here, cow and ins_len must equals 0 for following reasons:
 762          * 1) chunk recover is based on disk scanning, so COW should
 763          *    be disabled in case the original chunk being scanned
 764          *    and recovered using the old chunk.
 765          * 2) if cow = 0, ins_len must also be set to 0, or BUG_ON
 766          *    will be triggered.
 767          */
 768         ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
 769         if (ret > 0) {
 770                 fprintf(stderr, "Can't find chunk with given offset %llu\n",
 771                         offset);
 772                 goto out;
 773         }
 774         if (ret < 0) {
 775                 fprintf(stderr, "Error searching chunk");
 776                 goto out;
 777         }
 778 out:
 779         return ret;
 780
 781 }
 782 int main(int ac, char **av)
 783 {
 784         struct cache_tree root_cache;
 785         struct btrfs_key key;
 786         struct btrfs_root *root;
 787         struct extent_buffer *eb;
 788         char *dev;
 789         /* chunk offset can be 0,so change to (u64)-1 */
 790         u64 logical = (u64)-1;
 791         int ret = 0;
 792         int option_index = 0;
 793         u64 copy = 0;
 794         u64 bytes = 4096;
 795         int extent_rec = 0;
 796         int extent_tree = 0;
 797         int corrupt_block_keys = 0;
 798         int chunk_rec = 0;
 799         int chunk_tree = 0;
 800         u64 metadata_block = 0;
 801         u64 inode = 0;
 802         u64 file_extent = (u64)-1;
 803         char field[FIELD_BUF_LEN];
 804
 805         field[0] = '\0';
 806         srand(128);
 807         memset(&key, 0, sizeof(key));
 808
 809         while(1) {
 810                 int c;
 811                 c = getopt_long(ac, av, "l:c:b:eEkuUi:f:x:m:K:", long_options,
 812                                 &option_index);
 813                 if (c < 0)
 814                         break;
 815                 switch(c) {
 816                         case 'l':
 817                                 logical = arg_strtou64(optarg);
 818                                 break;
 819                         case 'c':
 820                                 copy = arg_strtou64(optarg);
 821                                 break;
 822                         case 'b':
 823                                 bytes = arg_strtou64(optarg);
 824                                 break;
 825                         case 'e':
 826                                 extent_rec = 1;
 827                                 break;
 828                         case 'E':
 829                                 extent_tree = 1;
 830                                 break;
 831                         case 'k':
 832                                 corrupt_block_keys = 1;
 833                                 break;
 834                         case 'u':
 835                                 chunk_rec = 1;
 836                                 break;
 837                         case 'U':
 838                                 chunk_tree = 1;
 839                         case 'i':
 840                                 inode = arg_strtou64(optarg);
 841                                 break;
 842                         case 'f':
 843                                 strncpy(field, optarg, FIELD_BUF_LEN);
 844                                 break;
 845                         case 'x':
 846                                 file_extent = arg_strtou64(optarg);
 847                                 break;
 848                         case 'm':
 849                                 metadata_block = arg_strtou64(optarg);
 850                                 break;
 851                         case 'K':
 852                                 ret = sscanf(optarg, "%llu,%u,%llu",
 853                                              &key.objectid,
 854                                              (unsigned int *)&key.type,
 855                                              &key.offset);
 856                                 if (ret != 3) {
 857                                         fprintf(stderr, "error reading key "
 858                                                 "%d\n", errno);
 859                                         print_usage();
 860                                 }
 861                                 break;
 862                         default:
 863                                 print_usage();
 864                 }
 865         }
 866         set_argv0(av);
 867         ac = ac - optind;
 868         if (check_argc_min(ac, 1))
 869                 print_usage();
 870         dev = av[optind];
 871
 872         radix_tree_init();
 873         cache_tree_init(&root_cache);
 874
 875         root = open_ctree(dev, 0, OPEN_CTREE_WRITES);
 876         if (!root) {
 877                 fprintf(stderr, "Open ctree failed\n");
 878                 exit(1);
 879         }
 880         if (extent_rec) {
 881                 struct btrfs_trans_handle *trans;
 882
 883                 if (logical == (u64)-1)
 884                         print_usage();
 885                 trans = btrfs_start_transaction(root, 1);
 886                 ret = corrupt_extent (trans, root, logical, 0);
 887                 btrfs_commit_transaction(trans, root);
 888                 goto out_close;
 889         }
 890         if (extent_tree) {
 891                 struct btrfs_trans_handle *trans;
 892                 trans = btrfs_start_transaction(root, 1);
 893                 btrfs_corrupt_extent_tree(trans, root->fs_info->extent_root,
 894                                           root->fs_info->extent_root->node);
 895                 btrfs_commit_transaction(trans, root);
 896                 goto out_close;
 897         }
 898         if (chunk_rec) {
 899                 struct btrfs_trans_handle *trans;
 900                 struct btrfs_path *path;
 901                 int del;
 902
 903                 if (logical == (u64)-1)
 904                         print_usage();
 905                 del = rand() % 3;
 906                 path = btrfs_alloc_path();
 907                 if (!path) {
 908                         fprintf(stderr, "path allocation failed\n");
 909                         goto out_close;
 910                 }
 911
 912                 if (find_chunk_offset(root->fs_info->chunk_root, path,
 913                                       logical) != 0) {
 914                         btrfs_free_path(path);
 915                         goto out_close;
 916                 }
 917                 trans = btrfs_start_transaction(root, 1);
 918                 ret = corrupt_item_nocow(trans, root->fs_info->chunk_root,
 919                                          path, del);
 920                 if (ret < 0)
 921                         fprintf(stderr, "Failed to corrupt chunk record\n");
 922                 btrfs_commit_transaction(trans, root);
 923                 goto out_close;
 924         }
 925         if (chunk_tree) {
 926                 struct btrfs_trans_handle *trans;
 927                 trans = btrfs_start_transaction(root, 1);
 928                 ret = corrupt_chunk_tree(trans, root->fs_info->chunk_root);
 929                 if (ret < 0)
 930                         fprintf(stderr, "Failed to corrupt chunk tree\n");
 931                 btrfs_commit_transaction(trans, root);
 932                 goto out_close;
 933         }
 934         if (inode) {
 935                 struct btrfs_trans_handle *trans;
 936
 937                 if (!strlen(field))
 938                         print_usage();
 939
 940                 trans = btrfs_start_transaction(root, 1);
 941                 if (file_extent == (u64)-1) {
 942                         printf("corrupting inode\n");
 943                         ret = corrupt_inode(trans, root, inode, field);
 944                 } else {
 945                         printf("corrupting file extent\n");
 946                         ret = corrupt_file_extent(trans, root, inode,
 947                                                   file_extent, field);
 948                 }
 949                 btrfs_commit_transaction(trans, root);
 950                 goto out_close;
 951         }
 952         if (metadata_block) {
 953                 if (!strlen(field))
 954                         print_usage();
 955                 ret = corrupt_metadata_block(root, metadata_block, field);
 956                 goto out_close;
 957         }
 958         if (key.objectid || key.offset || key.type) {
 959                 if (!strlen(field))
 960                         print_usage();
 961                 ret = corrupt_key(root, &key, field);
 962                 goto out_close;
 963         }
 964         /*
 965          * If we made it here and we have extent set then we didn't specify
 966          * inode and we're screwed.
 967          */
 968         if (file_extent != (u64)-1)
 969                 print_usage();
 970
 971         if (logical == (u64)-1)
 972                 print_usage();
 973
 974         if (bytes == 0)
 975                 bytes = root->sectorsize;
 976
 977         bytes = (bytes + root->sectorsize - 1) / root->sectorsize;
 978         bytes *= root->sectorsize;
 979
 980         while (bytes > 0) {
 981                 if (corrupt_block_keys) {
 982                         corrupt_keys_in_block(root, logical);
 983                 } else {
 984                         eb = debug_corrupt_block(root, logical,
 985                                                  root->sectorsize, copy);
 986                         free_extent_buffer(eb);
 987                 }
 988                 logical += root->sectorsize;
 989                 bytes -= root->sectorsize;
 990         }
 991         return ret;
 992 out_close:
 993         close_ctree(root);
 994         return ret;
 995 }