Re: [PATCH] btrfs: tree-checker: add btrfs dev extent checks

[David Sterba <dsterba@suse.cz>]

On Wed, Aug 14, 2024 at 08:47:40AM +0930, Qu Wenruo wrote:
> > Looks like we missed some simple tree item checks indeed.
> 
> The original idea is, we have btrfs_verify_dev_extents() at mount time, 
> thus it's enough to reject bad dev extents, and no need for tree-checker 
> for dev-extents.
> 
> But this method doesn't prevent bitflip from sneaking in during runtime.

Yeah, the tree-checker is run before commit too, so the mount checks
won't catch that.

> So in the long run, our sanity checks should:
> 
> - Do cross-checks at mount time for critical infrastructure
>    To prevent corruption sneaking in undetected.

At mount we can afford to do more than the tree-checker can do in the
single leaf, like matching the dev extents and block groups.

> - Do in-leaf checks at tree-checker
>    To prevent corruption reach storage.
> 
> - Do extra read-time cross-checks
>    Just like the dir item checks we did.

Some values have a clear range, or a constraint like alignment to a
sectorsize. Beyond that I think it's quite limited, we can't read other
leaves but maybe other checks against existing in-memory structures can
be done. An example, a block group item is consistent but overlaps with
one in the tree. Similar to what you do in this patch, but the bg is
already handled because of how the data is tracked. The tree-checker
coverage is pretty good so it's hard to find what else to cross-check.