[PATCH 0/2] qnx6: stale superblock #1 use and undefined shifts

[Matthias Goergens]

These two fixes came up while testing Hui Peng's qnx6 series.  Both bugs
date back to the initial qnx6 commit.  The patches apply on top of
Hui's v2 [1]; its 3/6 changes the context of 1/2 here.  His v3 [2]
does not apply to mainline, and I have replied to it separately.

1/2: when superblock #2 is the newer one, qnx6_fill_super() still
takes the inode and long filename trees from superblock #1, after
releasing its buffer.

2/2: qnx6_block_map() shifts a 32-bit block number by 32 or more bits
for depth-5 trees with 512 byte blocks and for depth-4 and depth-5
trees with 4K blocks, all of which the driver accepts.

Tested on mainline 40288c9206c1 plus Hui's v2 1-6, in a KASAN and
UBSAN kernel under qemu with generated images:

- An image whose newer superblock #2 points at a different inode tree
  lists that tree's file with 1/2 and the older tree's file without.

- Files in depth-5 (512 byte blocks) and depth-4 and depth-5 (4K
  blocks) trees read back with the contents they were generated with,
  with 2/2.
  Without it they read back with the wrong contents, and UBSAN reports
  shift-out-of-bounds.

- Six valid images (512 byte and 4K blocks, either superblock active,
  normal and MMI layouts), a depth-4 tree with 512 byte blocks and a
  depth-3 tree with 4K blocks read back identically with and without
  both patches.

[1] https://lore.kernel.org/all/20260921042511.1473629-1-benquike@xxxxxxxxx/
[2] https://lore.kernel.org/all/20260924073920.2782917-1-benquike@xxxxxxxxx/

Matthias Goergens (2):
  qnx6: use the active superblock after choosing superblock #2
  qnx6: avoid undefined shifts in qnx6_block_map()

 fs/qnx6/inode.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)


base-commit: 40288c9206c17eb66a603262e06a58d300d0f279
prerequisite-patch-id: 46f959e08f10dc22aa50f0dcf3b666bc797e16fb
prerequisite-patch-id: d556417ccc538855b2090601ca20abd209019457
prerequisite-patch-id: 66d4e443988c07ddde054c867da5ebdbb34c2489
prerequisite-patch-id: 873f6449aef25a36fb2a66da92cc2eb4f0a23d12
prerequisite-patch-id: 51ea17033b2899bab8950a36f880154df18a4afc
prerequisite-patch-id: 0a0f17ec064751ffb6558cedfaff3be7b2a41f79
-- 
2.55.0