[PATCH 1/2] qnx6: use the active superblock after choosing superblock #2

[Matthias Goergens]

When superblock #2 has the higher serial number, qnx6_fill_super()
makes it active in sbi->sb and sbi->sb_buf and releases bh1, but keeps
using sb1, which points into bh1's data, for the Inode and Longfile
level checks and for the root nodes passed to qnx6_private_inode().

The mount therefore reads the inode and long filename trees of the older
superblock #1, through a buffer_head it no longer holds, while the rest
of its superblock metadata comes from #2.  On an image whose two
superblocks point at different inode trees, the mount lists the files of
the older tree.  brelse() only drops the reference and the buffer stays
cached, so KASAN reports nothing and the mount does not crash.

Point sb1 at superblock #2 once it has been chosen, so that all later
uses see the active superblock.  bh2 remains held through sbi->sb_buf.

Fixes: 5d026c724220 ("fs: initial qnx6fs addition")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Matthias Goergens <matthias.goergens@xxxxxxxxx>
---
 fs/qnx6/inode.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/qnx6/inode.c b/fs/qnx6/inode.c
index 916de1e3ccc4..0dfe8a3dab83 100644
--- a/fs/qnx6/inode.c
+++ b/fs/qnx6/inode.c
@@ -407,6 +407,8 @@ static int qnx6_fill_super(struct super_block *s, struct fs_context *fc)
 		sbi->sb = (struct qnx6_super_block *)bh2->b_data;
 		brelse(bh1);
 		bh1 = NULL;
+		/* the checks and root nodes below must come from #2 too */
+		sb1 = sb2;
 		pr_info("superblock #2 active\n");
 	}
 mmi_success:

base-commit: 40288c9206c17eb66a603262e06a58d300d0f279
prerequisite-patch-id: 46f959e08f10dc22aa50f0dcf3b666bc797e16fb
prerequisite-patch-id: d556417ccc538855b2090601ca20abd209019457
prerequisite-patch-id: 66d4e443988c07ddde054c867da5ebdbb34c2489
prerequisite-patch-id: 873f6449aef25a36fb2a66da92cc2eb4f0a23d12
prerequisite-patch-id: 51ea17033b2899bab8950a36f880154df18a4afc
prerequisite-patch-id: 0a0f17ec064751ffb6558cedfaff3be7b2a41f79
-- 
2.55.0