[PATCH v4 0/6] fs/qnx6: fix buffer head leaks, double free, and inode validation

[Hui Peng]

This series fixes buffer head leaks, double free issues, and inode/
superblock validation defects in fs/qnx6/:

1. Validate di_filelevels against QNX6_PTR_MAX_LEVELS (5) in qnx6_iget()
   before accessing level pointers.
2. Release buffer_head on error path in qnx6_block_map().
3. Avoid double brelse() and fix sbi->sb_buf leak on error path in
   qnx6_fill_super().
4. Clear bh pointers when selecting active superblock in
   qnx6_mmi_fill_super().
5. Abort mount on superblock magic mismatch when silent is set in
   qnx6_mmi_fill_super().
6. Validate sb_blocksize before dividing in qnx6_mmi_fill_super().

Changes in v4:
- Rebased cleanly and tested for applicability against tip of upstream
  mainline commit 62f4c998b297 ("Merge tag 'parisc-for-7.3-rc5' of
  git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux").
- Updated 1/6 commit description to state QNX6_PTR_MAX_LEVELS is 5
  (defined in include/linux/qnx6_fs.h), correcting the previous
  description text as pointed out by Matthias Goergens.
- Temporarily dropped Tested-by / Reviewed-by tags from Matthias Goergens
  per his request until he re-tests v4 on mainline.

Changes in v3:
- Added Tested-by and Reviewed-by tags from Matthias Goergens across all
  6 patches.
- Updated Fixes tag in patch 1/6 to commit 5d026c724220 ("fs: initial
  qnx6fs addition").

Hui Peng (6):
  qnx6: validate di_filelevels in qnx6_iget() before accessing level...
  qnx6: release bh on error path in qnx6_block_map()
  qnx6: avoid double brelse() and fix sb_buf leak on error path in...
  qnx6: release bh2/bh1 on active superblock selection in...
  qnx6: abort mount on superblock magic mismatch when silent is set...
  qnx6: validate sb_blocksize before dividing in qnx6_mmi_fill_super()

 fs/qnx6/inode.c     | 17 ++++++++++++++---
 fs/qnx6/super_mmi.c |  9 ++++++---
 2 files changed, 20 insertions(+), 6 deletions(-)