[PATCH v5 0/6] fs/qnx6: fix buffer head leaks, double free, and inode validation

[Hui Peng <benquike@gmail.com>]

This series addresses buffer head memory leaks, uninitialized pointer reads,
out-of-bounds array access, and superblock validation issues in the qnx6
filesystem driver.

All patches have been ported to the latest tip of mainline (551c722f4080)
and verified in QEMU KVM with CONFIG_KASAN=y and UBSAN enabled.

Changes in v5:
- 1/6: Restored commit description to accurately specify UBSAN
  shift-out-of-bounds reports at both shifts in qnx6_block_map() as
  requested by Matthias Goergens.
- 3/6: Used qs->sb_buf instead of sbi->sb_buf at label out: in
  qnx6_fill_super() to prevent reading uninitialized sbi when mounting
  mmi_fs images, fixing a general protection fault reported by Matthias.
- 4/6: Updated commit description to state that clearing sb_buf after
  brelse() is defensive cleanup.
- Collected Tested-by and Reviewed-by tags from Matthias Goergens.

Hui Peng (6):
  qnx6: validate di_filelevels in qnx6_iget() before accessing level
    pointers
  qnx6: release bh on error path in qnx6_block_map()
  qnx6: release bh on error path in qnx6_fill_super()
  qnx6: clear sb_buf after brelse in qnx6_mmi_fill_super()
  qnx6: abort mount on superblock magic mismatch when silent is set in
    qnx6_mmi_fill_super()
  qnx6: validate sb_blocksize before dividing in qnx6_mmi_fill_super()

 fs/qnx6/inode.c     | 18 +++++++++++++++---
 fs/qnx6/super_mmi.c |  7 ++++++-
 2 files changed, 21 insertions(+), 4 deletions(-)

-- 
2.47.3