Subject:[REGRESSION] fs/qnx6: incorrect pointer arithmetic breaks dir scanning completely

[Oleg Chaun <olegchaun@gmail.com>]

#regzbot introduced: b2aa615

Hello,

A change to fs/qnx6/dir.c:qnx6_readdir() introduced in commit b2aa615 
contains an incorrect pointer arithmetic (adding an offset expressed in 
QNX6_DIR_ENTRY_SIZE units to a plain char * pointer) which breaks QNX6 
directory reading completely: only few entries are visible, kernel log 
is spammed with "invalid direntry size" messages.

The following patch seems to fix the issue:

--- /tmp/temp/linux-6.17/fs/qnx6/dir.c    2025-09-28 23:39:22.000000000 
+0200
+++ ./dir.c    2026-02-13 18:52:56.000000000 +0100
@@ -138,8 +138,8 @@
              ctx->pos = (n + 1) << PAGE_SHIFT;
              return PTR_ERR(kaddr);
          }
-        de = (struct qnx6_dir_entry *)(kaddr + offset);
-        limit = kaddr + last_entry(inode, n);
+        de = ((struct qnx6_dir_entry *)kaddr) + offset;
+        limit = kaddr + last_entry(inode, n) * QNX6_DIR_ENTRY_SIZE;
          for (; (char *)de < limit; de++, ctx->pos += 
QNX6_DIR_ENTRY_SIZE) {
              int size = de->de_size;
              u32 no_inode = fs32_to_cpu(sbi, de->de_inode);

I can test any further changes on real QNX6 fs images if necessary.

BR,
Oleg