[PATCH] fs/qnx6: fix pointer arithmetic in directory iteration

[PATCH] fs/qnx6: fix pointer arithmetic in directory iteration

[Arpith Kalaginanavoor]

The conversion to qnx6_get_folio() in commit b2aa61556fcf
("qnx6: Convert qnx6_get_page() to qnx6_get_folio()")
introduced a regression in directory iteration. The pointer 'de'
and the 'limit' address were calculated using byte offsets from
a char pointer without scaling by the size of a QNX6 directory
entry.

This causes the driver to read from incorrect memory offsets,
leading to "invalid direntry size" errors and premature
termination of directory scans.

Fix this by explicitly scaling the offset and limit calculations
by QNX6_DIR_ENTRY_SIZE to ensure the directory entry pointers
align with the intended 32-byte structures.

Fixes: b2aa61556fcf ("qnx6: Convert qnx6_get_page() to qnx6_get_folio()")
Cc: stable@vger.kernel.org
Signed-off-by: Arpith Kalaginanavoor <arpithk@nvidia.com>
---
 fs/qnx6/dir.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/qnx6/dir.c b/fs/qnx6/dir.c
index ae0c9846833d..ba5cae49ad1d 100644
--- a/fs/qnx6/dir.c
+++ b/fs/qnx6/dir.c
@@ -139,8 +139,8 @@ static int qnx6_readdir(struct file *file, struct dir_context *ctx)
 			ctx->pos = (n + 1) << PAGE_SHIFT;
 			return PTR_ERR(kaddr);
 		}
-		de = (struct qnx6_dir_entry *)(kaddr + offset);
-		limit = kaddr + last_entry(inode, n);
+		de = (struct qnx6_dir_entry *)(kaddr + (offset * QNX6_DIR_ENTRY_SIZE));
+		limit = kaddr + (last_entry(inode, n) * QNX6_DIR_ENTRY_SIZE);
 		for (; (char *)de < limit; de++, ctx->pos += QNX6_DIR_ENTRY_SIZE) {
 			int size = de->de_size;
 			u32 no_inode = fs32_to_cpu(sbi, de->de_inode);
-- 
2.43.0

Re: [PATCH] fs/qnx6: fix pointer arithmetic in directory iteration

[Al Viro]

On Tue, Mar 10, 2026 at 03:22:33AM -0700, Arpith Kalaginanavoor wrote:

> diff --git a/fs/qnx6/dir.c b/fs/qnx6/dir.c
> index ae0c9846833d..ba5cae49ad1d 100644
> --- a/fs/qnx6/dir.c
> +++ b/fs/qnx6/dir.c
> @@ -139,8 +139,8 @@ static int qnx6_readdir(struct file *file, struct dir_context *ctx)
>  			ctx->pos = (n + 1) << PAGE_SHIFT;
>  			return PTR_ERR(kaddr);
>  		}
> -		de = (struct qnx6_dir_entry *)(kaddr + offset);
> -		limit = kaddr + last_entry(inode, n);
> +		de = (struct qnx6_dir_entry *)(kaddr + (offset * QNX6_DIR_ENTRY_SIZE));
> +		limit = kaddr + (last_entry(inode, n) * QNX6_DIR_ENTRY_SIZE);

Why not simply

		de = (struct qnx6_dir_entry *)kaddr + offset;
		limit = (struct qnx6_dir_entry *)kaddr + last_entry(inode, n);

instead of open-coding the multiplication?

[PATCH v2] fs/qnx6: fix pointer arithmetic in directory iteration

[Arpith Kalaginanavoor]

The conversion to qnx6_get_folio() in commit b2aa61556fcf
("qnx6: Convert qnx6_get_page() to qnx6_get_folio()")
introduced a regression in directory iteration. The pointer 'de'
and the 'limit' address were calculated using byte offsets from
a char pointer without scaling by the size of a QNX6 directory
entry.

This causes the driver to read from incorrect memory offsets,
leading to "invalid direntry size" errors and premature
termination of directory scans.

Fix this by casting 'kaddr' to 'struct qnx6_dir_entry *' before
applying the offset and last_entry(...) increments. This allows the
compiler to correctly scale the pointer arithmetic by the 32-byte
stride of the directory entry structure.

Fixes: b2aa61556fcf ("qnx6: Convert qnx6_get_page() to qnx6_get_folio()")
Cc: stable@vger.kernel.org
Signed-off-by: Arpith Kalaginanavoor <arpithk@nvidia.com>
---
v2: Use idiomatic pointer arithmetic: cast kaddr to struct
    qnx6_dir_entry * and add offset / last_entry() counts
    directly, rather than scaling a char * with
    QNX6_DIR_ENTRY_SIZE, as suggested by Al Viro.

 fs/qnx6/dir.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/fs/qnx6/dir.c b/fs/qnx6/dir.c
index ae0c9846833d..8a26908f78c2 100644
--- a/fs/qnx6/dir.c
+++ b/fs/qnx6/dir.c
@@ -132,16 +132,16 @@ static int qnx6_readdir(struct file *file, struct dir_context *ctx)
 		struct qnx6_dir_entry *de;
 		struct folio *folio;
 		char *kaddr = qnx6_get_folio(inode, n, &folio);
-		char *limit;
+		struct qnx6_dir_entry *limit;
 
 		if (IS_ERR(kaddr)) {
 			pr_err("%s(): read failed\n", __func__);
 			ctx->pos = (n + 1) << PAGE_SHIFT;
 			return PTR_ERR(kaddr);
 		}
-		de = (struct qnx6_dir_entry *)(kaddr + offset);
-		limit = kaddr + last_entry(inode, n);
-		for (; (char *)de < limit; de++, ctx->pos += QNX6_DIR_ENTRY_SIZE) {
+		de = (struct qnx6_dir_entry *)kaddr + offset;
+		limit = (struct qnx6_dir_entry *)kaddr + last_entry(inode, n);
+		for (; de < limit; de++, ctx->pos += QNX6_DIR_ENTRY_SIZE) {
 			int size = de->de_size;
 			u32 no_inode = fs32_to_cpu(sbi, de->de_inode);
 
-- 
2.43.0

Re: [PATCH v2] fs/qnx6: fix pointer arithmetic in directory iteration

[Christian Brauner]

On Tue, 26 May 2026 05:38:58 -0700, Arpith Kalaginanavoor wrote:
> The conversion to qnx6_get_folio() in commit b2aa61556fcf
> ("qnx6: Convert qnx6_get_page() to qnx6_get_folio()")
> introduced a regression in directory iteration. The pointer 'de'
> and the 'limit' address were calculated using byte offsets from
> a char pointer without scaling by the size of a QNX6 directory
> entry.
> 
> [...]

Applied to the vfs.fixes branch of the vfs/vfs.git tree.
Patches in the vfs.fixes branch should appear in linux-next soon.

Please report any outstanding bugs that were missed during review in a
new review to the original patch series allowing us to drop it.

It's encouraged to provide Acked-bys and Reviewed-bys even though the
patch has now been applied. If possible patch trailers will be updated.

Note that commit hashes shown below are subject to change due to rebase,
trailer updates or similar. If in doubt, please check the listed branch.

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
branch: vfs.fixes

[1/1] fs/qnx6: fix pointer arithmetic in directory iteration
      https://git.kernel.org/vfs/vfs/c/89c4a1167f3a