Re: [PATCH v5 0/6] fs/qnx6: fix buffer head leaks, double free, and inode validation

[Matthias Goergens <matthias.goergens@gmail.com>]

Hi Hui,

Thanks for keeping at this series, and for taking the 1/6 wording on
board.  I think something went wrong when v5 was generated, though: it
does not apply to mainline 551c722f4080, the base your cover letter
names.  git am stops at 1/6, and git apply rejects 1/6, 2/6, 5/6 and
6/6 on their own (4/6 is reported as corrupt).  The context lines refer
to code that is not in fs/qnx6, such as a bad_inode label in
qnx6_iget() and labels out1 and out2 in super_mmi.c, so it looks as if
it came from a different tree than v4, which applied cleanly.  Could
you regenerate it from v4 on a clean checkout of mainline?

While comparing it with v4 I also noticed a few things that may have
been lost along the way:

2/6: the brelse(bh) is now inside if (!bh), where bh is NULL, so it
has no effect.  The leak v4 fixed is on the qnx6_check_blockptr()
failure path.

3/6: the bh1 = NULL and bh2 = NULL assignments from v4 are gone, so the
double brelse() comes back.  With only this 3/6 applied to mainline
(KASAN and UBSAN, under QEMU), the double-brelse image gives the same
two "Trying to free free buffer" warnings as unpatched mainline; v4
gives none.  The qs->sb_buf release itself looks right.

1/6: the text says QNX6_PTR_MAX_LEVELS is 3, but
include/linux/qnx6_fs.h defines it as 5, so inodes with 4 or 5 levels
are valid.  The check uses the macro, so only the text needs fixing.

Fixes: 1da177e4c3f4 is the 2.6.12-rc2 import, which predates qnx6, and
3377755f1064 is not in mainline.  v4's 5d026c724220 ("fs: initial
qnx6fs addition") added both inode.c and super_mmi.c.

Could you also drop my Tested-by and Reviewed-by from v5?  I haven't
been able to test it as posted, and 2/6 and 5/6 have changed since I
reviewed them.  I'll gladly re-test the next version and give them
again.

Thanks,
Matthias