Re: Subject:[REGRESSION] fs/qnx6: incorrect pointer arithmetic breaks dir scanning completely

On 5/26/26 12:40, Oleg Chaun wrote:
> 
> A change to fs/qnx6/dir.c:qnx6_readdir() introduced in commit b2aa615
> contains an incorrect pointer arithmetic (adding an offset expressed in
> QNX6_DIR_ENTRY_SIZE units to a plain char * pointer) which breaks QNX6
> directory reading completely: only few entries are visible, kernel log
> is spammed with "invalid direntry size" messages.

Thx for the report. From a quick look it seems Arpith Kalaginanavoor
(now CCed) reported this last month and provided a proper patch:
https://lore.kernel.org/all/[email protected]/

Al (now CCed, too) suggested a slightly different fix, but it seems
since then nothing happened.

Ciao, Thorsten

> The following patch seems to fix the issue:
> 
> --- /tmp/temp/linux-6.17/fs/qnx6/dir.c    2025-09-28 23:39:22.000000000
> +0200
> +++ ./dir.c    2026-02-13 18:52:56.000000000 +0100
> @@ -138,8 +138,8 @@
>              ctx->pos = (n + 1) << PAGE_SHIFT;
>              return PTR_ERR(kaddr);
>          }
> -        de = (struct qnx6_dir_entry *)(kaddr + offset);
> -        limit = kaddr + last_entry(inode, n);
> +        de = ((struct qnx6_dir_entry *)kaddr) + offset;
> +        limit = kaddr + last_entry(inode, n) * QNX6_DIR_ENTRY_SIZE;
>          for (; (char *)de < limit; de++, ctx->pos +=
> QNX6_DIR_ENTRY_SIZE) {
>              int size = de->de_size;
>              u32 no_inode = fs32_to_cpu(sbi, de->de_inode);
> 
> I can test any further changes on real QNX6 fs images if necessary.

#regzbot introduced: b2aa61556fcfa8
#regzbot title: qnx6: dir scanning broken
#regzbot dup:
https://lore.kernel.org/all/[email protected]/