When superblock #2 has the higher serial number, qnx6_fill_super() makes it active in sbi->sb and sbi->sb_buf and releases bh1, but keeps using sb1, which points into bh1's data, for the Inode and Longfile level checks and for the root nodes passed to qnx6_private_inode(). The mount therefore reads the inode and long filename trees of the older superblock #1, through a buffer_head it no longer holds, while the rest of its superblock metadata comes from #2. On an image whose two superblocks point at different inode trees, the mount lists the files of the older tree. brelse() only drops the reference and the buffer stays cached, so KASAN reports nothing and the mount does not crash. Point sb1 at superblock #2 once it has been chosen, so that all later uses see the active superblock. bh2 remains held through sbi->sb_buf. Fixes: 5d026c724220 ("fs: initial qnx6fs addition") Cc: stable@vger.kernel.org Signed-off-by: Matthias Goergens --- fs/qnx6/inode.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/qnx6/inode.c b/fs/qnx6/inode.c index 916de1e3ccc4..0dfe8a3dab83 100644 --- a/fs/qnx6/inode.c +++ b/fs/qnx6/inode.c @@ -407,6 +407,8 @@ static int qnx6_fill_super(struct super_block *s, struct fs_context *fc) sbi->sb = (struct qnx6_super_block *)bh2->b_data; brelse(bh1); bh1 = NULL; + /* the checks and root nodes below must come from #2 too */ + sb1 = sb2; pr_info("superblock #2 active\n"); } mmi_success: base-commit: 40288c9206c17eb66a603262e06a58d300d0f279 prerequisite-patch-id: 46f959e08f10dc22aa50f0dcf3b666bc797e16fb prerequisite-patch-id: d556417ccc538855b2090601ca20abd209019457 prerequisite-patch-id: 66d4e443988c07ddde054c867da5ebdbb34c2489 prerequisite-patch-id: 873f6449aef25a36fb2a66da92cc2eb4f0a23d12 prerequisite-patch-id: 51ea17033b2899bab8950a36f880154df18a4afc prerequisite-patch-id: 0a0f17ec064751ffb6558cedfaff3be7b2a41f79 -- 2.55.0