linux-kernel - [PATCH v2] fs/ntfs3: Fix memory and resource leak in indx_find

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20260118185736.41529-1-jiashengjiangcool@gmail.com>
Date: Sun, 18 Jan 2026 18:57:36 +0000
From: Jiasheng Jiang <jiashengjiangcool@...il.com>
To: markus.elfring@....de
Cc: almaz.alexandrovich@...agon-software.com,
	jiashengjiangcool@...il.com,
	linux-kernel@...r.kernel.org,
	ntfs3@...ts.linux.dev,
	stable@...r.kernel.org
Subject: [PATCH v2] fs/ntfs3: Fix memory and resource leak in indx_find_sort

The function indx_find_sort() incorrectly uses kfree(n) to cleanup the
'struct indx_node' instance in error paths.

The 'struct indx_node' is a container that manages internal allocations
(n->index) and holds a reference to a buffer head (n->nb). Using kfree()
directly on the node pointer only frees the container itself, resulting
in a memory leak of the index buffer and a resource leak of the buffer
head reference.

This patch replaces the incorrect kfree(n) calls with the specialized
helper put_indx_node(n), which correctly releases the internal resources
and the buffer head, consistent with other functions like indx_find_raw().

Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@...il.com>
---
Changelog:

v1 -> v2:

1. Add a Fixes tag.
---
 fs/ntfs3/index.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
index 7157cfd70fdc..c598b4b2f454 100644
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -1248,7 +1248,7 @@ int indx_find_sort(struct ntfs_index *indx, struct ntfs_inode *ni,
 		    sizeof(struct NTFS_DE) + sizeof(u64)) {
 			if (n) {
 				fnd_pop(fnd);
-				kfree(n);
+				put_indx_node(n);
 			}
 			return -EINVAL;
 		}
@@ -1261,7 +1261,7 @@ int indx_find_sort(struct ntfs_index *indx, struct ntfs_inode *ni,
 		/* Try next level. */
 		e = hdr_first_de(&n->index->ihdr);
 		if (!e) {
-			kfree(n);
+			put_indx_node(n);
 			return -EINVAL;
 		}
 
@@ -1281,7 +1281,7 @@ int indx_find_sort(struct ntfs_index *indx, struct ntfs_inode *ni,
 		/* Pop one level. */
 		if (n) {
 			fnd_pop(fnd);
-			kfree(n);
+			put_indx_node(n);
 		}
 
 		level = fnd->level;
-- 
2.25.1