[PATCH] fs/ntfs3: use put_indx_node() in indx_find_sort()

["Iván Ezequiel Rodriguez" <ivanrwcm25@gmail.com>]

indx_find_sort() frees struct indx_node without nb_put(): bare kfree()
on two error paths, and kfree(index)+kfree(node) on pop. Buffer heads
taken by indx_read() therefore leak. Use put_indx_node(), as
indx_find_raw() already does.

194491be54e1 freed n->index on pop only; bh refs and the error paths
were left. Jiasheng Jiang sent the complete put_indx_node() change
earlier (v2) but it was not merged.

QEMU: 300 distinct system.ntfs_security inserts; unpatched pop path
holds nbufs=1 across teardown, patched does not.

Link: https://lore.kernel.org/all/20260118185736.41529-1-jiashengjiangcool@gmail.com/
Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block")
Signed-off-by: Iván Ezequiel Rodriguez <ivanrwcm25@gmail.com>
---
 fs/ntfs3/index.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
index c06b36760448..00dc87818dfb 100644
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -1297,7 +1297,7 @@ int indx_find_sort(struct ntfs_index *indx, struct ntfs_inode *ni,
 		    sizeof(struct NTFS_DE) + sizeof(u64)) {
 			if (n) {
 				fnd_pop(fnd);
-				kfree(n);
+				put_indx_node(n);
 			}
 			return -EINVAL;
 		}
@@ -1310,7 +1310,7 @@ int indx_find_sort(struct ntfs_index *indx, struct ntfs_inode *ni,
 		/* Try next level. */
 		e = hdr_first_de(&n->index->ihdr);
 		if (!e) {
-			kfree(n);
+			put_indx_node(n);
 			return -EINVAL;
 		}
 
@@ -1330,8 +1330,7 @@ int indx_find_sort(struct ntfs_index *indx, struct ntfs_inode *ni,
 		/* Pop one level. */
 		if (n) {
 			fnd_pop(fnd);
-			kfree(n->index);
-			kfree(n);
+			put_indx_node(n);
 		}
 
 		level = fnd->level;
-- 
2.43.0