[PATCH] fs/ntfs3: fix memory leak in ntfs_fill_super()

[PATCH] fs/ntfs3: fix memory leak in ntfs_fill_super()

[Konstantin Komarov]

ntfs_fill_super() assigns fc->fs_private to a newly allocated options
structure earlier in the mount path. At the end of a successful mount, the
code set fc->fs_private = NULL, which prevented the vfs from freeing this
memory during mount context cleanup. As a result, the options structure
was leaked.

Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
---
 fs/ntfs3/super.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c
index a641d474c782..38d82e46171a 100644
--- a/fs/ntfs3/super.c
+++ b/fs/ntfs3/super.c
@@ -1252,7 +1252,6 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc)
 		}
 	}
 	sbi->options = options;
-	fc->fs_private = NULL;
 	sb->s_flags |= SB_NODIRATIME;
 	sb->s_magic = 0x7366746e; // "ntfs"
 	sb->s_op = &ntfs_sops;
-- 
2.43.0

Re: [PATCH] fs/ntfs3: fix memory leak in ntfs_fill_super()

[Konstantin Komarov]

On 12/11/25 14:51, Konstantin Komarov wrote:

> ntfs_fill_super() assigns fc->fs_private to a newly allocated options
> structure earlier in the mount path. At the end of a successful mount, the
> code set fc->fs_private = NULL, which prevented the vfs from freeing this
> memory during mount context cleanup. As a result, the options structure
> was leaked.
>
> Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
> ---
>   fs/ntfs3/super.c | 1 -
>   1 file changed, 1 deletion(-)
>
> diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c
> index a641d474c782..38d82e46171a 100644
> --- a/fs/ntfs3/super.c
> +++ b/fs/ntfs3/super.c
> @@ -1252,7 +1252,6 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc)
>   		}
>   	}
>   	sbi->options = options;
> -	fc->fs_private = NULL;
>   	sb->s_flags |= SB_NODIRATIME;
>   	sb->s_magic = 0x7366746e; // "ntfs"
>   	sb->s_op = &ntfs_sops;

Please withdraw this patch.

I realized after sending it that an equivalent patch was already submitted
earlier by Baokun Li<libaokun1@huawei.com>. My version is redundant, so I
will drop it and proceed with reviewing/merging the earlier contribution.

Apologies for the duplication.

Regards,
Konstantin

[PATCH] fs/ntfs3: Fix memory leak in ntfs_fill_super()

[Shigeru Yoshida]

syzbot reported memory leak in ntfs_fill_super(). ntfs_fill_super() calls
wnd_init() and this allocates memory. So, we need to free those memory on the
error handling path in ntfs_fill_super().

Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block")
Reported-and-tested-by: syzbot+9ccdd15480e9d9833822@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9ccdd15480e9d9833822
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
---
 fs/ntfs3/super.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c
index cfec5e0c7f66..a9610f5f4cc0 100644
--- a/fs/ntfs3/super.c
+++ b/fs/ntfs3/super.c
@@ -1563,6 +1563,13 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc)
 	iput(inode);
 out:
 	kfree(boot2);
+
+	if (sbi->mft.bitmap.inited)
+		wnd_close(&sbi->mft.bitmap);
+
+	if (sbi->used.bitmap.inited)
+		wnd_close(&sbi->used.bitmap);
+
 	return err;
 }
 
-- 
2.41.0