[PATCH] ntfs: Fix error handling in __ntfs_create()

[PATCH] ntfs: Fix error handling in __ntfs_create()

[Bart Van Assche]

In __ntfs_create(), if ntfs_init_acl() fails before
ntfs_mft_record_alloc() is called, jumping to err_out frees MFT record
0 ($MFT), unmaps an unmapped record and unlocks the unheld
&dir_ni->mrec_lock and &ni->mrec_lock mutexes. Call iput(vi) and
return ERR_PTR(err) directly instead, matching the
ntfs_mft_record_alloc() failure path right below it.

Fixes: af0db57d4293 ("ntfs: update inode operations")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 fs/ntfs/namei.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/ntfs/namei.c b/fs/ntfs/namei.c
index 62b01646c262..b46fe44b63b5 100644
--- a/fs/ntfs/namei.c
+++ b/fs/ntfs/namei.c
@@ -472,8 +472,10 @@ static struct ntfs_inode *__ntfs_create(const struct mnt_idmap *idmap, struct in
 #ifdef CONFIG_NTFS_FS_POSIX_ACL
 	if (!S_ISLNK(mode) && (sb->s_flags & SB_POSIXACL)) {
 		err = ntfs_init_acl(idmap, vi, dir);
-		if (err)
-			goto err_out;
+		if (err) {
+			iput(vi);
+			return ERR_PTR(err);
+		}
 	} else
 #endif
 	{

Re: [PATCH] ntfs: Fix error handling in __ntfs_create()

[Hyunchul Lee]

On Mon, Oct 26, 2026 at 12:43:00PM -0700, Bart Van Assche wrote:
> In __ntfs_create(), if ntfs_init_acl() fails before
> ntfs_mft_record_alloc() is called, jumping to err_out frees MFT record
> 0 ($MFT), unmaps an unmapped record and unlocks the unheld
> &dir_ni->mrec_lock and &ni->mrec_lock mutexes. Call iput(vi) and
> return ERR_PTR(err) directly instead, matching the
> ntfs_mft_record_alloc() failure path right below it.
> 
> Fixes: af0db57d4293 ("ntfs: update inode operations")
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>

Looks good to me.

Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>

-- 
Thanks,
Hyunchul