[PATCH] ntfs: fix hole runlist memory leak in insert range error path

[PATCH] ntfs: fix hole runlist memory leak in insert range error path

[Peiyang He]

ntfs_non_resident_attr_insert_range() allocates hole_rl before mapping the
whole runlist. If ntfs_attr_map_whole_runlist() fails, the error path drops
ni->runlist.lock and returns without freeing hole_rl. This causes memory leak
of sizeof(*hole_rl) * 2 bytes.

Fix this memory leak by freeing hole_rl before returning from that error path,
matching the later error paths in the same function.

Fixes: 495e90fa3348 ("ntfs: update attrib operations")
Signed-off-by: Peiyang He <peiyang_he@smail.nju.edu.cn>
---
 fs/ntfs/attrib.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/ntfs/attrib.c b/fs/ntfs/attrib.c
index dd8828098511..55603df0a2ed 100644
--- a/fs/ntfs/attrib.c
+++ b/fs/ntfs/attrib.c
@@ -5325,6 +5325,7 @@ int ntfs_non_resident_attr_insert_range(struct ntfs_inode *ni, s64 start_vcn, s6
 	ret = ntfs_attr_map_whole_runlist(ni);
 	if (ret) {
 		up_write(&ni->runlist.lock);
+		kfree(hole_rl);
 		return ret;
 	}
 

base-commit: 1a3746ccbb0a97bed3c06ccde6b880013b1dddc1
-- 
2.43.0

Re: [PATCH] ntfs: fix hole runlist memory leak in insert range error path

[Greg KH]

On Sun, Jul 05, 2026 at 06:05:54PM +0800, Peiyang He wrote:
> ntfs_non_resident_attr_insert_range() allocates hole_rl before mapping the
> whole runlist. If ntfs_attr_map_whole_runlist() fails, the error path drops
> ni->runlist.lock and returns without freeing hole_rl. This causes memory leak
> of sizeof(*hole_rl) * 2 bytes.
> 
> Fix this memory leak by freeing hole_rl before returning from that error path,
> matching the later error paths in the same function.
> 
> Fixes: 495e90fa3348 ("ntfs: update attrib operations")
> Signed-off-by: Peiyang He <peiyang_he@smail.nju.edu.cn>
> ---
>  fs/ntfs/attrib.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/fs/ntfs/attrib.c b/fs/ntfs/attrib.c
> index dd8828098511..55603df0a2ed 100644
> --- a/fs/ntfs/attrib.c
> +++ b/fs/ntfs/attrib.c
> @@ -5325,6 +5325,7 @@ int ntfs_non_resident_attr_insert_range(struct ntfs_inode *ni, s64 start_vcn, s6
>  	ret = ntfs_attr_map_whole_runlist(ni);
>  	if (ret) {
>  		up_write(&ni->runlist.lock);
> +		kfree(hole_rl);
>  		return ret;
>  	}
>  
> 
> base-commit: 1a3746ccbb0a97bed3c06ccde6b880013b1dddc1
> -- 
> 2.43.0
> 
> 

<formletter>

This is not the correct way to submit patches for inclusion in the
stable kernel tree.  Please read:
    https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
for how to do this properly.

</formletter>

[PATCH v2] ntfs: fix hole runlist memory leak in insert range error path

[Peiyang He]

ntfs_non_resident_attr_insert_range() allocates hole_rl before mapping the
whole runlist. If ntfs_attr_map_whole_runlist() fails, the error path drops
ni->runlist.lock and returns without freeing hole_rl. This leaks memory
of sizeof(*hole_rl) * 2 bytes.

Fix this memory leak by freeing hole_rl before returning from
that error path, matching the later error paths in the same function.

Fixes: 495e90fa3348 ("ntfs: update attrib operations")
Cc: stable@vger.kernel.org
Signed-off-by: Peiyang He <peiyang_he@smail.nju.edu.cn>
---
Changes in v2:
  - modify commit message to resolve checkpatch.pl warning
  - add Cc: stable@vger.kernel.org tag to the commit message

 fs/ntfs/attrib.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/ntfs/attrib.c b/fs/ntfs/attrib.c
index dd8828098511..55603df0a2ed 100644
--- a/fs/ntfs/attrib.c
+++ b/fs/ntfs/attrib.c
@@ -5325,6 +5325,7 @@ int ntfs_non_resident_attr_insert_range(struct ntfs_inode *ni, s64 start_vcn, s6
 	ret = ntfs_attr_map_whole_runlist(ni);
 	if (ret) {
 		up_write(&ni->runlist.lock);
+		kfree(hole_rl);
 		return ret;
 	}
 

base-commit: 1a3746ccbb0a97bed3c06ccde6b880013b1dddc1
-- 
2.43.0

Re: [PATCH v2] ntfs: fix hole runlist memory leak in insert range error path

[Hyunchul Lee]

2026년 7월 5일 (일) 오후 8:14, Peiyang He <peiyang_he@smail.nju.edu.cn>님이 작성:
>
> ntfs_non_resident_attr_insert_range() allocates hole_rl before mapping the
> whole runlist. If ntfs_attr_map_whole_runlist() fails, the error path drops
> ni->runlist.lock and returns without freeing hole_rl. This leaks memory
> of sizeof(*hole_rl) * 2 bytes.
>
> Fix this memory leak by freeing hole_rl before returning from
> that error path, matching the later error paths in the same function.
>
> Fixes: 495e90fa3348 ("ntfs: update attrib operations")
> Cc: stable@vger.kernel.org
> Signed-off-by: Peiyang He <peiyang_he@smail.nju.edu.cn>

Looks good to me.

Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>

> ---
> Changes in v2:
>   - modify commit message to resolve checkpatch.pl warning
>   - add Cc: stable@vger.kernel.org tag to the commit message
>
>  fs/ntfs/attrib.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/fs/ntfs/attrib.c b/fs/ntfs/attrib.c
> index dd8828098511..55603df0a2ed 100644
> --- a/fs/ntfs/attrib.c
> +++ b/fs/ntfs/attrib.c
> @@ -5325,6 +5325,7 @@ int ntfs_non_resident_attr_insert_range(struct ntfs_inode *ni, s64 start_vcn, s6
>         ret = ntfs_attr_map_whole_runlist(ni);
>         if (ret) {
>                 up_write(&ni->runlist.lock);
> +               kfree(hole_rl);
>                 return ret;
>         }
>
>
> base-commit: 1a3746ccbb0a97bed3c06ccde6b880013b1dddc1
> --
> 2.43.0
>


-- 
Thanks,
Hyunchul

Re: [PATCH v2] ntfs: fix hole runlist memory leak in insert range error path

[Namjae Jeon]

On Sun, Jul 5, 2026 at 8:14 PM Peiyang He <peiyang_he@smail.nju.edu.cn> wrote:
>
> ntfs_non_resident_attr_insert_range() allocates hole_rl before mapping the
> whole runlist. If ntfs_attr_map_whole_runlist() fails, the error path drops
> ni->runlist.lock and returns without freeing hole_rl. This leaks memory
> of sizeof(*hole_rl) * 2 bytes.
>
> Fix this memory leak by freeing hole_rl before returning from
> that error path, matching the later error paths in the same function.
>
> Fixes: 495e90fa3348 ("ntfs: update attrib operations")
> Cc: stable@vger.kernel.org
> Signed-off-by: Peiyang He <peiyang_he@smail.nju.edu.cn>
Applied it to #ntfs-next.
Thanks!