[PATCH] ntfs: fix resource leak in ntfs_new_attr_flags

From: Hongling Zeng

Date: Thu Aug 20 2026 - 04:16:10 EST


When handling resident attributes that don't need sparse/compressed
changes, ntfs_new_attr_flags() returns 0 directly at line 678 without
calling unmap_mft_record() or ntfs_attr_put_search_ctx(). This leaks
the MFT record mapping and attribute search context.

An unprivileged user can cause a denial of service by repeatedly
calling setxattr(2) with system.ntfs_attrib on files with resident
attributes, eventually exhausting kernel memory.

Fix by replacing the direct return with goto err_out to ensure proper
cleanup of resources via the existing cleanup code.

Fixes: e791930240a5 ("ntfs: fix resident conversion in ntfs_new_attr_flags")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Hongling Zeng <zenghongling@xxxxxxxxxx>
---
fs/ntfs/ea.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/ntfs/ea.c b/fs/ntfs/ea.c
index 5cd5a4a02d1e..44252f2c2ca6 100644
--- a/fs/ntfs/ea.c
+++ b/fs/ntfs/ea.c
@@ -674,8 +674,10 @@ static int ntfs_new_attr_flags(struct ntfs_inode *ni, __le32 fattr)
}

if (!a->non_resident) {
- if (!(new_aflags & (ATTR_IS_SPARSE | ATTR_IS_COMPRESSED)))
- return 0;
+ if (!(new_aflags & (ATTR_IS_SPARSE | ATTR_IS_COMPRESSED))) {
+ err = 0;
+ goto err_out;
+ }

if (le32_to_cpu(a->data.resident.value_length)) {
pr_err("Can't change sparse/compressed for non-empty file");
--
2.25.1