The variable ctx can be null and once confirmed to be null in its error
path goes to label err_out. Once there it can be immediately dereferenced
by the function ntfs_attr_put_search_ctx() which has no null pointer check.

Detected by Smatch:
fs/ntfs/ea.c:687 ntfs_new_attr_flags() error: 
we previously assumed 'ctx' could be null (see line 577)

Add null pointer check before running  ntfs_attr_put_search_ctx() in 
error path.

Fixes: fc053f05ca282 ("ntfs: add reparse and ea operations")
Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
---
 fs/ntfs/ea.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/ntfs/ea.c b/fs/ntfs/ea.c
index 82ad9b61ec64..b2b0a9a043a9 100644
--- a/fs/ntfs/ea.c
+++ b/fs/ntfs/ea.c
@@ -684,7 +684,8 @@ static int ntfs_new_attr_flags(struct ntfs_inode *ni, __le32 fattr)
 	a->flags = new_aflags;
 	mark_mft_record_dirty(ctx->ntfs_ino);
 err_out:
-	ntfs_attr_put_search_ctx(ctx);
+	if (ctx)
+		ntfs_attr_put_search_ctx(ctx);
 	unmap_mft_record(ni);
 	return err;
 }
-- 
2.53.0

On Thu, Feb 26, 2026 at 7:25 AM Ethan Tidmore <ethantidmore06@gmail.com> wrote:
>
> The variable ctx can be null and once confirmed to be null in its error
> path goes to label err_out. Once there it can be immediately dereferenced
> by the function ntfs_attr_put_search_ctx() which has no null pointer check.
>
> Detected by Smatch:
> fs/ntfs/ea.c:687 ntfs_new_attr_flags() error:
> we previously assumed 'ctx' could be null (see line 577)
>
> Add null pointer check before running  ntfs_attr_put_search_ctx() in
> error path.
>
> Fixes: fc053f05ca282 ("ntfs: add reparse and ea operations")
> Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
Applied it to #ntfs-next.
Thanks!

On Wed, Feb 25, 2026 at 04:24:53PM -0600, Ethan Tidmore wrote:
> The variable ctx can be null and once confirmed to be null in its error
> path goes to label err_out. Once there it can be immediately dereferenced
> by the function ntfs_attr_put_search_ctx() which has no null pointer check.
> 
> Detected by Smatch:
> fs/ntfs/ea.c:687 ntfs_new_attr_flags() error: 
> we previously assumed 'ctx' could be null (see line 577)
> 
> Add null pointer check before running  ntfs_attr_put_search_ctx() in 
> error path.
> 
> Fixes: fc053f05ca282 ("ntfs: add reparse and ea operations")
> Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>

Looks good to me. Thanks for the patch.

Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>

> ---
>  fs/ntfs/ea.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/ntfs/ea.c b/fs/ntfs/ea.c
> index 82ad9b61ec64..b2b0a9a043a9 100644
> --- a/fs/ntfs/ea.c
> +++ b/fs/ntfs/ea.c
> @@ -684,7 +684,8 @@ static int ntfs_new_attr_flags(struct ntfs_inode *ni, __le32 fattr)
>  	a->flags = new_aflags;
>  	mark_mft_record_dirty(ctx->ntfs_ino);
>  err_out:
> -	ntfs_attr_put_search_ctx(ctx);
> +	if (ctx)
> +		ntfs_attr_put_search_ctx(ctx);
>  	unmap_mft_record(ni);
>  	return err;
>  }
> -- 
> 2.53.0
> 

-- 
Thanks,
Hyunchul