CVE-2026-72205: ntfs: free volume-wide resources on fill_super failure

In the Linux kernel, the following vulnerability has been resolved:

ntfs: free volume-wide resources on fillsuper failure

ntfsfillsuper()'s erroutnow path frees only the volume struct via kfree(vol), leaving several vol-owned allocations behind on every mount failure:

- vol->nlsmap, loaded by ntfsinitfscontext() via loadnlsdefault() (or replaced by an explicit nls= option in ntfsparseparam()), is never unloadnls()'d.

- vol->volumelabel, allocated by loadsystemfiles() through ntfsucstonls() once the $Volume name attribute has been parsed, is not released by loadsystemfiles()'s own error labels nor by the fillsuper() inline cleanup that only runs on dmakeroot() failure. Any later failure inside loadsystemfiles() leaks it.

- vol->lcnemptybitsperpage was kvfree()'d in unlupcaseiputtmpinoerroutnow without clearing the pointer, so it could not be folded into a single common cleanup.

Because the failure paths never call ntfsvolumefree() and never reach the dmakeroot() inline cleanup block (it sits above the label and is jumped over by the loadsystemfiles() / kvmalloc failure gotos), these resources accumulate per failed mount attempt with no chance of recovery short of unloading the module. This is a silent leak: the inodes loaded prior to failure remain hashed but genericshutdownsuper() skips evictinodes() when sb->sroot is unset, so no CHECKDATACORRUPTION warning is emitted either.

Move the per-volume frees down to erroutnow and drop the lcnemptybitsperpage kvfree() from the upper label so the cleanup is performed exactly once on every failure path. Using unconditional kvfree() / kfree() / unloadnls() is safe because they all accept NULL and the upper labels that previously freed nlsmap (the dmakeroot() inline cleanup) already clear the pointer.