hfs: add error checking for hfs_find_init()

hfs_find_init() may fail with ENOMEM, but there are places, where the
returned value is not checked.  The consequences can be very unpleasant,
e.g.  kfree uninitialized pointer and inappropriate mutex unlocking.

The patch adds checks for errors in hfs_find_init().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Reviewed-by: Vyacheslav Dubeyko <slava@dubeyko.com>
Cc: Hin-Tak Leung <htl10@users.sourceforge.net>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 3 insertions, 1 deletions

diff --git a/fs/hfs/super.c b/fs/hfs/super.c
index bbaaa8a4ee64..719760b2b0a6 100644
--- a/fs/hfs/super.c
+++ b/fs/hfs/super.c
@@ -418,7 +418,9 @@ static int hfs_fill_super(struct super_block *sb, void *data, int silent)
         }
 
         /* try to get the root inode */
-        hfs_find_init(HFS_SB(sb)->cat_tree, &fd);
+        res = hfs_find_init(HFS_SB(sb)->cat_tree, &fd);
+        if (res)
+                goto bail_no_root;
         res = hfs_cat_find_brec(sb, HFS_ROOT_CNID, &fd);
         if (!res) {
                 if (fd.entrylength > sizeof(rec) || fd.entrylength < 0) {