hfs: add error checking for hfs_find_init()

hfs_find_init() may fail with ENOMEM, but there are places, where the
returned value is not checked.  The consequences can be very unpleasant,
e.g.  kfree uninitialized pointer and inappropriate mutex unlocking.

The patch adds checks for errors in hfs_find_init().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Reviewed-by: Vyacheslav Dubeyko <slava@dubeyko.com>
Cc: Hin-Tak Leung <htl10@users.sourceforge.net>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 9 insertions, 3 deletions

diff --git a/fs/hfs/catalog.c b/fs/hfs/catalog.c
index 424b0337f524..9569b39257ec 100644
--- a/fs/hfs/catalog.c
+++ b/fs/hfs/catalog.c
@@ -92,7 +92,9 @@ int hfs_cat_create(u32 cnid, struct inode *dir, struct qstr *str, struct inode *
                 return -ENOSPC;
 
         sb = dir->i_sb;
-        hfs_find_init(HFS_SB(sb)->cat_tree, &fd);
+        err = hfs_find_init(HFS_SB(sb)->cat_tree, &fd);
+        if (err)
+                return err;
 
         hfs_cat_build_key(sb, fd.search_key, cnid, NULL);
         entry_size = hfs_cat_build_thread(sb, &entry, S_ISDIR(inode->i_mode) ?
@@ -214,7 +216,9 @@ int hfs_cat_delete(u32 cnid, struct inode *dir, struct qstr *str)
 
         dprint(DBG_CAT_MOD, "delete_cat: %s,%u\n", str ? str->name : NULL, cnid);
         sb = dir->i_sb;
-        hfs_find_init(HFS_SB(sb)->cat_tree, &fd);
+        res = hfs_find_init(HFS_SB(sb)->cat_tree, &fd);
+        if (res)
+                return res;
 
         hfs_cat_build_key(sb, fd.search_key, dir->i_ino, str);
         res = hfs_brec_find(&fd);
@@ -281,7 +285,9 @@ int hfs_cat_move(u32 cnid, struct inode *src_dir, struct qstr *src_name,
         dprint(DBG_CAT_MOD, "rename_cat: %u - %lu,%s - %lu,%s\n", cnid, src_dir->i_ino, src_name->name,
                 dst_dir->i_ino, dst_name->name);
         sb = src_dir->i_sb;
-        hfs_find_init(HFS_SB(sb)->cat_tree, &src_fd);
+        err = hfs_find_init(HFS_SB(sb)->cat_tree, &src_fd);
+        if (err)
+                return err;
         dst_fd = src_fd;
 
         /* find the old dir entry and read the data */