bcachefs: Fix null ptr deref in twf from BCH_IOCTL_FSCK_OFFLINE

We need to initialize the stdio redirects before they're used.

Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>

diff --git a/fs/bcachefs/chardev.c b/fs/bcachefs/chardev.c
index 72781aad6ba70ccc774b688c6a9d50b2dc21f133..4d14f19f51850e9d024ee69bd1f68d5a3743a2b0 100644 (file)
--- a/fs/bcachefs/chardev.c
+++ b/fs/bcachefs/chardev.c
@@ -232,13 +232,15 @@ static long bch2_ioctl_fsck_offline(struct bch_ioctl_fsck_offline __user *user_a
        /* We need request_key() to be called before we punt to kthread: */
        opt_set(thr->opts, nostart, true);
 
+       bch2_thread_with_stdio_init(&thr->thr, &bch2_offline_fsck_ops);
+
        thr->c = bch2_fs_open(devs.data, arg.nr_devs, thr->opts);
 
        if (!IS_ERR(thr->c) &&
            thr->c->opts.errors == BCH_ON_ERROR_panic)
                thr->c->opts.errors = BCH_ON_ERROR_ro;
 
-       ret = bch2_run_thread_with_stdio(&thr->thr, &bch2_offline_fsck_ops);
+       ret = __bch2_run_thread_with_stdio(&thr->thr);
 out:
        darray_for_each(devs, i)
                kfree(*i);

diff --git a/fs/bcachefs/thread_with_file.c b/fs/bcachefs/thread_with_file.c
index 940db15d6a939bf93281627e9759904e4a6531f3..b1af7ac430f662aa2b827d0c6550ef6187089352 100644 (file)
--- a/fs/bcachefs/thread_with_file.c
+++ b/fs/bcachefs/thread_with_file.c
@@ -294,16 +294,27 @@ static int thread_with_stdio_fn(void *arg)
        return 0;
 }
 
-int bch2_run_thread_with_stdio(struct thread_with_stdio *thr,
-                              const struct thread_with_stdio_ops *ops)
+void bch2_thread_with_stdio_init(struct thread_with_stdio *thr,
+                                const struct thread_with_stdio_ops *ops)
 {
        stdio_buf_init(&thr->stdio.input);
        stdio_buf_init(&thr->stdio.output);
        thr->ops = ops;
+}
 
+int __bch2_run_thread_with_stdio(struct thread_with_stdio *thr)
+{
        return bch2_run_thread_with_file(&thr->thr, &thread_with_stdio_fops, thread_with_stdio_fn);
 }
 
+int bch2_run_thread_with_stdio(struct thread_with_stdio *thr,
+                              const struct thread_with_stdio_ops *ops)
+{
+       bch2_thread_with_stdio_init(thr, ops);
+
+       return __bch2_run_thread_with_stdio(thr);
+}
+
 int bch2_run_thread_with_stdout(struct thread_with_stdio *thr,
                                const struct thread_with_stdio_ops *ops)
 {

diff --git a/fs/bcachefs/thread_with_file.h b/fs/bcachefs/thread_with_file.h
index af54ea8f5b0ff85871c915e275187c29b7b0c6f1..1d63d14d7dcae811a21e49a0cc509407daf7584c 100644 (file)
--- a/fs/bcachefs/thread_with_file.h
+++ b/fs/bcachefs/thread_with_file.h
@@ -63,6 +63,9 @@ struct thread_with_stdio {
        const struct thread_with_stdio_ops      *ops;
 };
 
+void bch2_thread_with_stdio_init(struct thread_with_stdio *,
+                                const struct thread_with_stdio_ops *);
+int __bch2_run_thread_with_stdio(struct thread_with_stdio *);
 int bch2_run_thread_with_stdio(struct thread_with_stdio *,
                               const struct thread_with_stdio_ops *);
 int bch2_run_thread_with_stdout(struct thread_with_stdio *,