block: fix NULL pointer dereferenced within __blk_rq_map_sg

The block layer internal flush request may not have bio attached, so the
request iterator has to be initialized from valid req->bio, otherwise NULL
pointer dereferenced is triggered.

Cc: Christoph Hellwig <hch@lst.de>
Reported-and-tested-by: Cheyenne Wills <cheyenne.wills@gmail.com>
Fixes: b7175e24d6ac ("block: add a dma mapping iterator")
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20250217031626.461977-1-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/block/blk-merge.c b/block/blk-merge.c
index 39b738c0e4c9a9b4b950807ebc13a1ba4a012dc9..c7c85e10cf9cb396674f49702d018d6dabfeaa5c 100644 (file)
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -556,11 +556,14 @@ int __blk_rq_map_sg(struct request_queue *q, struct request *rq,
 {
        struct req_iterator iter = {
                .bio    = rq->bio,
-               .iter   = rq->bio->bi_iter,
        };
        struct phys_vec vec;
        int nsegs = 0;
 
+       /* the internal flush request may not have bio attached */
+       if (iter.bio)
+               iter.iter = iter.bio->bi_iter;
+
        while (blk_map_iter_next(rq, &iter, &vec)) {
                *last_sg = blk_next_sg(last_sg, sglist);
                sg_set_page(*last_sg, phys_to_page(vec.paddr), vec.len,