From: Ming Lei Date: Mon, 17 Feb 2025 03:16:26 +0000 (+0800) Subject: block: fix NULL pointer dereferenced within __blk_rq_map_sg X-Git-Tag: nvme-6.14-2025-03-05~11 X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=dd8b0582e25e36bba483c60338741c0ba5bc426c;p=nvme.git block: fix NULL pointer dereferenced within __blk_rq_map_sg The block layer internal flush request may not have bio attached, so the request iterator has to be initialized from valid req->bio, otherwise NULL pointer dereferenced is triggered. Cc: Christoph Hellwig Reported-and-tested-by: Cheyenne Wills Fixes: b7175e24d6ac ("block: add a dma mapping iterator") Signed-off-by: Ming Lei Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20250217031626.461977-1-ming.lei@redhat.com Signed-off-by: Jens Axboe --- diff --git a/block/blk-merge.c b/block/blk-merge.c index 39b738c0e4c9..c7c85e10cf9c 100644 --- a/block/blk-merge.c +++ b/block/blk-merge.c @@ -556,11 +556,14 @@ int __blk_rq_map_sg(struct request_queue *q, struct request *rq, { struct req_iterator iter = { .bio = rq->bio, - .iter = rq->bio->bi_iter, }; struct phys_vec vec; int nsegs = 0; + /* the internal flush request may not have bio attached */ + if (iter.bio) + iter.iter = iter.bio->bi_iter; + while (blk_map_iter_next(rq, &iter, &vec)) { *last_sg = blk_next_sg(last_sg, sglist); sg_set_page(*last_sg, phys_to_page(vec.paddr), vec.len,