Commit dd8b0582 authored by Ming Lei's avatar Ming Lei Committed by Jens Axboe
Browse files

block: fix NULL pointer dereferenced within __blk_rq_map_sg 



The block layer internal flush request may not have bio attached, so the
request iterator has to be initialized from valid req->bio, otherwise NULL
pointer dereferenced is triggered.

Cc: Christoph Hellwig <hch@lst.de>
Reported-and-tested-by: default avatarCheyenne Wills <cheyenne.wills@gmail.com>
Fixes: b7175e24 ("block: add a dma mapping iterator")
Signed-off-by: default avatarMing Lei <ming.lei@redhat.com>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20250217031626.461977-1-ming.lei@redhat.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 43c70b10

block/blk-merge.c

+4 −1
Original line number Diff line number Diff line
@@ -556,11 +556,14 @@ int __blk_rq_map_sg(struct request_queue *q, struct request *rq, 
{

	struct req_iterator iter = {

		.bio	= rq->bio,

		.iter	= rq->bio->bi_iter,

	};

	struct phys_vec vec;

	int nsegs = 0;



	/* the internal flush request may not have bio attached */

	if (iter.bio)

		iter.iter = iter.bio->bi_iter;



	while (blk_map_iter_next(rq, &iter, &vec)) {

		*last_sg = blk_next_sg(last_sg, sglist);

		sg_set_page(*last_sg, phys_to_page(vec.paddr), vec.len,