diff options
| author | Ming Lei <ming.lei@redhat.com> | 2025-02-17 11:16:26 +0800 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2025-02-17 09:04:07 -0700 |
| commit | dd8b0582e25e36bba483c60338741c0ba5bc426c (patch) | |
| tree | 563164a63e154846fc617dab5d3d3d87df394127 /block | |
| parent | 43c70b104093c324b1a000762ce943d16ce788f9 (diff) | |
block: fix NULL pointer dereferenced within __blk_rq_map_sg
The block layer internal flush request may not have bio attached, so the
request iterator has to be initialized from valid req->bio, otherwise NULL
pointer dereferenced is triggered.
Cc: Christoph Hellwig <hch@lst.de>
Reported-and-tested-by: Cheyenne Wills <cheyenne.wills@gmail.com>
Fixes: b7175e24d6ac ("block: add a dma mapping iterator")
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20250217031626.461977-1-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'block')
| -rw-r--r-- | block/blk-merge.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/block/blk-merge.c b/block/blk-merge.c index 39b738c0e4c9..c7c85e10cf9c 100644 --- a/block/blk-merge.c +++ b/block/blk-merge.c @@ -556,11 +556,14 @@ int __blk_rq_map_sg(struct request_queue *q, struct request *rq, { struct req_iterator iter = { .bio = rq->bio, - .iter = rq->bio->bi_iter, }; struct phys_vec vec; int nsegs = 0; + /* the internal flush request may not have bio attached */ + if (iter.bio) + iter.iter = iter.bio->bi_iter; + while (blk_map_iter_next(rq, &iter, &vec)) { *last_sg = blk_next_sg(last_sg, sglist); sg_set_page(*last_sg, phys_to_page(vec.paddr), vec.len, |