| Message ID | 20250217031626.461977-1-ming.lei@redhat.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | [V2] block: fix NULL pointer dereferenced within __blk_rq_map_sg | expand |
Looks good:
Reviewed-by: Christoph Hellwig <hch@lst.de>
On Mon, 17 Feb 2025 11:16:26 +0800, Ming Lei wrote: > The block layer internal flush request may not have bio attached, so the > request iterator has to be initialized from valid req->bio, otherwise NULL > pointer dereferenced is triggered. > > Applied, thanks! [1/1] block: fix NULL pointer dereferenced within __blk_rq_map_sg commit: dd8b0582e25e36bba483c60338741c0ba5bc426c Best regards,
diff --git a/block/blk-merge.c b/block/blk-merge.c index b55c52a42303..143834087d55 100644 --- a/block/blk-merge.c +++ b/block/blk-merge.c @@ -556,11 +556,14 @@ int __blk_rq_map_sg(struct request_queue *q, struct request *rq, { struct req_iterator iter = { .bio = rq->bio, - .iter = rq->bio->bi_iter, }; struct phys_vec vec; int nsegs = 0; + /* the internal flush request may not have bio attached */ + if (iter.bio) + iter.iter = iter.bio->bi_iter; + while (blk_map_iter_next(rq, &iter, &vec)) { *last_sg = blk_next_sg(last_sg, sglist); sg_set_page(*last_sg, phys_to_page(vec.paddr), vec.len,
The block layer internal flush request may not have bio attached, so the request iterator has to be initialized from valid req->bio, otherwise NULL pointer dereferenced is triggered. Cc: Christoph Hellwig <hch@lst.de> Reported-and-tested-by: Cheyenne Wills <cheyenne.wills@gmail.com> Fixes: b7175e24d6ac ("block: add a dma mapping iterator") Signed-off-by: Ming Lei <ming.lei@redhat.com> --- V2: - fix commit log and comment block/blk-merge.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)