Re: BUG: NULL pointer dereferenced within __blk_rq_map_sg

[Ming Lei <ming.lei@redhat.com>]

On Fri, Feb 07, 2025 at 07:09:39PM -0700, Cheyenne Wills wrote:
> While I was setting up to test with linux 6.14-rc1 (under Xen), I ran
> into a consistent NULL ptr dereference within __blk_rq_map_sg when
> booting the system.
> 
> Using git bisect I was able to narrow down the "bad" commit to:
> 
> block: add a dma mapping iterator (b7175e24d6acf79d9f3af9ce9d3d50de1fa748ec)
> 
> Building a kernel with the parent commit
> (2caca8fc7aad9ea9a6ea3ed26ed146b1e5f06fab) using the same .config does
> not fail.
> 
> Following is the console log showing the error as well as the Xen
> (libvirt) configuration for the guest that I'm using.
> 
> Please let me know if there is any additional information that I can provide.

Can you test the following patch?


diff --git a/block/blk-merge.c b/block/blk-merge.c
index b55c52a42303..1eabde8383fb 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -493,7 +493,7 @@ static bool blk_map_iter_next(struct request *req,
 		return true;
 	}
 
-	if (!iter->iter.bi_size)
+	if (!iter->bio || !iter->iter.bi_size)
 		return false;
 
 	bv = mp_bvec_iter_bvec(iter->bio->bi_io_vec, iter->iter);
@@ -514,7 +514,8 @@ static bool blk_map_iter_next(struct request *req,
 			if (!iter->bio->bi_next)
 				break;
 			iter->bio = iter->bio->bi_next;
-			iter->iter = iter->bio->bi_iter;
+			if (iter->bio)
+				iter->iter = iter->bio->bi_iter;
 		}
 
 		next = mp_bvec_iter_bvec(iter->bio->bi_io_vec, iter->iter);


Thanks,
Ming