Re: BUG: NULL pointer dereferenced within __blk_rq_map_sg

[Ming Lei <ming.lei@redhat.com>]

On Tue, Feb 11, 2025 at 08:13:16PM +0800, Ming Lei wrote:
> On Fri, Feb 07, 2025 at 07:09:39PM -0700, Cheyenne Wills wrote:
> > While I was setting up to test with linux 6.14-rc1 (under Xen), I ran
> > into a consistent NULL ptr dereference within __blk_rq_map_sg when
> > booting the system.
> > 
> > Using git bisect I was able to narrow down the "bad" commit to:
> > 
> > block: add a dma mapping iterator (b7175e24d6acf79d9f3af9ce9d3d50de1fa748ec)
> > 
> > Building a kernel with the parent commit
> > (2caca8fc7aad9ea9a6ea3ed26ed146b1e5f06fab) using the same .config does
> > not fail.
> > 
> > Following is the console log showing the error as well as the Xen
> > (libvirt) configuration for the guest that I'm using.
> > 
> > Please let me know if there is any additional information that I can provide.
> 
> Can you test the following patch?
> 

Please try the revised one:


diff --git a/block/blk-merge.c b/block/blk-merge.c
index 15cd231d560c..a66d087a6b55 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -493,7 +493,7 @@ static bool blk_map_iter_next(struct request *req,
 		return true;
 	}
 
-	if (!iter->iter.bi_size)
+	if (!iter->bio || !iter->iter.bi_size)
 		return false;
 
 	bv = mp_bvec_iter_bvec(iter->bio->bi_io_vec, iter->iter);
@@ -514,6 +514,8 @@ static bool blk_map_iter_next(struct request *req,
 			if (!iter->bio->bi_next)
 				break;
 			iter->bio = iter->bio->bi_next;
+			if (!iter->bio)
+				break;
 			iter->iter = iter->bio->bi_iter;
 		}
 



Thanks,
Ming