Discard request may use special payload only and doesn't have bio
attached, so the request iterator has to be initialized from valid
req->bio, otherwise NULL pointer dereferenced is triggered.
Cc: Christoph Hellwig <hch@xxxxxx>
Reported-and-tested-by: Cheyenne Wills <cheyenne.wills@xxxxxxxxx>
Fixes: b7175e24d6ac ("block: add a dma mapping iterator")
Signed-off-by: Ming Lei <ming.lei@xxxxxxxxxx>
---
block/blk-merge.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/block/blk-merge.c b/block/blk-merge.c
index b55c52a42303..48a96aed15b6 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -556,11 +556,14 @@ int __blk_rq_map_sg(struct request_queue *q, struct request *rq,
{
struct req_iterator iter = {
.bio = rq->bio,
- .iter = rq->bio->bi_iter,
};
struct phys_vec vec;
int nsegs = 0;
+ /* discard request may not have bio attached */
+ if (iter.bio)
+ iter.iter = iter.bio->bi_iter;
+
while (blk_map_iter_next(rq, &iter, &vec)) {
*last_sg = blk_next_sg(last_sg, sglist);
sg_set_page(*last_sg, phys_to_page(vec.paddr), vec.len,
--
2.47.1
