On 7/29/2025 8:04 PM, Keith Busch wrote:
> @@ -39,12 +33,11 @@ static bool blk_map_iter_next(struct request *req, struct req_iterator *iter,
> * one could be merged into it. This typically happens when moving to
> * the next bio, but some callers also don't pack bvecs tight.
> */
> - while (!iter->iter.bi_size || !iter->iter.bi_bvec_done) {
> + while (!iter->iter.bi_size ||
> + (!iter->iter.bi_bvec_done && iter->bio->bi_next)) {
> struct bio_vec next;
>
> if (!iter->iter.bi_size) {
> - if (!iter->bio->bi_next)
> - break;
> iter->bio = iter->bio->bi_next;
> iter->iter = iter->bio->bi_iter;
This can crash here if we come inside the loop because
iter->iter.bi_size is 0
and if this is the last bio i.e., iter->bio->bi_next is NULL?
