block: fix NULL pointer dereferenced within __blk_rq_map_sg

JIRA: https://issues.redhat.com/browse/RHEL-79409

commit dd8b058
Author: Ming Lei <ming.lei@redhat.com>
Date:   Mon Feb 17 11:16:26 2025 +0800

    block: fix NULL pointer dereferenced within __blk_rq_map_sg

    The block layer internal flush request may not have bio attached, so the
    request iterator has to be initialized from valid req->bio, otherwise NULL
    pointer dereferenced is triggered.

    Cc: Christoph Hellwig <hch@lst.de>
    Reported-and-tested-by: Cheyenne Wills <cheyenne.wills@gmail.com>
    Fixes: b7175e2 ("block: add a dma mapping iterator")
    Signed-off-by: Ming Lei <ming.lei@redhat.com>
    Reviewed-by: Christoph Hellwig <hch@lst.de>
    Link: https://lore.kernel.org/r/20250217031626.461977-1-ming.lei@redhat.com
    Signed-off-by: Jens Axboe <axboe@kernel.dk>

Signed-off-by: Ming Lei <ming.lei@redhat.com>

Author: Ming Lei

block/blk-merge.c

@@ -556,11 +556,14 @@ int __blk_rq_map_sg(struct request_queue *q, struct request *rq,
 {
 	struct req_iterator iter = {
 		.bio	= rq->bio,
-		.iter	= rq->bio->bi_iter,
 	};
 	struct phys_vec vec;
 	int nsegs = 0;
 
+	/* the internal flush request may not have bio attached */
+	if (iter.bio)
+		iter.iter = iter.bio->bi_iter;
+
 	while (blk_map_iter_next(rq, &iter, &vec)) {
 		*last_sg = blk_next_sg(last_sg, sglist);
 		sg_set_page(*last_sg, phys_to_page(vec.paddr), vec.len,