Re: [PATCH v3] vhost-scsi: zero misaligned I/O bounce pages

[Mike Christie <michael.christie@oracle.com>]

On 10/20/26 5:55 AM, Shubham Antil wrote:
> The misaligned I/O fallback copies the full bounce scatterlist to the
> request buffer during completion.  If a data-in command transfers less
> than requested, part of a newly allocated bounce page can remain unwritten.
> 
> Allocate bounce pages with __GFP_ZERO so all bytes copied during completion
> have a defined value.  This path is already the slow fallback for
> misaligned I/O, so the added initialization cost is acceptable.
> 
> Found during an LLM-assisted source audit and validated with a QEMU/KVM
> vhost-scsi target using misaligned data-in commands.
> 
> Fixes: 5ced58bfa132 ("vhost-scsi: Fix alignment handling with windows")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM (OpenAI Codex, gpt-5.6-sol)
> Signed-off-by: Shubham Antil <shubham@octane.security>
> ---
> Changes in v3:
> - Restore allocation-time zeroing after review confirmed that this is an
>    already slow and uncommon bounce-buffer fallback.
> - Keep the change minimal and document why the zeroing is required.
> - Drop the transfer-length copy-back change from v2.
> - Add the discovery method and the requested Fixes, stable Cc, Assisted-by,
>    and Signed-off-by tags.
> 
>   drivers/vhost/scsi.c | 7 ++++++-
>   1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
> index 885fac5ed042..8493a372de6c 100644
> --- a/drivers/vhost/scsi.c
> +++ b/drivers/vhost/scsi.c
> @@ -937,7 +937,12 @@ vhost_scsi_copy_iov_to_sgl(struct vhost_scsi_cmd *cmd, struct iov_iter *iter,
>   	}
>   
>   	for_each_sgtable_sg(sg_table, sg, i) {
> -		page = alloc_page(GFP_KERNEL);
> +		/*
> +		 * Completion copies the full bounce buffer, including bytes the
> +		 * target did not write. This is already the slow fallback for
> +		 * misaligned I/O, so zeroing is acceptable here.
> +		 */
> +		page = alloc_page(GFP_KERNEL | __GFP_ZERO);
>   		if (!page) {
>   			ret = -ENOMEM;
>   			goto err;
> 
Reviewed-by: Mike Christie <michael.christie@oracle.com>