[PATCH v2] vhost-scsi: fix page reference leak in misaligned I/O fallback

[PATCH v2] vhost-scsi: fix page reference leak in misaligned I/O fallback

[Jia Jia]

iov_iter_get_pages2() returns a byte count that excludes the offset into
the first page, but also returns a reference to that page in pages[].

On the misaligned-I/O fallback, vhost_scsi_revert_map_iov_to_sgl() puts
pages already added to the SG list. The cleanup loop starts at
pages[npages], but accounts for its first page as PAGE_SIZE bytes
rather than PAGE_SIZE - offset. If the remaining data starts at a
non-zero offset, it can finish one page early and leave a page reference
behind.

Use PAGE_SIZE - offset for the first remaining page and clear offset for
later pages, as in the mapping loop. Without this, each affected request
leaks one page reference.

Fixes: bca939d5bcd0 ("vhost-scsi: Dynamically allocate scatterlists")
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Jia Jia <physicalmtea@gmail.com>
---
Testing:

- Four fileio vhost-scsi test instances repeatedly issued affected writes
  using recycled backing pages. After about 1.33 million requests,
  MemAvailable fell from 5.3 GB to 13 MB and swap was nearly exhausted.

The affected fallback is reachable from guest-issued virtio-scsi I/O.

 drivers/vhost/scsi.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 4f8c0260bc9e..b0a536fbc69a 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -883,11 +883,16 @@ vhost_scsi_map_to_sgl(struct vhost_scsi_cmd *cmd,
 	vhost_scsi_revert_map_iov_to_sgl(iter, *sgl, sg);
 
 	iov_iter_revert(iter, bytes);
+	/*
+	 * pages[npages] is the first page not added to the SG list.
+	 * The remaining data starts at offset in that page.
+	 */
 	while (bytes) {
-		n = min_t(unsigned int, PAGE_SIZE, bytes);
+		n = min_t(unsigned int, PAGE_SIZE - offset, bytes);
 
 		put_page(pages[npages++]);
 		bytes -= n;
+		offset = 0;
 	}
 
 	return -EINVAL;
-- 
2.34.1

Re: [PATCH v2] vhost-scsi: fix page reference leak in misaligned I/O fallback

[sashiko-bot]

> iov_iter_get_pages2() returns a byte count that excludes the offset into
> the first page, but also returns a reference to that page in pages[].
> 
> On the misaligned-I/O fallback, vhost_scsi_revert_map_iov_to_sgl() puts
> pages already added to the SG list. The cleanup loop starts at
> pages[npages], but accounts for its first page as PAGE_SIZE bytes
> rather than PAGE_SIZE - offset. If the remaining data starts at a
> non-zero offset, it can finish one page early and leave a page reference
> behind.
> 
> Use PAGE_SIZE - offset for the first remaining page and clear offset for
> later pages, as in the mapping loop. Without this, each affected request
> leaks one page reference.
> 
> Fixes: bca939d5bcd0 ("vhost-scsi: Dynamically allocate scatterlists")
> Reviewed-by: Mike Christie <michael.christie@oracle.com>
> Signed-off-by: Jia Jia <physicalmtea@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261023104035.6686-1-physicalmtea@gmail.com?part=1