[PATCH] vhost-scsi: fix page reference leak in misaligned I/O fallback

[PATCH] vhost-scsi: fix page reference leak in misaligned I/O fallback

[Jia Jia]

iov_iter_get_pages2() returns a byte count that excludes the offset
into the first page, but also returns a reference to that page in
pages[].

On the misaligned-I/O fallback,
vhost_scsi_revert_map_iov_to_sgl() puts pages already added to the SG
list.  The cleanup loop starts at pages[npages], but accounts for its
first page as PAGE_SIZE bytes rather than PAGE_SIZE - offset.  If the
remaining data starts at a non-zero offset, it can finish one page
early and leave a page reference behind.

Use PAGE_SIZE - offset for the first remaining page and clear offset
for later pages, as in the mapping loop.  Without this, each affected
request leaks one page reference.

Fixes: bca939d5bcd0 ("vhost-scsi: Dynamically allocate scatterlists")
Signed-off-by: Jia Jia <physicalmtea@gmail.com>
---
Testing:

- Four fileio vhost-scsi test instances repeatedly issued affected
  writes using recycled backing pages.  After about 1.33 million
  requests, MemAvailable fell from 5.3 GB to 13 MB and swap was nearly
  exhausted.

The affected fallback is reachable from guest-issued virtio-scsi I/O.

 drivers/vhost/scsi.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 4f8c0260bc9e..b7e41c0a91d4 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -883,11 +883,16 @@ vhost_scsi_map_to_sgl(struct vhost_scsi_cmd *cmd,
 	vhost_scsi_revert_map_iov_to_sgl(iter, *sgl, sg);
 
 	iov_iter_revert(iter, bytes);
+	/*
+	 * pages[npages] is the first page not added to the SG list.  The
+	 * remaining data starts at offset in that page.
+	 */
 	while (bytes) {
-		n = min_t(unsigned int, PAGE_SIZE, bytes);
+		n = min_t(unsigned int, PAGE_SIZE - offset, bytes);
 
 		put_page(pages[npages++]);
 		bytes -= n;
+		offset = 0;
 	}
 
 	return -EINVAL;
-- 
2.47.0

Re: [PATCH] vhost-scsi: fix page reference leak in misaligned I/O fallback

[sashiko-bot]

> iov_iter_get_pages2() returns a byte count that excludes the offset
> into the first page, but also returns a reference to that page in
> pages[].
> 
> On the misaligned-I/O fallback,
> vhost_scsi_revert_map_iov_to_sgl() puts pages already added to the SG
> list.  The cleanup loop starts at pages[npages], but accounts for its
> first page as PAGE_SIZE bytes rather than PAGE_SIZE - offset.  If the
> remaining data starts at a non-zero offset, it can finish one page
> early and leave a page reference behind.
> 
> Use PAGE_SIZE - offset for the first remaining page and clear offset
> for later pages, as in the mapping loop.  Without this, each affected
> request leaks one page reference.
> 
> Fixes: bca939d5bcd0 ("vhost-scsi: Dynamically allocate scatterlists")
> Signed-off-by: Jia Jia <physicalmtea@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261021085458.196742-1-physicalmtea@gmail.com?part=1

Re: [PATCH] vhost-scsi: fix page reference leak in misaligned I/O fallback

[Mike Christie]

On 10/21/26 3:54 AM, Jia Jia wrote:
> diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
> index 4f8c0260bc9e..b7e41c0a91d4 100644
> --- a/drivers/vhost/scsi.c
> +++ b/drivers/vhost/scsi.c
> @@ -883,11 +883,16 @@ vhost_scsi_map_to_sgl(struct vhost_scsi_cmd *cmd,
>   	vhost_scsi_revert_map_iov_to_sgl(iter, *sgl, sg);
>   
>   	iov_iter_revert(iter, bytes);
> +	/*
> +	 * pages[npages] is the first page not added to the SG list.  The

Just a minor nit. There's an extra space before "The" in the comment.

Patch looks ok otherwise. Thanks.

Reviewed-by: Mike Christie <michael.christie@oracle.com>


> +	 * remaining data starts at offset in that page.
> +	 */
>   	while (bytes) {
> -		n = min_t(unsigned int, PAGE_SIZE, bytes);
> +		n = min_t(unsigned int, PAGE_SIZE - offset, bytes);
>   
>   		put_page(pages[npages++]);
>   		bytes -= n;
> +		offset = 0;
>   	}
>   
>   	return -EINVAL;
> -- 
> 2.47.0
> 

Re: [PATCH] vhost-scsi: fix page reference leak in misaligned I/O fallback

[Jia Jia]

>
> On 10/21/26 3:54 AM, Jia Jia wrote:
> > diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
> > index 4f8c0260bc9e..b7e41c0a91d4 100644
> > --- a/drivers/vhost/scsi.c
> > +++ b/drivers/vhost/scsi.c
> > @@ -883,11 +883,16 @@ vhost_scsi_map_to_sgl(struct vhost_scsi_cmd *cmd,
> >       vhost_scsi_revert_map_iov_to_sgl(iter, *sgl, sg);
> >
> >       iov_iter_revert(iter, bytes);
> > +     /*
> > +      * pages[npages] is the first page not added to the SG list.  The
>
> Just a minor nit. There's an extra space before "The" in the comment.
>

Thanks for pointing this out. I'll remove it and send a v2.

> Patch looks ok otherwise. Thanks.
>
> Reviewed-by: Mike Christie <michael.christie@oracle.com>
>
>
> > +      * remaining data starts at offset in that page.
> > +      */
> >       while (bytes) {
> > -             n = min_t(unsigned int, PAGE_SIZE, bytes);
> > +             n = min_t(unsigned int, PAGE_SIZE - offset, bytes);
> >
> >               put_page(pages[npages++]);
> >               bytes -= n;
> > +             offset = 0;
> >       }
> >
> >       return -EINVAL;
> > --
> > 2.47.0
> >
>