[PATCH v3] vhost-scsi: zero misaligned I/O bounce pages

[PATCH v3] vhost-scsi: zero misaligned I/O bounce pages

[Shubham Antil]

The misaligned I/O fallback copies the full bounce scatterlist to the
request buffer during completion.  If a data-in command transfers less
than requested, part of a newly allocated bounce page can remain unwritten.

Allocate bounce pages with __GFP_ZERO so all bytes copied during completion
have a defined value.  This path is already the slow fallback for
misaligned I/O, so the added initialization cost is acceptable.

Found during an LLM-assisted source audit and validated with a QEMU/KVM
vhost-scsi target using misaligned data-in commands.

Fixes: 5ced58bfa132 ("vhost-scsi: Fix alignment handling with windows")
Cc: stable@vger.kernel.org
Assisted-by: LLM (OpenAI Codex, gpt-5.6-sol)
Signed-off-by: Shubham Antil <shubham@octane.security>
---
Changes in v3:
- Restore allocation-time zeroing after review confirmed that this is an
  already slow and uncommon bounce-buffer fallback.
- Keep the change minimal and document why the zeroing is required.
- Drop the transfer-length copy-back change from v2.
- Add the discovery method and the requested Fixes, stable Cc, Assisted-by,
  and Signed-off-by tags.

 drivers/vhost/scsi.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 885fac5ed042..8493a372de6c 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -937,7 +937,12 @@ vhost_scsi_copy_iov_to_sgl(struct vhost_scsi_cmd *cmd, struct iov_iter *iter,
 	}
 
 	for_each_sgtable_sg(sg_table, sg, i) {
-		page = alloc_page(GFP_KERNEL);
+		/*
+		 * Completion copies the full bounce buffer, including bytes the
+		 * target did not write. This is already the slow fallback for
+		 * misaligned I/O, so zeroing is acceptable here.
+		 */
+		page = alloc_page(GFP_KERNEL | __GFP_ZERO);
 		if (!page) {
 			ret = -ENOMEM;
 			goto err;

base-commit: c69023b5e16e5ffe9368603dca76d85bd544ee57
-- 
2.43.0

Re: [PATCH v3] vhost-scsi: zero misaligned I/O bounce pages

[sashiko-bot]

> The misaligned I/O fallback copies the full bounce scatterlist to the
> request buffer during completion.  If a data-in command transfers less
> than requested, part of a newly allocated bounce page can remain unwritten.
> 
> Allocate bounce pages with __GFP_ZERO so all bytes copied during completion
> have a defined value.  This path is already the slow fallback for
> misaligned I/O, so the added initialization cost is acceptable.
> 
> Found during an LLM-assisted source audit and validated with a QEMU/KVM
> vhost-scsi target using misaligned data-in commands.
> 
> Fixes: 5ced58bfa132 ("vhost-scsi: Fix alignment handling with windows")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM (OpenAI Codex, gpt-5.6-sol)
> Signed-off-by: Shubham Antil <shubham@octane.security>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261020105503.75904-1-shubham@octane.security?part=1

Re: [PATCH v3] vhost-scsi: zero misaligned I/O bounce pages

[Mike Christie]

On 10/20/26 5:55 AM, Shubham Antil wrote:
> The misaligned I/O fallback copies the full bounce scatterlist to the
> request buffer during completion.  If a data-in command transfers less
> than requested, part of a newly allocated bounce page can remain unwritten.
> 
> Allocate bounce pages with __GFP_ZERO so all bytes copied during completion
> have a defined value.  This path is already the slow fallback for
> misaligned I/O, so the added initialization cost is acceptable.
> 
> Found during an LLM-assisted source audit and validated with a QEMU/KVM
> vhost-scsi target using misaligned data-in commands.
> 
> Fixes: 5ced58bfa132 ("vhost-scsi: Fix alignment handling with windows")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM (OpenAI Codex, gpt-5.6-sol)
> Signed-off-by: Shubham Antil <shubham@octane.security>
> ---
> Changes in v3:
> - Restore allocation-time zeroing after review confirmed that this is an
>    already slow and uncommon bounce-buffer fallback.
> - Keep the change minimal and document why the zeroing is required.
> - Drop the transfer-length copy-back change from v2.
> - Add the discovery method and the requested Fixes, stable Cc, Assisted-by,
>    and Signed-off-by tags.
> 
>   drivers/vhost/scsi.c | 7 ++++++-
>   1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
> index 885fac5ed042..8493a372de6c 100644
> --- a/drivers/vhost/scsi.c
> +++ b/drivers/vhost/scsi.c
> @@ -937,7 +937,12 @@ vhost_scsi_copy_iov_to_sgl(struct vhost_scsi_cmd *cmd, struct iov_iter *iter,
>   	}
>   
>   	for_each_sgtable_sg(sg_table, sg, i) {
> -		page = alloc_page(GFP_KERNEL);
> +		/*
> +		 * Completion copies the full bounce buffer, including bytes the
> +		 * target did not write. This is already the slow fallback for
> +		 * misaligned I/O, so zeroing is acceptable here.
> +		 */
> +		page = alloc_page(GFP_KERNEL | __GFP_ZERO);
>   		if (!page) {
>   			ret = -ENOMEM;
>   			goto err;
> 
Reviewed-by: Mike Christie <michael.christie@oracle.com>