The misaligned I/O fallback copies the full bounce scatterlist to the
request buffer during completion. If a data-in command transfers less
than requested, part of a newly allocated bounce page can remain unwritten.
Allocate bounce pages with __GFP_ZERO so all bytes copied during completion
have a defined value. This path is already the slow fallback for
misaligned I/O, so the added initialization cost is acceptable.
Found during an LLM-assisted source audit and validated with a QEMU/KVM
vhost-scsi target using misaligned data-in commands.
Fixes: 5ced58bfa132 ("vhost-scsi: Fix alignment handling with windows")
Cc: [email protected]
Assisted-by: LLM (OpenAI Codex, gpt-5.6-sol)
Signed-off-by: Shubham Antil <[email protected]>
---
Changes in v3:
- Restore allocation-time zeroing after review confirmed that this is an
already slow and uncommon bounce-buffer fallback.
- Keep the change minimal and document why the zeroing is required.
- Drop the transfer-length copy-back change from v2.
- Add the discovery method and the requested Fixes, stable Cc, Assisted-by,
and Signed-off-by tags.
drivers/vhost/scsi.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 885fac5ed042..8493a372de6c 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -937,7 +937,12 @@ vhost_scsi_copy_iov_to_sgl(struct vhost_scsi_cmd *cmd,
struct iov_iter *iter,
}
for_each_sgtable_sg(sg_table, sg, i) {
- page = alloc_page(GFP_KERNEL);
+ /*
+ * Completion copies the full bounce buffer, including bytes the
+ * target did not write. This is already the slow fallback for
+ * misaligned I/O, so zeroing is acceptable here.
+ */
+ page = alloc_page(GFP_KERNEL | __GFP_ZERO);
if (!page) {
ret = -ENOMEM;
goto err;
base-commit: c69023b5e16e5ffe9368603dca76d85bd544ee57
--
2.43.0
