From 01c3a5fa6d641c93c7cef4fb25c5f12938316e18 Mon Sep 17 00:00:00 2001 From: Shubham Antil Date: Tue, 20 Oct 2026 16:25:03 +0530 Subject: [PATCH] vhost-scsi: zero misaligned I/O bounce pages The misaligned I/O fallback copies the full bounce scatterlist to the request buffer during completion. If a data-in command transfers less than requested, part of a newly allocated bounce page can remain unwritten. Allocate bounce pages with __GFP_ZERO so all bytes copied during completion have a defined value. This path is already the slow fallback for misaligned I/O, so the added initialization cost is acceptable. Found during an LLM-assisted source audit and validated with a QEMU/KVM vhost-scsi target using misaligned data-in commands. Fixes: 5ced58bfa132 ("vhost-scsi: Fix alignment handling with windows") Cc: stable@vger.kernel.org Assisted-by: LLM (OpenAI Codex, gpt-5.6-sol) Signed-off-by: Shubham Antil Reviewed-by: Mike Christie Signed-off-by: Michael S. Tsirkin Message-ID: <20261020105503.75904-1-shubham@octane.security> --- drivers/vhost/scsi.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c index 1a0b75cc4cef..8b166bf5ae77 100644 --- a/drivers/vhost/scsi.c +++ b/drivers/vhost/scsi.c @@ -944,7 +944,12 @@ vhost_scsi_copy_iov_to_sgl(struct vhost_scsi_cmd *cmd, struct iov_iter *iter, } for_each_sgtable_sg(sg_table, sg, i) { - page = alloc_page(GFP_KERNEL); + /* + * Completion copies the full bounce buffer, including bytes the + * target did not write. This is already the slow fallback for + * misaligned I/O, so zeroing is acceptable here. + */ + page = alloc_page(GFP_KERNEL | __GFP_ZERO); if (!page) { ret = -ENOMEM; goto err;