5.16-stable patches

added patches:
	vhost-allow-batching-hint-without-size.patch

diff --git a/queue-5.16/series b/queue-5.16/series
index 31a94200ef373e93cdfb4aa58d94f787617a5347..5373631cf0d36c8cc4048464a2f13b0860253675 100644 (file)
--- a/queue-5.16/series
+++ b/queue-5.16/series
@@ -119,3 +119,4 @@ drm-panel-select-drm_dp_helper-for-drm_panel_edp.patch
 perf-parse-fix-event-parser-error-for-hybrid-systems.patch
 btrfs-make-send-work-with-concurrent-block-group-relocation.patch
 riscv-dts-k210-fix-broken-irqs-on-hart1.patch
+vhost-allow-batching-hint-without-size.patch

diff --git a/queue-5.16/vhost-allow-batching-hint-without-size.patch b/queue-5.16/vhost-allow-batching-hint-without-size.patch
new file mode 100644 (file)
index 0000000..515959e
--- /dev/null
+++ b/queue-5.16/vhost-allow-batching-hint-without-size.patch
@@ -0,0 +1,42 @@
+From 95932ab2ea07b79cdb33121e2f40ccda9e6a73b5 Mon Sep 17 00:00:00 2001
+From: Jason Wang <jasowang@redhat.com>
+Date: Thu, 10 Mar 2022 15:52:11 +0800
+Subject: vhost: allow batching hint without size
+
+From: Jason Wang <jasowang@redhat.com>
+
+commit 95932ab2ea07b79cdb33121e2f40ccda9e6a73b5 upstream.
+
+Commit e2ae38cf3d91 ("vhost: fix hung thread due to erroneous iotlb
+entries") tries to reject the IOTLB message whose size is zero. But
+the size is not necessarily meaningful, one example is the batching
+hint, so the commit breaks that.
+
+Fixing this be reject zero size message only if the message is used to
+update/invalidate the IOTLB.
+
+Fixes: e2ae38cf3d91 ("vhost: fix hung thread due to erroneous iotlb entries")
+Reported-by: Eli Cohen <elic@nvidia.com>
+Cc: Anirudh Rayabharam <mail@anirudhrb.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+Link: https://lore.kernel.org/r/20220310075211.4801-1-jasowang@redhat.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Tested-by: Eli Cohen <elic@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/vhost/vhost.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -1170,7 +1170,9 @@ ssize_t vhost_chr_write_iter(struct vhos
+               goto done;
+       }
+ 
+-      if (msg.size == 0) {
++      if ((msg.type == VHOST_IOTLB_UPDATE ||
++           msg.type == VHOST_IOTLB_INVALIDATE) &&
++           msg.size == 0) {
+               ret = -EINVAL;
+               goto done;
+       }