5.15-stable patches

added patches:
	vhost-allow-batching-hint-without-size.patch

diff --git a/queue-5.15/series b/queue-5.15/series
index 940405f1e5b056deffb8e749de2942a11914746b..f4d02f0fb30887f3eaa0764eaf60727df0438659 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -108,3 +108,4 @@ drm-i915-workaround-broken-bios-dbuf-configuration-on-tgl-rkl.patch
 riscv-dts-k210-fix-broken-irqs-on-hart1.patch
 block-drop-unused-includes-in-linux-genhd.h.patch
 revert-net-dsa-mv88e6xxx-flush-switchdev-fdb-workqueue-before-removing-vlan.patch
+vhost-allow-batching-hint-without-size.patch

diff --git a/queue-5.15/vhost-allow-batching-hint-without-size.patch b/queue-5.15/vhost-allow-batching-hint-without-size.patch
new file mode 100644 (file)
index 0000000..515959e
--- /dev/null
+++ b/queue-5.15/vhost-allow-batching-hint-without-size.patch
@@ -0,0 +1,42 @@
+From 95932ab2ea07b79cdb33121e2f40ccda9e6a73b5 Mon Sep 17 00:00:00 2001
+From: Jason Wang <jasowang@redhat.com>
+Date: Thu, 10 Mar 2022 15:52:11 +0800
+Subject: vhost: allow batching hint without size
+
+From: Jason Wang <jasowang@redhat.com>
+
+commit 95932ab2ea07b79cdb33121e2f40ccda9e6a73b5 upstream.
+
+Commit e2ae38cf3d91 ("vhost: fix hung thread due to erroneous iotlb
+entries") tries to reject the IOTLB message whose size is zero. But
+the size is not necessarily meaningful, one example is the batching
+hint, so the commit breaks that.
+
+Fixing this be reject zero size message only if the message is used to
+update/invalidate the IOTLB.
+
+Fixes: e2ae38cf3d91 ("vhost: fix hung thread due to erroneous iotlb entries")
+Reported-by: Eli Cohen <elic@nvidia.com>
+Cc: Anirudh Rayabharam <mail@anirudhrb.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+Link: https://lore.kernel.org/r/20220310075211.4801-1-jasowang@redhat.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Tested-by: Eli Cohen <elic@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/vhost/vhost.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -1170,7 +1170,9 @@ ssize_t vhost_chr_write_iter(struct vhos
+               goto done;
+       }
+ 
+-      if (msg.size == 0) {
++      if ((msg.type == VHOST_IOTLB_UPDATE ||
++           msg.type == VHOST_IOTLB_INVALIDATE) &&
++           msg.size == 0) {
+               ret = -EINVAL;
+               goto done;
+       }