8 files changed, 65 insertions, 119 deletions

diff --git a/drivers/dax/dax-private.h b/drivers/dax/dax-private.h
index c915889d1769..6ccca3b890d6 100644
--- a/drivers/dax/dax-private.h
+++ b/drivers/dax/dax-private.h
@@ -43,6 +43,7 @@ struct dax_region {
  * @target_node: effective numa node if dev_dax memory range is onlined
  * @dev - device core
  * @pgmap - pgmap for memmap setup / lifetime (driver owned)
+ * @dax_mem_res: physical address range of hotadded DAX memory
  */
 struct dev_dax {
         struct dax_region *region;
@@ -50,6 +51,7 @@ struct dev_dax {
         int target_node;
         struct device dev;
         struct dev_pagemap pgmap;
+        struct resource *dax_kmem_res;
 };
 
 static inline struct dev_dax *to_dev_dax(struct device *dev)
diff --git a/drivers/dax/kmem.c b/drivers/dax/kmem.c
index a02318c6d28a..3d0a7e702c94 100644
--- a/drivers/dax/kmem.c
+++ b/drivers/dax/kmem.c
@@ -66,23 +66,59 @@ int dev_dax_kmem_probe(struct device *dev)
         new_res->name = dev_name(dev);
 
         rc = add_memory(numa_node, new_res->start, resource_size(new_res));
-        if (rc)
+        if (rc) {
+                release_resource(new_res);
+                kfree(new_res);
                 return rc;
+        }
+        dev_dax->dax_kmem_res = new_res;
 
         return 0;
 }
 
+#ifdef CONFIG_MEMORY_HOTREMOVE
+static int dev_dax_kmem_remove(struct device *dev)
+{
+        struct dev_dax *dev_dax = to_dev_dax(dev);
+        struct resource *res = dev_dax->dax_kmem_res;
+        resource_size_t kmem_start = res->start;
+        resource_size_t kmem_size = resource_size(res);
+        int rc;
+
+        /*
+         * We have one shot for removing memory, if some memory blocks were not
+         * offline prior to calling this function remove_memory() will fail, and
+         * there is no way to hotremove this memory until reboot because device
+         * unbind will succeed even if we return failure.
+         */
+        rc = remove_memory(dev_dax->target_node, kmem_start, kmem_size);
+        if (rc) {
+                dev_err(dev,
+                        "DAX region %pR cannot be hotremoved until the next reboot\n",
+                        res);
+                return rc;
+        }
+
+        /* Release and free dax resources */
+        release_resource(res);
+        kfree(res);
+        dev_dax->dax_kmem_res = NULL;
+
+        return 0;
+}
+#else
 static int dev_dax_kmem_remove(struct device *dev)
 {
         /*
-         * Purposely leak the request_mem_region() for the device-dax
-         * range and return '0' to ->remove() attempts. The removal of
-         * the device from the driver always succeeds, but the region
-         * is permanently pinned as reserved by the unreleased
+         * Without hotremove purposely leak the request_mem_region() for the
+         * device-dax range and return '0' to ->remove() attempts. The removal
+         * of the device from the driver always succeeds, but the region is
+         * permanently pinned as reserved by the unreleased
          * request_mem_region().
          */
         return 0;
 }
+#endif /* CONFIG_MEMORY_HOTREMOVE */
 
 static struct dax_device_driver device_dax_kmem_driver = {
         .drv = {
diff --git a/drivers/fpga/dfl-afu-dma-region.c b/drivers/fpga/dfl-afu-dma-region.c
index dcd80b088c7b..62f924489db5 100644
--- a/drivers/fpga/dfl-afu-dma-region.c
+++ b/drivers/fpga/dfl-afu-dma-region.c
@@ -12,6 +12,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/sched/signal.h>
 #include <linux/uaccess.h>
+#include <linux/mm.h>
 
 #include "dfl-afu.h"
 
@@ -32,52 +33,6 @@ void afu_dma_region_init(struct dfl_feature_platform_data *pdata)
 }
 
 /**
- * afu_dma_adjust_locked_vm - adjust locked memory
- * @dev: port device
- * @npages: number of pages
- * @incr: increase or decrease locked memory
- *
- * Increase or decrease the locked memory size with npages input.
- *
- * Return 0 on success.
- * Return -ENOMEM if locked memory size is over the limit and no CAP_IPC_LOCK.
- */
-static int afu_dma_adjust_locked_vm(struct device *dev, long npages, bool incr)
-{
-        unsigned long locked, lock_limit;
-        int ret = 0;
-
-        /* the task is exiting. */
-        if (!current->mm)
-                return 0;
-
-        down_write(&current->mm->mmap_sem);
-
-        if (incr) {
-                locked = current->mm->locked_vm + npages;
-                lock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
-
-                if (locked > lock_limit && !capable(CAP_IPC_LOCK))
-                        ret = -ENOMEM;
-                else
-                        current->mm->locked_vm += npages;
-        } else {
-                if (WARN_ON_ONCE(npages > current->mm->locked_vm))
-                        npages = current->mm->locked_vm;
-                current->mm->locked_vm -= npages;
-        }
-
-        dev_dbg(dev, "[%d] RLIMIT_MEMLOCK %c%ld %ld/%ld%s\n", current->pid,
-                incr ? '+' : '-', npages << PAGE_SHIFT,
-                current->mm->locked_vm << PAGE_SHIFT, rlimit(RLIMIT_MEMLOCK),
-                ret ? "- exceeded" : "");
-
-        up_write(&current->mm->mmap_sem);
-
-        return ret;
-}
-
-/**
  * afu_dma_pin_pages - pin pages of given dma memory region
  * @pdata: feature device platform data
  * @region: dma memory region to be pinned
@@ -92,7 +47,7 @@ static int afu_dma_pin_pages(struct dfl_feature_platform_data *pdata,
         struct device *dev = &pdata->dev->dev;
         int ret, pinned;
 
-        ret = afu_dma_adjust_locked_vm(dev, npages, true);
+        ret = account_locked_vm(current->mm, npages, true);
         if (ret)
                 return ret;
 
@@ -121,7 +76,7 @@ put_pages:
 free_pages:
         kfree(region->pages);
 unlock_vm:
-        afu_dma_adjust_locked_vm(dev, npages, false);
+        account_locked_vm(current->mm, npages, false);
         return ret;
 }
 
@@ -141,7 +96,7 @@ static void afu_dma_unpin_pages(struct dfl_feature_platform_data *pdata,
 
         put_all_pages(region->pages, npages);
         kfree(region->pages);
-        afu_dma_adjust_locked_vm(dev, npages, false);
+        account_locked_vm(current->mm, npages, false);
 
         dev_dbg(dev, "%ld pages unpinned\n", npages);
 }
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_usb_core.c b/drivers/net/wireless/mediatek/mt76/mt76x02_usb_core.c
index 5e4f3a8c5784..e4332d5a5757 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x02_usb_core.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x02_usb_core.c
@@ -53,7 +53,7 @@ int mt76x02u_skb_dma_info(struct sk_buff *skb, int port, u32 flags)
         pad = round_up(skb->len, 4) + 4 - skb->len;
 
         /* First packet of a A-MSDU burst keeps track of the whole burst
-         * length, need to update lenght of it and the last packet.
+         * length, need to update length of it and the last packet.
          */
         skb_walk_frags(skb, iter) {
                 last = iter;
diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c
index 3a546ec10d90..22a65ad4e46e 100644
--- a/drivers/pps/pps.c
+++ b/drivers/pps/pps.c
@@ -152,6 +152,14 @@ static long pps_cdev_ioctl(struct file *file,
                         pps->params.mode |= PPS_CANWAIT;
                 pps->params.api_version = PPS_API_VERS;
 
+                /*
+                 * Clear unused fields of pps_kparams to avoid leaking
+                 * uninitialized data of the PPS_SETPARAMS caller via
+                 * PPS_GETPARAMS
+                 */
+                pps->params.assert_off_tu.flags = 0;
+                pps->params.clear_off_tu.flags = 0;
+
                 spin_unlock_irq(&pps->lock);
 
                 break;
diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c
index ce7a90e68042..8155f59ece38 100644
--- a/drivers/rapidio/devices/rio_mport_cdev.c
+++ b/drivers/rapidio/devices/rio_mport_cdev.c
@@ -1686,6 +1686,7 @@ static int rio_mport_add_riodev(struct mport_cdev_priv *priv,
 
         if (copy_from_user(&dev_info, arg, sizeof(dev_info)))
                 return -EFAULT;
+        dev_info.name[sizeof(dev_info.name) - 1] = '\0';
 
         rmcd_debug(RDEV, "name:%s ct:0x%x did:0x%x hc:0x%x", dev_info.name,
                    dev_info.comptag, dev_info.destid, dev_info.hopcount);
@@ -1817,6 +1818,7 @@ static int rio_mport_del_riodev(struct mport_cdev_priv *priv, void __user *arg)
 
         if (copy_from_user(&dev_info, arg, sizeof(dev_info)))
                 return -EFAULT;
+        dev_info.name[sizeof(dev_info.name) - 1] = '\0';
 
         mport = priv->md->mport;
 
diff --git a/drivers/vfio/vfio_iommu_spapr_tce.c b/drivers/vfio/vfio_iommu_spapr_tce.c
index 7048c9198c21..8ce9ad21129f 100644
--- a/drivers/vfio/vfio_iommu_spapr_tce.c
+++ b/drivers/vfio/vfio_iommu_spapr_tce.c
@@ -19,6 +19,7 @@
 #include <linux/vmalloc.h>
 #include <linux/sched/mm.h>
 #include <linux/sched/signal.h>
+#include <linux/mm.h>
 
 #include <asm/iommu.h>
 #include <asm/tce.h>
@@ -31,51 +32,6 @@
 static void tce_iommu_detach_group(void *iommu_data,
                 struct iommu_group *iommu_group);
 
-static long try_increment_locked_vm(struct mm_struct *mm, long npages)
-{
-        long ret = 0, locked, lock_limit;
-
-        if (WARN_ON_ONCE(!mm))
-                return -EPERM;
-
-        if (!npages)
-                return 0;
-
-        down_write(&mm->mmap_sem);
-        locked = mm->locked_vm + npages;
-        lock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
-        if (locked > lock_limit && !capable(CAP_IPC_LOCK))
-                ret = -ENOMEM;
-        else
-                mm->locked_vm += npages;
-
-        pr_debug("[%d] RLIMIT_MEMLOCK +%ld %ld/%ld%s\n", current->pid,
-                        npages << PAGE_SHIFT,
-                        mm->locked_vm << PAGE_SHIFT,
-                        rlimit(RLIMIT_MEMLOCK),
-                        ret ? " - exceeded" : "");
-
-        up_write(&mm->mmap_sem);
-
-        return ret;
-}
-
-static void decrement_locked_vm(struct mm_struct *mm, long npages)
-{
-        if (!mm || !npages)
-                return;
-
-        down_write(&mm->mmap_sem);
-        if (WARN_ON_ONCE(npages > mm->locked_vm))
-                npages = mm->locked_vm;
-        mm->locked_vm -= npages;
-        pr_debug("[%d] RLIMIT_MEMLOCK -%ld %ld/%ld\n", current->pid,
-                        npages << PAGE_SHIFT,
-                        mm->locked_vm << PAGE_SHIFT,
-                        rlimit(RLIMIT_MEMLOCK));
-        up_write(&mm->mmap_sem);
-}
-
 /*
  * VFIO IOMMU fd for SPAPR_TCE IOMMU implementation
  *
@@ -333,7 +289,7 @@ static int tce_iommu_enable(struct tce_container *container)
                 return ret;
 
         locked = table_group->tce32_size >> PAGE_SHIFT;
-        ret = try_increment_locked_vm(container->mm, locked);
+        ret = account_locked_vm(container->mm, locked, true);
         if (ret)
                 return ret;
 
@@ -352,7 +308,7 @@ static void tce_iommu_disable(struct tce_container *container)
         container->enabled = false;
 
         BUG_ON(!container->mm);
-        decrement_locked_vm(container->mm, container->locked_pages);
+        account_locked_vm(container->mm, container->locked_pages, false);
 }
 
 static void *tce_iommu_open(unsigned long arg)
@@ -656,7 +612,7 @@ static long tce_iommu_create_table(struct tce_container *container,
         if (!table_size)
                 return -EINVAL;
 
-        ret = try_increment_locked_vm(container->mm, table_size >> PAGE_SHIFT);
+        ret = account_locked_vm(container->mm, table_size >> PAGE_SHIFT, true);
         if (ret)
                 return ret;
 
@@ -675,7 +631,7 @@ static void tce_iommu_free_table(struct tce_container *container,
         unsigned long pages = tbl->it_allocated_size >> PAGE_SHIFT;
 
         iommu_tce_table_put(tbl);
-        decrement_locked_vm(container->mm, pages);
+        account_locked_vm(container->mm, pages, false);
 }
 
 static long tce_iommu_create_window(struct tce_container *container,
diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index add34adfadc7..054391f30fa8 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -272,21 +272,8 @@ static int vfio_lock_acct(struct vfio_dma *dma, long npage, bool async)
 
         ret = down_write_killable(&mm->mmap_sem);
         if (!ret) {
-                if (npage > 0) {
-                        if (!dma->lock_cap) {
-                                unsigned long limit;
-
-                                limit = task_rlimit(dma->task,
-                                                RLIMIT_MEMLOCK) >> PAGE_SHIFT;
-
-                                if (mm->locked_vm + npage > limit)
-                                        ret = -ENOMEM;
-                        }
-                }
-
-                if (!ret)
-                        mm->locked_vm += npage;
-
+                ret = __account_locked_vm(mm, abs(npage), npage > 0, dma->task,
+                                          dma->lock_cap);
                 up_write(&mm->mmap_sem);
         }