2 files changed, 23 insertions, 4 deletions

diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
index 3656849f78a0..73358d256fa2 100644
--- a/virt/kvm/eventfd.c
+++ b/virt/kvm/eventfd.c
@@ -90,7 +90,7 @@ irqfd_shutdown(struct work_struct *work)
          * We know no new events will be scheduled at this point, so block
          * until all previously outstanding events have completed
          */
-        flush_work(&irqfd->inject);
+        flush_work_sync(&irqfd->inject);
 
         /*
          * It is now safe to release the object's resources
@@ -578,7 +578,7 @@ kvm_assign_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
 
         mutex_lock(&kvm->slots_lock);
 
-        /* Verify that there isnt a match already */
+        /* Verify that there isn't a match already */
         if (ioeventfd_check_collision(kvm, p)) {
                 ret = -EEXIST;
                 goto unlock_fail;
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 556e3efe5325..6330653480e4 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -1037,6 +1037,17 @@ static pfn_t get_fault_pfn(void)
         return fault_pfn;
 }
 
+int get_user_page_nowait(struct task_struct *tsk, struct mm_struct *mm,
+        unsigned long start, int write, struct page **page)
+{
+        int flags = FOLL_TOUCH | FOLL_NOWAIT | FOLL_HWPOISON | FOLL_GET;
+
+        if (write)
+                flags |= FOLL_WRITE;
+
+        return __get_user_pages(tsk, mm, start, 1, flags, page, NULL, NULL);
+}
+
 static inline int check_user_page_hwpoison(unsigned long addr)
 {
         int rc, flags = FOLL_TOUCH | FOLL_HWPOISON | FOLL_WRITE;
@@ -1070,7 +1081,14 @@ static pfn_t hva_to_pfn(struct kvm *kvm, unsigned long addr, bool atomic,
                 if (writable)
                         *writable = write_fault;
 
-                npages = get_user_pages_fast(addr, 1, write_fault, page);
+                if (async) {
+                        down_read(&current->mm->mmap_sem);
+                        npages = get_user_page_nowait(current, current->mm,
+                                                     addr, write_fault, page);
+                        up_read(&current->mm->mmap_sem);
+                } else
+                        npages = get_user_pages_fast(addr, 1, write_fault,
+                                                     page);
 
                 /* map read fault as writable if possible */
                 if (unlikely(!write_fault) && npages == 1) {
@@ -1093,7 +1111,8 @@ static pfn_t hva_to_pfn(struct kvm *kvm, unsigned long addr, bool atomic,
                         return get_fault_pfn();
 
                 down_read(&current->mm->mmap_sem);
-                if (check_user_page_hwpoison(addr)) {
+                if (npages == -EHWPOISON ||
+                        (!async && check_user_page_hwpoison(addr))) {
                         up_read(&current->mm->mmap_sem);
                         get_page(hwpoison_page);
                         return page_to_pfn(hwpoison_page);