1 files changed, 13 insertions, 9 deletions

diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 8e10ab436d1f..23593cb23dd0 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1127,16 +1127,18 @@ vhost_scsi_send_tmf_reject(struct vhost_scsi *vs,
                            struct vhost_virtqueue *vq,
                            struct vhost_scsi_ctx *vc)
 {
-        struct virtio_scsi_ctrl_tmf_resp __user *resp;
         struct virtio_scsi_ctrl_tmf_resp rsp;
+        struct iov_iter iov_iter;
         int ret;
 
         pr_debug("%s\n", __func__);
         memset(&rsp, 0, sizeof(rsp));
         rsp.response = VIRTIO_SCSI_S_FUNCTION_REJECTED;
-        resp = vq->iov[vc->out].iov_base;
-        ret = __copy_to_user(resp, &rsp, sizeof(rsp));
-        if (!ret)
+
+        iov_iter_init(&iov_iter, READ, &vq->iov[vc->out], vc->in, sizeof(rsp));
+
+        ret = copy_to_iter(&rsp, sizeof(rsp), &iov_iter);
+        if (likely(ret == sizeof(rsp)))
                 vhost_add_used_and_signal(&vs->dev, vq, vc->head, 0);
         else
                 pr_err("Faulted on virtio_scsi_ctrl_tmf_resp\n");
@@ -1147,16 +1149,18 @@ vhost_scsi_send_an_resp(struct vhost_scsi *vs,
                         struct vhost_virtqueue *vq,
                         struct vhost_scsi_ctx *vc)
 {
-        struct virtio_scsi_ctrl_an_resp __user *resp;
         struct virtio_scsi_ctrl_an_resp rsp;
+        struct iov_iter iov_iter;
         int ret;
 
         pr_debug("%s\n", __func__);
         memset(&rsp, 0, sizeof(rsp));   /* event_actual = 0 */
         rsp.response = VIRTIO_SCSI_S_OK;
-        resp = vq->iov[vc->out].iov_base;
-        ret = __copy_to_user(resp, &rsp, sizeof(rsp));
-        if (!ret)
+
+        iov_iter_init(&iov_iter, READ, &vq->iov[vc->out], vc->in, sizeof(rsp));
+
+        ret = copy_to_iter(&rsp, sizeof(rsp), &iov_iter);
+        if (likely(ret == sizeof(rsp)))
                 vhost_add_used_and_signal(&vs->dev, vq, vc->head, 0);
         else
                 pr_err("Faulted on virtio_scsi_ctrl_an_resp\n");
@@ -1623,7 +1627,7 @@ static int vhost_scsi_open(struct inode *inode, struct file *f)
                 vqs[i] = &vs->vqs[i].vq;
                 vs->vqs[i].vq.handle_kick = vhost_scsi_handle_kick;
         }
-        vhost_dev_init(&vs->dev, vqs, VHOST_SCSI_MAX_VQ);
+        vhost_dev_init(&vs->dev, vqs, VHOST_SCSI_MAX_VQ, UIO_MAXIOV);
 
         vhost_scsi_init_inflight(vs, NULL);