Merge branch 'for-linus-1' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull vfs update from Al Viro:
 "Part one:

   - struct filename-related cleanups

   - saner iov_iter_init() replacements (and switching the syscalls to
     use of those)

   - ntfs switch to ->write_iter() (Anton)

   - aio cleanups and splitting iocb into common and async parts
     (Christoph)

   - assorted fixes (me, bfields, Andrew Elble)

  There's a lot more, including the completion of switchover to
  ->{read,write}_iter(), d_inode/d_backing_inode annotations, f_flags
  race fixes, etc, but that goes after #for-davem merge.  David has
  pulled it, and once it's in I'll send the next vfs pull request"

* 'for-linus-1' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (35 commits)
  sg_start_req(): use import_iovec()
  sg_start_req(): make sure that there's not too many elements in iovec
  blk_rq_map_user(): use import_single_range()
  sg_io(): use import_iovec()
  process_vm_access: switch to {compat_,}import_iovec()
  switch keyctl_instantiate_key_common() to iov_iter
  switch {compat_,}do_readv_writev() to {compat_,}import_iovec()
  aio_setup_vectored_rw(): switch to {compat_,}import_iovec()
  vmsplice_to_user(): switch to import_iovec()
  kill aio_setup_single_vector()
  aio: simplify arguments of aio_setup_..._rw()
  aio: lift iov_iter_init() into aio_setup_..._rw()
  lift iov_iter into {compat_,}do_readv_writev()
  NFS: fix BUG() crash in notify_change() with patch to chown_common()
  dcache: return -ESTALE not -EBUSY on distributed fs race
  NTFS: Version 2.1.32 - Update file write from aio_write to write_iter.
  VFS: Add iov_iter_fault_in_multipages_readable()
  drop bogus check in file_open_root()
  switch security_inode_getattr() to struct path *
  constify tomoyo_realpath_from_path()
  ...

2 files changed, 8 insertions, 10 deletions

diff --git a/block/blk-map.c b/block/blk-map.c
index b8d2725324a6..da310a105429 100644
--- a/block/blk-map.c
+++ b/block/blk-map.c
@@ -124,10 +124,10 @@ int blk_rq_map_user(struct request_queue *q, struct request *rq,
 {
         struct iovec iov;
         struct iov_iter i;
+        int ret = import_single_range(rq_data_dir(rq), ubuf, len, &iov, &i);
 
-        iov.iov_base = ubuf;
-        iov.iov_len = len;
-        iov_iter_init(&i, rq_data_dir(rq), &iov, 1, len);
+        if (unlikely(ret < 0))
+                return ret;
 
         return blk_rq_map_user_iov(q, rq, map_data, &i, gfp_mask);
 }
diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
index e1f71c396193..55b6f15dac90 100644
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -335,16 +335,14 @@ static int sg_io(struct request_queue *q, struct gendisk *bd_disk,
                 struct iov_iter i;
                 struct iovec *iov = NULL;
 
-                ret = rw_copy_check_uvector(-1, hdr->dxferp, hdr->iovec_count,
-                                            0, NULL, &iov);
-                if (ret < 0) {
-                        kfree(iov);
+                ret = import_iovec(rq_data_dir(rq),
+                                   hdr->dxferp, hdr->iovec_count,
+                                   0, &iov, &i);
+                if (ret < 0)
                         goto out_free_cdb;
-                }
 
                 /* SG_IO howto says that the shorter of the two wins */
-                iov_iter_init(&i, rq_data_dir(rq), iov, hdr->iovec_count,
-                              min_t(unsigned, ret, hdr->dxfer_len));
+                iov_iter_truncate(&i, hdr->dxfer_len);
 
                 ret = blk_rq_map_user_iov(q, rq, NULL, &i, GFP_KERNEL);
                 kfree(iov);