Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull vfs updates from Al Viro:
 "The first vfs pile, with deep apologies for being very late in this
  window.

  Assorted cleanups and fixes, plus a large preparatory part of iov_iter
  work.  There's a lot more of that, but it'll probably go into the next
  merge window - it *does* shape up nicely, removes a lot of
  boilerplate, gets rid of locking inconsistencie between aio_write and
  splice_write and I hope to get Kent's direct-io rewrite merged into
  the same queue, but some of the stuff after this point is having
  (mostly trivial) conflicts with the things already merged into
  mainline and with some I want more testing.

  This one passes LTP and xfstests without regressions, in addition to
  usual beating.  BTW, readahead02 in ltp syscalls testsuite has started
  giving failures since "mm/readahead.c: fix readahead failure for
  memoryless NUMA nodes and limit readahead pages" - might be a false
  positive, might be a real regression..."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (63 commits)
  missing bits of "splice: fix racy pipe->buffers uses"
  cifs: fix the race in cifs_writev()
  ceph_sync_{,direct_}write: fix an oops on ceph_osdc_new_request() failure
  kill generic_file_buffered_write()
  ocfs2_file_aio_write(): switch to generic_perform_write()
  ceph_aio_write(): switch to generic_perform_write()
  xfs_file_buffered_aio_write(): switch to generic_perform_write()
  export generic_perform_write(), start getting rid of generic_file_buffer_write()
  generic_file_direct_write(): get rid of ppos argument
  btrfs_file_aio_write(): get rid of ppos
  kill the 5th argument of generic_file_buffered_write()
  kill the 4th argument of __generic_file_aio_write()
  lustre: don't open-code kernel_recvmsg()
  ocfs2: don't open-code kernel_recvmsg()
  drbd: don't open-code kernel_recvmsg()
  constify blk_rq_map_user_iov() and friends
  lustre: switch to kernel_sendmsg()
  ocfs2: don't open-code kernel_sendmsg()
  take iov_iter stuff to mm/iov_iter.c
  process_vm_access: tidy up a bit
  ...

12 files changed, 54 insertions, 175 deletions

diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
index 18c76e84d540..68e3992e8838 100644
--- a/drivers/block/drbd/drbd_receiver.c
+++ b/drivers/block/drbd/drbd_receiver.c
@@ -469,24 +469,14 @@ static void drbd_wait_ee_list_empty(struct drbd_device *device,
 
 static int drbd_recv_short(struct socket *sock, void *buf, size_t size, int flags)
 {
-        mm_segment_t oldfs;
         struct kvec iov = {
                 .iov_base = buf,
                 .iov_len = size,
         };
         struct msghdr msg = {
-                .msg_iovlen = 1,
-                .msg_iov = (struct iovec *)&iov,
                 .msg_flags = (flags ? flags : MSG_WAITALL | MSG_NOSIGNAL)
         };
-        int rv;
-
-        oldfs = get_fs();
-        set_fs(KERNEL_DS);
-        rv = sock_recvmsg(sock, &msg, size, msg.msg_flags);
-        set_fs(oldfs);
-
-        return rv;
+        return kernel_recvmsg(sock, &msg, &iov, 1, size, msg.msg_flags);
 }
 
 static int drbd_recv(struct drbd_connection *connection, void *buf, size_t size)
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 55298db36b2d..3a70ea2f7cd6 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -630,37 +630,29 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
         }
  
         case NBD_CLEAR_SOCK: {
-                struct file *file;
-
+                struct socket *sock = nbd->sock;
                 nbd->sock = NULL;
-                file = nbd->file;
-                nbd->file = NULL;
                 nbd_clear_que(nbd);
                 BUG_ON(!list_empty(&nbd->queue_head));
                 BUG_ON(!list_empty(&nbd->waiting_queue));
                 kill_bdev(bdev);
-                if (file)
-                        fput(file);
+                if (sock)
+                        sockfd_put(sock);
                 return 0;
         }
 
         case NBD_SET_SOCK: {
-                struct file *file;
-                if (nbd->file)
+                struct socket *sock;
+                int err;
+                if (nbd->sock)
                         return -EBUSY;
-                file = fget(arg);
-                if (file) {
-                        struct inode *inode = file_inode(file);
-                        if (S_ISSOCK(inode->i_mode)) {
-                                nbd->file = file;
-                                nbd->sock = SOCKET_I(inode);
-                                if (max_part > 0)
-                                        bdev->bd_invalidated = 1;
-                                nbd->disconnect = 0; /* we're connected now */
-                                return 0;
-                        } else {
-                                fput(file);
-                        }
+                sock = sockfd_lookup(arg, &err);
+                if (sock) {
+                        nbd->sock = sock;
+                        if (max_part > 0)
+                                bdev->bd_invalidated = 1;
+                        nbd->disconnect = 0; /* we're connected now */
+                        return 0;
                 }
                 return -EINVAL;
         }
@@ -697,12 +689,12 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
 
         case NBD_DO_IT: {
                 struct task_struct *thread;
-                struct file *file;
+                struct socket *sock;
                 int error;
 
                 if (nbd->pid)
                         return -EBUSY;
-                if (!nbd->file)
+                if (!nbd->sock)
                         return -EINVAL;
 
                 mutex_unlock(&nbd->tx_lock);
@@ -731,15 +723,15 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
                 if (error)
                         return error;
                 sock_shutdown(nbd, 0);
-                file = nbd->file;
-                nbd->file = NULL;
+                sock = nbd->sock;
+                nbd->sock = NULL;
                 nbd_clear_que(nbd);
                 dev_warn(disk_to_dev(nbd->disk), "queue cleared\n");
                 kill_bdev(bdev);
                 queue_flag_clear_unlocked(QUEUE_FLAG_DISCARD, nbd->disk->queue);
                 set_device_ro(bdev, false);
-                if (file)
-                        fput(file);
+                if (sock)
+                        sockfd_put(sock);
                 nbd->flags = 0;
                 nbd->bytesize = 0;
                 bdev->bd_inode->i_size = 0;
@@ -875,9 +867,7 @@ static int __init nbd_init(void)
 
         for (i = 0; i < nbds_max; i++) {
                 struct gendisk *disk = nbd_dev[i].disk;
-                nbd_dev[i].file = NULL;
                 nbd_dev[i].magic = NBD_MAGIC;
-                nbd_dev[i].flags = 0;
                 INIT_LIST_HEAD(&nbd_dev[i].waiting_queue);
                 spin_lock_init(&nbd_dev[i].queue_lock);
                 INIT_LIST_HEAD(&nbd_dev[i].queue_head);
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 6928d094451d..60aafb8a1f2e 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -901,9 +901,9 @@ static int pipe_to_sg(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
                 if (len + offset > PAGE_SIZE)
                         len = PAGE_SIZE - offset;
 
-                src = buf->ops->map(pipe, buf, 1);
+                src = kmap_atomic(buf->page);
                 memcpy(page_address(page) + offset, src + buf->offset, len);
-                buf->ops->unmap(pipe, buf, src);
+                kunmap_atomic(src);
 
                 sg_set_page(&(sgl->sg[sgl->n]), page, len, offset);
         }
diff --git a/drivers/staging/lustre/lnet/klnds/socklnd/socklnd_lib-linux.c b/drivers/staging/lustre/lnet/klnds/socklnd/socklnd_lib-linux.c
index a54b506ba7ca..b87b246111c0 100644
--- a/drivers/staging/lustre/lnet/klnds/socklnd/socklnd_lib-linux.c
+++ b/drivers/staging/lustre/lnet/klnds/socklnd/socklnd_lib-linux.c
@@ -99,16 +99,7 @@ ksocknal_lib_send_iov (ksock_conn_t *conn, ksock_tx_t *tx)
                 struct iovec   *scratchiov = conn->ksnc_scheduler->kss_scratch_iov;
                 unsigned int    niov = tx->tx_niov;
 #endif
-                struct msghdr msg = {
-                        .msg_name       = NULL,
-                        .msg_namelen    = 0,
-                        .msg_iov        = scratchiov,
-                        .msg_iovlen     = niov,
-                        .msg_control    = NULL,
-                        .msg_controllen = 0,
-                        .msg_flags      = MSG_DONTWAIT
-                };
-                mm_segment_t oldmm = get_fs();
+                struct msghdr msg = {.msg_flags = MSG_DONTWAIT};
                 int  i;
 
                 for (nob = i = 0; i < niov; i++) {
@@ -120,9 +111,7 @@ ksocknal_lib_send_iov (ksock_conn_t *conn, ksock_tx_t *tx)
                     nob < tx->tx_resid)
                         msg.msg_flags |= MSG_MORE;
 
-                set_fs (KERNEL_DS);
-                rc = sock_sendmsg(sock, &msg, nob);
-                set_fs (oldmm);
+                rc = kernel_sendmsg(sock, &msg, (struct kvec *)scratchiov, niov, nob);
         }
         return rc;
 }
@@ -174,16 +163,7 @@ ksocknal_lib_send_kiov (ksock_conn_t *conn, ksock_tx_t *tx)
                 struct iovec *scratchiov = conn->ksnc_scheduler->kss_scratch_iov;
                 unsigned int  niov = tx->tx_nkiov;
 #endif
-                struct msghdr msg = {
-                        .msg_name       = NULL,
-                        .msg_namelen    = 0,
-                        .msg_iov        = scratchiov,
-                        .msg_iovlen     = niov,
-                        .msg_control    = NULL,
-                        .msg_controllen = 0,
-                        .msg_flags      = MSG_DONTWAIT
-                };
-                mm_segment_t  oldmm = get_fs();
+                struct msghdr msg = {.msg_flags = MSG_DONTWAIT};
                 int        i;
 
                 for (nob = i = 0; i < niov; i++) {
@@ -196,9 +176,7 @@ ksocknal_lib_send_kiov (ksock_conn_t *conn, ksock_tx_t *tx)
                     nob < tx->tx_resid)
                         msg.msg_flags |= MSG_MORE;
 
-                set_fs (KERNEL_DS);
-                rc = sock_sendmsg(sock, &msg, nob);
-                set_fs (oldmm);
+                rc = kernel_sendmsg(sock, &msg, (struct kvec *)scratchiov, niov, nob);
 
                 for (i = 0; i < niov; i++)
                         kunmap(kiov[i].kiov_page);
@@ -237,15 +215,8 @@ ksocknal_lib_recv_iov (ksock_conn_t *conn)
 #endif
         struct iovec *iov = conn->ksnc_rx_iov;
         struct msghdr msg = {
-                .msg_name       = NULL,
-                .msg_namelen    = 0,
-                .msg_iov        = scratchiov,
-                .msg_iovlen     = niov,
-                .msg_control    = NULL,
-                .msg_controllen = 0,
                 .msg_flags      = 0
         };
-        mm_segment_t oldmm = get_fs();
         int       nob;
         int       i;
         int       rc;
@@ -263,10 +234,8 @@ ksocknal_lib_recv_iov (ksock_conn_t *conn)
         }
         LASSERT (nob <= conn->ksnc_rx_nob_wanted);
 
-        set_fs (KERNEL_DS);
-        rc = sock_recvmsg (conn->ksnc_sock, &msg, nob, MSG_DONTWAIT);
-        /* NB this is just a boolean..........................^ */
-        set_fs (oldmm);
+        rc = kernel_recvmsg(conn->ksnc_sock, &msg,
+                (struct kvec *)scratchiov, niov, nob, MSG_DONTWAIT);
 
         saved_csum = 0;
         if (conn->ksnc_proto == &ksocknal_protocol_v2x) {
@@ -355,14 +324,8 @@ ksocknal_lib_recv_kiov (ksock_conn_t *conn)
 #endif
         lnet_kiov_t   *kiov = conn->ksnc_rx_kiov;
         struct msghdr msg = {
-                .msg_name       = NULL,
-                .msg_namelen    = 0,
-                .msg_iov        = scratchiov,
-                .msg_control    = NULL,
-                .msg_controllen = 0,
                 .msg_flags      = 0
         };
-        mm_segment_t oldmm = get_fs();
         int       nob;
         int       i;
         int       rc;
@@ -370,13 +333,14 @@ ksocknal_lib_recv_kiov (ksock_conn_t *conn)
         void    *addr;
         int       sum;
         int       fragnob;
+        int n;
 
         /* NB we can't trust socket ops to either consume our iovs
          * or leave them alone. */
         addr = ksocknal_lib_kiov_vmap(kiov, niov, scratchiov, pages);
         if (addr != NULL) {
                 nob = scratchiov[0].iov_len;
-                msg.msg_iovlen = 1;
+                n = 1;
 
         } else {
                 for (nob = i = 0; i < niov; i++) {
@@ -384,15 +348,13 @@ ksocknal_lib_recv_kiov (ksock_conn_t *conn)
                         scratchiov[i].iov_base = kmap(kiov[i].kiov_page) +
                                                  kiov[i].kiov_offset;
                 }
-                msg.msg_iovlen = niov;
+                n = niov;
         }
 
         LASSERT (nob <= conn->ksnc_rx_nob_wanted);
 
-        set_fs (KERNEL_DS);
-        rc = sock_recvmsg (conn->ksnc_sock, &msg, nob, MSG_DONTWAIT);
-        /* NB this is just a boolean.......................^ */
-        set_fs (oldmm);
+        rc = kernel_recvmsg(conn->ksnc_sock, &msg,
+                        (struct kvec *)scratchiov, n, nob, MSG_DONTWAIT);
 
         if (conn->ksnc_msg.ksm_csum != 0) {
                 for (i = 0, sum = rc; sum > 0; i++, sum -= fragnob) {
diff --git a/drivers/staging/lustre/lustre/libcfs/linux/linux-tcpip.c b/drivers/staging/lustre/lustre/libcfs/linux/linux-tcpip.c
index e6069d78af6b..7539fe16d76f 100644
--- a/drivers/staging/lustre/lustre/libcfs/linux/linux-tcpip.c
+++ b/drivers/staging/lustre/lustre/libcfs/linux/linux-tcpip.c
@@ -265,17 +265,11 @@ libcfs_sock_write (struct socket *sock, void *buffer, int nob, int timeout)
          * empty enough to take the whole message immediately */
 
         for (;;) {
-                struct iovec  iov = {
+                struct kvec  iov = {
                         .iov_base = buffer,
                         .iov_len  = nob
                 };
                 struct msghdr msg = {
-                        .msg_name       = NULL,
-                        .msg_namelen    = 0,
-                        .msg_iov        = &iov,
-                        .msg_iovlen     = 1,
-                        .msg_control    = NULL,
-                        .msg_controllen = 0,
                         .msg_flags      = (timeout == 0) ? MSG_DONTWAIT : 0
                 };
 
@@ -297,11 +291,9 @@ libcfs_sock_write (struct socket *sock, void *buffer, int nob, int timeout)
                         }
                 }
 
-                set_fs (KERNEL_DS);
                 then = jiffies;
-                rc = sock_sendmsg (sock, &msg, iov.iov_len);
+                rc = kernel_sendmsg(sock, &msg, &iov, 1, nob);
                 ticks -= jiffies - then;
-                set_fs (oldmm);
 
                 if (rc == nob)
                         return 0;
@@ -338,17 +330,11 @@ libcfs_sock_read (struct socket *sock, void *buffer, int nob, int timeout)
         LASSERT (ticks > 0);
 
         for (;;) {
-                struct iovec  iov = {
+                struct kvec  iov = {
                         .iov_base = buffer,
                         .iov_len  = nob
                 };
                 struct msghdr msg = {
-                        .msg_name       = NULL,
-                        .msg_namelen    = 0,
-                        .msg_iov        = &iov,
-                        .msg_iovlen     = 1,
-                        .msg_control    = NULL,
-                        .msg_controllen = 0,
                         .msg_flags      = 0
                 };
 
@@ -367,11 +353,9 @@ libcfs_sock_read (struct socket *sock, void *buffer, int nob, int timeout)
                         return rc;
                 }
 
-                set_fs(KERNEL_DS);
                 then = jiffies;
-                rc = sock_recvmsg(sock, &msg, iov.iov_len, 0);
+                rc = kernel_recvmsg(sock, &msg, &iov, 1, nob, 0);
                 ticks -= jiffies - then;
-                set_fs(oldmm);
 
                 if (rc < 0)
                         return rc;
diff --git a/drivers/staging/lustre/lustre/llite/symlink.c b/drivers/staging/lustre/lustre/llite/symlink.c
index ab06891f7fc7..80d48b5ae247 100644
--- a/drivers/staging/lustre/lustre/llite/symlink.c
+++ b/drivers/staging/lustre/lustre/llite/symlink.c
@@ -115,27 +115,6 @@ failed:
         return rc;
 }
 
-static int ll_readlink(struct dentry *dentry, char *buffer, int buflen)
-{
-        struct inode *inode = dentry->d_inode;
-        struct ptlrpc_request *request;
-        char *symname;
-        int rc;
-
-        CDEBUG(D_VFSTRACE, "VFS Op\n");
-
-        ll_inode_size_lock(inode);
-        rc = ll_readlink_internal(inode, &request, &symname);
-        if (rc)
-                GOTO(out, rc);
-
-        rc = vfs_readlink(dentry, buffer, buflen, symname);
- out:
-        ptlrpc_req_finished(request);
-        ll_inode_size_unlock(inode);
-        return rc;
-}
-
 static void *ll_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
         struct inode *inode = dentry->d_inode;
@@ -175,7 +154,7 @@ static void ll_put_link(struct dentry *dentry, struct nameidata *nd, void *cooki
 }
 
 struct inode_operations ll_fast_symlink_inode_operations = {
-        .readlink       = ll_readlink,
+        .readlink       = generic_readlink,
         .setattr        = ll_setattr,
         .follow_link    = ll_follow_link,
         .put_link       = ll_put_link,
diff --git a/drivers/staging/usbip/stub_dev.c b/drivers/staging/usbip/stub_dev.c
index 773d8ca07a00..de692d7011a5 100644
--- a/drivers/staging/usbip/stub_dev.c
+++ b/drivers/staging/usbip/stub_dev.c
@@ -86,7 +86,6 @@ static ssize_t store_sockfd(struct device *dev, struct device_attribute *attr,
         struct stub_device *sdev = dev_get_drvdata(dev);
         int sockfd = 0;
         struct socket *socket;
-        ssize_t err = -EINVAL;
         int rv;
 
         if (!sdev) {
@@ -99,6 +98,7 @@ static ssize_t store_sockfd(struct device *dev, struct device_attribute *attr,
                 return -EINVAL;
 
         if (sockfd != -1) {
+                int err;
                 dev_info(dev, "stub up\n");
 
                 spin_lock_irq(&sdev->ud.lock);
@@ -108,7 +108,7 @@ static ssize_t store_sockfd(struct device *dev, struct device_attribute *attr,
                         goto err;
                 }
 
-                socket = sockfd_to_socket(sockfd);
+                socket = sockfd_lookup(sockfd, &err);
                 if (!socket)
                         goto err;
 
@@ -141,7 +141,7 @@ static ssize_t store_sockfd(struct device *dev, struct device_attribute *attr,
 
 err:
         spin_unlock_irq(&sdev->ud.lock);
-        return err;
+        return -EINVAL;
 }
 static DEVICE_ATTR(usbip_sockfd, S_IWUSR, NULL, store_sockfd);
 
@@ -211,7 +211,7 @@ static void stub_shutdown_connection(struct usbip_device *ud)
          * not touch NULL socket.
          */
         if (ud->tcp_socket) {
-                fput(ud->tcp_socket->file);
+                sockfd_put(ud->tcp_socket);
                 ud->tcp_socket = NULL;
         }
 
diff --git a/drivers/staging/usbip/usbip_common.c b/drivers/staging/usbip/usbip_common.c
index 184fa70365db..facaaf003f19 100644
--- a/drivers/staging/usbip/usbip_common.c
+++ b/drivers/staging/usbip/usbip_common.c
@@ -382,31 +382,6 @@ err:
 }
 EXPORT_SYMBOL_GPL(usbip_recv);
 
-struct socket *sockfd_to_socket(unsigned int sockfd)
-{
-        struct socket *socket;
-        struct file *file;
-        struct inode *inode;
-
-        file = fget(sockfd);
-        if (!file) {
-                pr_err("invalid sockfd\n");
-                return NULL;
-        }
-
-        inode = file_inode(file);
-
-        if (!inode || !S_ISSOCK(inode->i_mode)) {
-                fput(file);
-                return NULL;
-        }
-
-        socket = SOCKET_I(inode);
-
-        return socket;
-}
-EXPORT_SYMBOL_GPL(sockfd_to_socket);
-
 /* there may be more cases to tweak the flags. */
 static unsigned int tweak_transfer_flags(unsigned int flags)
 {
diff --git a/drivers/staging/usbip/usbip_common.h b/drivers/staging/usbip/usbip_common.h
index 732fb636a1e5..f555d834f134 100644
--- a/drivers/staging/usbip/usbip_common.h
+++ b/drivers/staging/usbip/usbip_common.h
@@ -299,7 +299,6 @@ void usbip_dump_urb(struct urb *purb);
 void usbip_dump_header(struct usbip_header *pdu);
 
 int usbip_recv(struct socket *sock, void *buf, int size);
-struct socket *sockfd_to_socket(unsigned int sockfd);
 
 void usbip_pack_pdu(struct usbip_header *pdu, struct urb *urb, int cmd,
                     int pack);
diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/staging/usbip/vhci_hcd.c
index 1e84577230ef..70e17551943d 100644
--- a/drivers/staging/usbip/vhci_hcd.c
+++ b/drivers/staging/usbip/vhci_hcd.c
@@ -788,7 +788,7 @@ static void vhci_shutdown_connection(struct usbip_device *ud)
 
         /* active connection is closed */
         if (vdev->ud.tcp_socket) {
-                fput(vdev->ud.tcp_socket->file);
+                sockfd_put(vdev->ud.tcp_socket);
                 vdev->ud.tcp_socket = NULL;
         }
         pr_info("release socket\n");
@@ -835,7 +835,7 @@ static void vhci_device_reset(struct usbip_device *ud)
         vdev->udev = NULL;
 
         if (ud->tcp_socket) {
-                fput(ud->tcp_socket->file);
+                sockfd_put(ud->tcp_socket);
                 ud->tcp_socket = NULL;
         }
         ud->status = VDEV_ST_NULL;
diff --git a/drivers/staging/usbip/vhci_sysfs.c b/drivers/staging/usbip/vhci_sysfs.c
index e0980324fb03..47bddcdde0a6 100644
--- a/drivers/staging/usbip/vhci_sysfs.c
+++ b/drivers/staging/usbip/vhci_sysfs.c
@@ -176,6 +176,7 @@ static ssize_t store_attach(struct device *dev, struct device_attribute *attr,
         struct socket *socket;
         int sockfd = 0;
         __u32 rhport = 0, devid = 0, speed = 0;
+        int err;
 
         /*
          * @rhport: port number of vhci_hcd
@@ -194,8 +195,7 @@ static ssize_t store_attach(struct device *dev, struct device_attribute *attr,
                 return -EINVAL;
 
         /* Extract socket from fd. */
-        /* The correct way to clean this up is to fput(socket->file). */
-        socket = sockfd_to_socket(sockfd);
+        socket = sockfd_lookup(sockfd, &err);
         if (!socket)
                 return -EINVAL;
 
@@ -211,7 +211,7 @@ static ssize_t store_attach(struct device *dev, struct device_attribute *attr,
                 spin_unlock(&vdev->ud.lock);
                 spin_unlock(&the_controller->lock);
 
-                fput(socket->file);
+                sockfd_put(socket);
 
                 dev_err(dev, "port %d already used\n", rhport);
                 return -EINVAL;
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index e1e22e0f01e8..be414d2b2b22 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -818,9 +818,9 @@ static int vhost_net_release(struct inode *inode, struct file *f)
         vhost_dev_cleanup(&n->dev, false);
         vhost_net_vq_reset(n);
         if (tx_sock)
-                fput(tx_sock->file);
+                sockfd_put(tx_sock);
         if (rx_sock)
-                fput(rx_sock->file);
+                sockfd_put(rx_sock);
         /* Make sure no callbacks are outstanding */
         synchronize_rcu_bh();
         /* We do an extra flush before freeing memory,
@@ -860,7 +860,7 @@ static struct socket *get_raw_socket(int fd)
         }
         return sock;
 err:
-        fput(sock->file);
+        sockfd_put(sock);
         return ERR_PTR(r);
 }
 
@@ -966,7 +966,7 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd)
 
         if (oldsock) {
                 vhost_net_flush_vq(n, index);
-                fput(oldsock->file);
+                sockfd_put(oldsock);
         }
 
         mutex_unlock(&n->dev.mutex);
@@ -978,7 +978,7 @@ err_used:
         if (ubufs)
                 vhost_net_ubuf_put_wait_and_free(ubufs);
 err_ubufs:
-        fput(sock->file);
+        sockfd_put(sock);
 err_vq:
         mutex_unlock(&vq->mutex);
 err:
@@ -1009,9 +1009,9 @@ static long vhost_net_reset_owner(struct vhost_net *n)
 done:
         mutex_unlock(&n->dev.mutex);
         if (tx_sock)
-                fput(tx_sock->file);
+                sockfd_put(tx_sock);
         if (rx_sock)
-                fput(rx_sock->file);
+                sockfd_put(rx_sock);
         return err;
 }