1 files changed, 17 insertions, 28 deletions

diff --git a/fs/aio.c b/fs/aio.c
index 7816e8ec3c0e..2ba172cfdeba 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1352,43 +1352,33 @@ typedef ssize_t (aio_rw_op)(struct kiocb *, const struct iovec *,
                             unsigned long, loff_t);
 typedef ssize_t (rw_iter_op)(struct kiocb *, struct iov_iter *);
 
-static ssize_t aio_setup_vectored_rw(struct kiocb *kiocb,
-                                     int rw, char __user *buf,
-                                     unsigned long *nr_segs,
-                                     size_t *len,
-                                     struct iovec **iovec,
-                                     bool compat,
-                                     struct iov_iter *iter)
+static int aio_setup_vectored_rw(int rw, char __user *buf, size_t len,
+                                 struct iovec **iovec,
+                                 bool compat,
+                                 struct iov_iter *iter)
 {
         ssize_t ret;
 
-        *nr_segs = *len;
-
 #ifdef CONFIG_COMPAT
         if (compat)
                 ret = compat_rw_copy_check_uvector(rw,
                                 (struct compat_iovec __user *)buf,
-                                *nr_segs, UIO_FASTIOV, *iovec, iovec);
+                                len, UIO_FASTIOV, *iovec, iovec);
         else
 #endif
                 ret = rw_copy_check_uvector(rw,
                                 (struct iovec __user *)buf,
-                                *nr_segs, UIO_FASTIOV, *iovec, iovec);
+                                len, UIO_FASTIOV, *iovec, iovec);
         if (ret < 0)
                 return ret;
 
-        /* len now reflect bytes instead of segs */
-        *len = ret;
-        iov_iter_init(iter, rw, *iovec, *nr_segs, *len);
+        iov_iter_init(iter, rw, *iovec, len, ret);
         return 0;
 }
 
-static ssize_t aio_setup_single_vector(struct kiocb *kiocb,
-                                       int rw, char __user *buf,
-                                       unsigned long *nr_segs,
-                                       size_t len,
-                                       struct iovec *iovec,
-                                       struct iov_iter *iter)
+static int aio_setup_single_vector(int rw, char __user *buf, size_t len,
+                                   struct iovec *iovec,
+                                   struct iov_iter *iter)
 {
         if (len > MAX_RW_COUNT)
                 len = MAX_RW_COUNT;
@@ -1397,8 +1387,7 @@ static ssize_t aio_setup_single_vector(struct kiocb *kiocb,
 
         iovec->iov_base = buf;
         iovec->iov_len = len;
-        *nr_segs = 1;
-        iov_iter_init(iter, rw, iovec, *nr_segs, len);
+        iov_iter_init(iter, rw, iovec, 1, len);
         return 0;
 }
 
@@ -1411,7 +1400,6 @@ static ssize_t aio_run_iocb(struct kiocb *req, unsigned opcode,
 {
         struct file *file = req->ki_filp;
         ssize_t ret;
-        unsigned long nr_segs;
         int rw;
         fmode_t mode;
         aio_rw_op *rw_op;
@@ -1443,13 +1431,14 @@ rw_common:
                         return -EINVAL;
 
                 if (opcode == IOCB_CMD_PREADV || opcode == IOCB_CMD_PWRITEV)
-                        ret = aio_setup_vectored_rw(req, rw, buf, &nr_segs,
-                                                &len, &iovec, compat, &iter);
+                        ret = aio_setup_vectored_rw(rw, buf, len,
+                                                &iovec, compat, &iter);
                 else
-                        ret = aio_setup_single_vector(req, rw, buf, &nr_segs,
-                                                  len, iovec, &iter);
+                        ret = aio_setup_single_vector(rw, buf, len,
+                                                iovec, &iter);
                 if (!ret)
-                        ret = rw_verify_area(rw, file, &req->ki_pos, len);
+                        ret = rw_verify_area(rw, file, &req->ki_pos,
+                                             iov_iter_count(&iter));
                 if (ret < 0) {
                         if (iovec != inline_vecs)
                                 kfree(iovec);