3 files changed, 11 insertions, 8 deletions

diff --git a/fs/aio.c b/fs/aio.c
index e29ec485af25..632b235f4fbe 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1387,13 +1387,13 @@ static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
                 ret = compat_rw_copy_check_uvector(type,
                                 (struct compat_iovec __user *)kiocb->ki_buf,
                                 kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec,
-                                &kiocb->ki_iovec);
+                                &kiocb->ki_iovec, 1);
         else
 #endif
                 ret = rw_copy_check_uvector(type,
                                 (struct iovec __user *)kiocb->ki_buf,
                                 kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec,
-                                &kiocb->ki_iovec);
+                                &kiocb->ki_iovec, 1);
         if (ret < 0)
                 goto out;
 
diff --git a/fs/compat.c b/fs/compat.c
index 302e761bd0aa..c98787536bb8 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -546,7 +546,7 @@ out:
 ssize_t compat_rw_copy_check_uvector(int type,
                 const struct compat_iovec __user *uvector, unsigned long nr_segs,
                 unsigned long fast_segs, struct iovec *fast_pointer,
-                struct iovec **ret_pointer)
+                struct iovec **ret_pointer, int check_access)
 {
         compat_ssize_t tot_len;
         struct iovec *iov = *ret_pointer = fast_pointer;
@@ -593,7 +593,8 @@ ssize_t compat_rw_copy_check_uvector(int type,
                 }
                 if (len < 0)    /* size_t not fitting in compat_ssize_t .. */
                         goto out;
-                if (!access_ok(vrfy_dir(type), compat_ptr(buf), len)) {
+                if (check_access &&
+                    !access_ok(vrfy_dir(type), compat_ptr(buf), len)) {
                         ret = -EFAULT;
                         goto out;
                 }
@@ -1107,7 +1108,7 @@ static ssize_t compat_do_readv_writev(int type, struct file *file,
                 goto out;
 
         tot_len = compat_rw_copy_check_uvector(type, uvector, nr_segs,
-                                               UIO_FASTIOV, iovstack, &iov);
+                                               UIO_FASTIOV, iovstack, &iov, 1);
         if (tot_len == 0) {
                 ret = 0;
                 goto out;
diff --git a/fs/read_write.c b/fs/read_write.c
index dfd125798791..5ad4248b0cd8 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -633,7 +633,8 @@ ssize_t do_loop_readv_writev(struct file *filp, struct iovec *iov,
 ssize_t rw_copy_check_uvector(int type, const struct iovec __user * uvector,
                               unsigned long nr_segs, unsigned long fast_segs,
                               struct iovec *fast_pointer,
-                              struct iovec **ret_pointer)
+                              struct iovec **ret_pointer,
+                              int check_access)
 {
         unsigned long seg;
         ssize_t ret;
@@ -689,7 +690,8 @@ ssize_t rw_copy_check_uvector(int type, const struct iovec __user * uvector,
                         ret = -EINVAL;
                         goto out;
                 }
-                if (unlikely(!access_ok(vrfy_dir(type), buf, len))) {
+                if (check_access
+                    && unlikely(!access_ok(vrfy_dir(type), buf, len))) {
                         ret = -EFAULT;
                         goto out;
                 }
@@ -721,7 +723,7 @@ static ssize_t do_readv_writev(int type, struct file *file,
         }
 
         ret = rw_copy_check_uvector(type, uvector, nr_segs,
-                        ARRAY_SIZE(iovstack), iovstack, &iov);
+                                    ARRAY_SIZE(iovstack), iovstack, &iov, 1);
         if (ret <= 0)
                 goto out;