fix 'direction' argument of iov_iter_{init,bvec}()

[ Upstream commit e3bf3df824675ea9cadc3cd2c75d08ee83a6ae26 ]

READ means "data destination", WRITE - "data source".

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Stable-dep-of: 6dd88fd59da8 ("vhost-scsi: unbreak any layout for response")
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 547f89a6940f3ba91e286bbfbe11b173ff882fb0..c234869d67279d2123d31ffc192c36add19ac9ad 100644 (file)
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -833,7 +833,7 @@ static int vhost_copy_to_user(struct vhost_virtqueue *vq, void __user *to,
                                     VHOST_ACCESS_WO);
                if (ret < 0)
                        goto out;
-               iov_iter_init(&t, WRITE, vq->iotlb_iov, ret, size);
+               iov_iter_init(&t, READ, vq->iotlb_iov, ret, size);
                ret = copy_to_iter(from, size, &t);
                if (ret == size)
                        ret = 0;
@@ -872,7 +872,7 @@ static int vhost_copy_from_user(struct vhost_virtqueue *vq, void *to,
                               (unsigned long long) size);
                        goto out;
                }
-               iov_iter_init(&f, READ, vq->iotlb_iov, ret, size);
+               iov_iter_init(&f, WRITE, vq->iotlb_iov, ret, size);
                ret = copy_from_iter(to, size, &f);
                if (ret == size)
                        ret = 0;
@@ -2136,7 +2136,7 @@ static int get_indirect(struct vhost_virtqueue *vq,
                        vq_err(vq, "Translation failure %d in indirect.\n", ret);
                return ret;
        }
-       iov_iter_init(&from, READ, vq->indirect, ret, len);
+       iov_iter_init(&from, WRITE, vq->indirect, ret, len);
        count = len / sizeof desc;
        /* Buffers are chained via a 16 bit next field, so
         * we can have at most 2^16 of these. */

diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
index 828c293065657c162fe80ade227028c41405af6d..139c782848c6758d7713f6a1d14b5b272730eab0 100644 (file)
--- a/drivers/vhost/vringh.c
+++ b/drivers/vhost/vringh.c
@@ -1161,7 +1161,7 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst,
                else if (ret < 0)
                        return ret;
 
-               iov_iter_bvec(&iter, READ, iov, ret, translated);
+               iov_iter_bvec(&iter, WRITE, iov, ret, translated);
 
                ret = copy_from_iter(dst, translated, &iter);
                if (ret < 0)
@@ -1194,7 +1194,7 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst,
                else if (ret < 0)
                        return ret;
 
-               iov_iter_bvec(&iter, WRITE, iov, ret, translated);
+               iov_iter_bvec(&iter, READ, iov, ret, translated);
 
                ret = copy_to_iter(src, translated, &iter);
                if (ret < 0)