Code: static ssize_t aio_setup_vectored_rw(struct kiocb *kiocb,
				     int rw, char __user *buf,
 				     unsigned long *nr_segs,
 				     size_t *len,
 				     struct iovec **iovec,
				     bool compat)
 {
 	ssize_t ret;
 
	*nr_segs = *len;

#ifdef CONFIG_COMPAT
	if (compat)
		ret = compat_rw_copy_check_uvector(rw,
				(struct compat_iovec __user *)buf,
				*nr_segs, UIO_FASTIOV, *iovec, iovec);
	else
#endif
		ret = rw_copy_check_uvector(rw,
				(struct iovec __user *)buf,
				*nr_segs, UIO_FASTIOV, *iovec, iovec);
	if (ret < 0)
		return ret;
 
 	/* len now reflect bytes instead of segs */
 	*len = ret;
 	return 0;
 }

Commit Message: aio: lift iov_iter_init() into aio_setup_..._rw()

the only non-trivial detail is that we do it before rw_verify_area(),
so we'd better cap the length ourselves in aio_setup_single_rw()
case (for vectored case rw_copy_check_uvector() will do that for us).

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
CWE ID: 
static ssize_t aio_setup_vectored_rw(struct kiocb *kiocb,
				     int rw, char __user *buf,
 				     unsigned long *nr_segs,
 				     size_t *len,
 				     struct iovec **iovec,
				     bool compat,
				     struct iov_iter *iter)
 {
 	ssize_t ret;
 
	*nr_segs = *len;

#ifdef CONFIG_COMPAT
	if (compat)
		ret = compat_rw_copy_check_uvector(rw,
				(struct compat_iovec __user *)buf,
				*nr_segs, UIO_FASTIOV, *iovec, iovec);
	else
#endif
		ret = rw_copy_check_uvector(rw,
				(struct iovec __user *)buf,
				*nr_segs, UIO_FASTIOV, *iovec, iovec);
	if (ret < 0)
		return ret;
 
 	/* len now reflect bytes instead of segs */
 	*len = ret;
	iov_iter_init(iter, rw, *iovec, *nr_segs, *len);
 	return 0;
 }
