Fix four things[1] in the patch that adds ITER_XARRAY[2]:
 (1) Remove the address_space struct predeclaration.  This is a holdover
     from when it was ITER_MAPPING.
 (2) Fix _copy_mc_to_iter() so that the xarray segment updates count and
     iov_offset in the iterator before returning.
 (3) Fix iov_iter_alignment() to not loop in the xarray case.  Because the
     middle pages are all whole pages, only the end pages need be
     considered - and this can be reduced to just looking at the start
     position in the xarray and the iteration size.
 (4) Fix iov_iter_advance() to limit the size of the advance to no more
     than the remaining iteration size.
Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Al Viro <viro@zeniv.linux.org.uk>
Tested-by: Jeff Layton <jlayton@redhat.com>
Tested-by: Dave Wysochanski <dwysocha@redhat.com>
Link: https://lore.kernel.org/r/YIVrJT8GwLI0Wlgx@zeniv-ca.linux.org.uk
Link: https://lore.kernel.org/r/161918448151.3145707.11541538916600921083.stgit@warthog.procyon.org.uk
 #include <uapi/linux/uio.h>
 
 struct page;
-struct address_space;
 struct pipe_inode_info;
 
 struct kvec {
 
                        curr_addr = (unsigned long) from;
                        bytes = curr_addr - s_addr - rem;
                        rcu_read_unlock();
+                       i->iov_offset += bytes;
+                       i->count -= bytes;
                        return bytes;
                }
                })
                return;
        }
        if (unlikely(iov_iter_is_xarray(i))) {
+               size = min(size, i->count);
                i->iov_offset += size;
                i->count -= size;
                return;
                        return size | i->iov_offset;
                return size;
        }
+       if (unlikely(iov_iter_is_xarray(i)))
+               return (i->xarray_start + i->iov_offset) | i->count;
        iterate_all_kinds(i, size, v,
                (res |= (unsigned long)v.iov_base | v.iov_len, 0),
                res |= v.bv_offset | v.bv_len,