fix ITER_PIPE interaction with direct_IO

by making sure we call iov_iter_advance() on original
iov_iter even if direct_IO (done on its copy) has returned 0.
It's a no-op for old iov_iter flavours and does the right thing
(== truncation of the stuff we'd allocated, but not filled) in
ITER_PIPE case.  Failures (e.g. -EIO) get caught and dealt with
by cleanup in generic_file_read_iter().

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
diff --git a/fs/splice.c b/fs/splice.c
index aa38901..153d4f3 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -315,15 +315,9 @@
 		*ppos = kiocb.ki_pos;
 		file_accessed(in);
 	} else if (ret < 0) {
-		if (WARN_ON(to.idx != idx || to.iov_offset)) {
-			/*
-			 * a bogus ->read_iter() has copied something and still
-			 * returned an error instead of a short read.
-			 */
-			to.idx = idx;
-			to.iov_offset = 0;
-			iov_iter_advance(&to, 0); /* to free what was emitted */
-		}
+		to.idx = idx;
+		to.iov_offset = 0;
+		iov_iter_advance(&to, 0); /* to free what was emitted */
 		/*
 		 * callers of ->splice_read() expect -EAGAIN on
 		 * "can't put anything in there", rather than -EFAULT.
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index 92f16cf..26cf153 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -317,7 +317,7 @@
 	data = *to;
 	ret = __blockdev_direct_IO(iocb, inode, target->bt_bdev, &data,
 			xfs_get_blocks_direct, NULL, NULL, 0);
-	if (ret > 0) {
+	if (ret >= 0) {
 		iocb->ki_pos += ret;
 		iov_iter_advance(to, ret);
 	}
diff --git a/mm/filemap.c b/mm/filemap.c
index 8a287df..6b965ef 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -1920,7 +1920,7 @@
 			retval = mapping->a_ops->direct_IO(iocb, &data);
 		}
 
-		if (retval > 0) {
+		if (retval >= 0) {
 			iocb->ki_pos += retval;
 			iov_iter_advance(iter, retval);
 		}