struct nfs_open_context *ctx;           /* file open context info */
        struct kiocb *          iocb;           /* controlling i/o request */
        struct inode *          inode;          /* target file of i/o */
-       struct page **          pages;          /* pages in our buffer */
-       unsigned int            npages;         /* count of pages */
 
        /* completion state */
        atomic_t                io_count;       /* i/os we're waiting for */
        return atomic_dec_and_test(&dreq->io_count);
 }
 
+/*
+ * "size" is never larger than rsize or wsize.
+ */
+static inline int nfs_direct_count_pages(unsigned long user_addr, size_t size)
+{
+       int page_count;
+
+       page_count = (user_addr + size + PAGE_SIZE - 1) >> PAGE_SHIFT;
+       page_count -= user_addr >> PAGE_SHIFT;
+       BUG_ON(page_count < 0);
+
+       return page_count;
+}
+
 /**
  * nfs_direct_IO - NFS address space operation for direct I/O
  * @rw: direction (read or write)
                page_cache_release(pages[i]);
 }
 
-static inline int nfs_get_user_pages(int rw, unsigned long user_addr, size_t size, struct page ***pages)
-{
-       int result = -ENOMEM;
-       unsigned long page_count;
-       size_t array_size;
-
-       page_count = (user_addr + size + PAGE_SIZE - 1) >> PAGE_SHIFT;
-       page_count -= user_addr >> PAGE_SHIFT;
-
-       array_size = (page_count * sizeof(struct page *));
-       *pages = kmalloc(array_size, GFP_KERNEL);
-       if (*pages) {
-               down_read(¤t->mm->mmap_sem);
-               result = get_user_pages(current, current->mm, user_addr,
-                                       page_count, (rw == READ), 0,
-                                       *pages, NULL);
-               up_read(¤t->mm->mmap_sem);
-               if (result != page_count) {
-                       /*
-                        * If we got fewer pages than expected from
-                        * get_user_pages(), the user buffer runs off the
-                        * end of a mapping; return EFAULT.
-                        */
-                       if (result >= 0) {
-                               nfs_direct_release_pages(*pages, result);
-                               result = -EFAULT;
-                       } else
-                               kfree(*pages);
-                       *pages = NULL;
-               }
-       }
-       return result;
-}
-
 static inline struct nfs_direct_req *nfs_direct_req_alloc(void)
 {
        struct nfs_direct_req *dreq;
 }
 
 /*
- * We must hold a reference to all the pages in this direct read request
- * until the RPCs complete.  This could be long *after* we are woken up in
- * nfs_direct_wait (for instance, if someone hits ^C on a slow server).
- *
- * In addition, synchronous I/O uses a stack-allocated iocb.  Thus we
- * can't trust the iocb is still valid here if this is a synchronous
- * request.  If the waiter is woken prematurely, the iocb is long gone.
+ * Synchronous I/O uses a stack-allocated iocb.  Thus we can't trust
+ * the iocb is still valid here if this is a synchronous request.
  */
 static void nfs_direct_complete(struct nfs_direct_req *dreq)
 {
        return dreq;
 }
 
+/*
+ * We must hold a reference to all the pages in this direct read request
+ * until the RPCs complete.  This could be long *after* we are woken up in
+ * nfs_direct_wait (for instance, if someone hits ^C on a slow server).
+ */
 static void nfs_direct_read_result(struct rpc_task *task, void *calldata)
 {
        struct nfs_read_data *data = calldata;
        if (nfs_readpage_result(task, data) != 0)
                return;
 
+       nfs_direct_dirty_pages(data->pagevec, data->npages);
+       nfs_direct_release_pages(data->pagevec, data->npages);
+
        spin_lock(&dreq->lock);
 
        if (likely(task->tk_status >= 0))
 
        spin_unlock(&dreq->lock);
 
-       if (put_dreq(dreq)) {
-               nfs_direct_dirty_pages(dreq->pages, dreq->npages);
-               nfs_direct_release_pages(dreq->pages, dreq->npages);
+       if (put_dreq(dreq))
                nfs_direct_complete(dreq);
-       }
 }
 
 static const struct rpc_call_ops nfs_read_direct_ops = {
 
 /*
  * For each nfs_read_data struct that was allocated on the list, dispatch
- * an NFS READ operation
+ * an NFS READ operation.  If get_user_pages() fails, we stop sending reads.
+ * Read length accounting is handled by nfs_direct_read_result().
+ * Otherwise, if no requests have been sent, just return an error.
  */
-static void nfs_direct_read_schedule(struct nfs_direct_req *dreq, unsigned long user_addr, size_t count, loff_t pos)
+static ssize_t nfs_direct_read_schedule(struct nfs_direct_req *dreq, unsigned long user_addr, size_t count, loff_t pos)
 {
        struct nfs_open_context *ctx = dreq->ctx;
        struct inode *inode = ctx->dentry->d_inode;
        struct list_head *list = &dreq->list;
-       struct page **pages = dreq->pages;
        size_t rsize = NFS_SERVER(inode)->rsize;
-       unsigned int curpage, pgbase;
+       unsigned int pgbase;
+       int result;
+       ssize_t started = 0;
+       struct nfs_read_data *data;
 
-       curpage = 0;
        pgbase = user_addr & ~PAGE_MASK;
        do {
-               struct nfs_read_data *data;
                size_t bytes;
 
                bytes = rsize;
                data = list_entry(list->next, struct nfs_read_data, pages);
                list_del_init(&data->pages);
 
+               data->npages = nfs_direct_count_pages(user_addr, bytes);
+               down_read(¤t->mm->mmap_sem);
+               result = get_user_pages(current, current->mm, user_addr,
+                                       data->npages, 1, 0, data->pagevec, NULL);
+               up_read(¤t->mm->mmap_sem);
+               if (unlikely(result < data->npages))
+                       goto out_err;
+
                data->inode = inode;
                data->cred = ctx->cred;
                data->args.fh = NFS_FH(inode);
                data->args.context = ctx;
                data->args.offset = pos;
                data->args.pgbase = pgbase;
-               data->args.pages = &pages[curpage];
+               data->args.pages = data->pagevec;
                data->args.count = bytes;
                data->res.fattr = &data->fattr;
                data->res.eof = 0;
                                bytes,
                                (unsigned long long)data->args.offset);
 
+               started += bytes;
+               user_addr += bytes;
                pos += bytes;
                pgbase += bytes;
-               curpage += pgbase >> PAGE_SHIFT;
                pgbase &= ~PAGE_MASK;
 
                count -= bytes;
        } while (count != 0);
        BUG_ON(!list_empty(list));
+       return 0;
+
+out_err:
+       if (result > 0)
+               nfs_direct_release_pages(data->pagevec, result);
+
+       list_add(&data->pages, list);
+       while (!list_empty(list)) {
+               data = list_entry(list->next, struct nfs_read_data, pages);
+               list_del(&data->pages);
+               nfs_readdata_free(data);
+               if (put_dreq(dreq))
+                       nfs_direct_complete(dreq);
+       }
+
+       if (started)
+               return 0;
+       return result < 0 ? (ssize_t) result : -EFAULT;
 }
 
-static ssize_t nfs_direct_read(struct kiocb *iocb, unsigned long user_addr, size_t count, loff_t pos, struct page **pages, unsigned int nr_pages)
+static ssize_t nfs_direct_read(struct kiocb *iocb, unsigned long user_addr, size_t count, loff_t pos)
 {
        ssize_t result;
        sigset_t oldset;
        if (!dreq)
                return -ENOMEM;
 
-       dreq->pages = pages;
-       dreq->npages = nr_pages;
        dreq->inode = inode;
        dreq->ctx = get_nfs_open_context((struct nfs_open_context *)iocb->ki_filp->private_data);
        if (!is_sync_kiocb(iocb))
 
        nfs_add_stats(inode, NFSIOS_DIRECTREADBYTES, count);
        rpc_clnt_sigmask(clnt, &oldset);
-       nfs_direct_read_schedule(dreq, user_addr, count, pos);
-       result = nfs_direct_wait(dreq);
+       result = nfs_direct_read_schedule(dreq, user_addr, count, pos);
+       if (!result)
+               result = nfs_direct_wait(dreq);
        rpc_clnt_sigunmask(clnt, &oldset);
 
        return result;
        while (!list_empty(&dreq->list)) {
                struct nfs_write_data *data = list_entry(dreq->list.next, struct nfs_write_data, pages);
                list_del(&data->pages);
+               nfs_direct_release_pages(data->pagevec, data->npages);
                nfs_writedata_release(data);
        }
-       nfs_direct_release_pages(dreq->pages, dreq->npages);
 }
 
 #if defined(CONFIG_NFS_V3) || defined(CONFIG_NFS_V4)
 
 /*
  * For each nfs_write_data struct that was allocated on the list, dispatch
- * an NFS WRITE operation
+ * an NFS WRITE operation.  If get_user_pages() fails, we stop sending writes.
+ * Write length accounting is handled by nfs_direct_write_result().
+ * Otherwise, if no requests have been sent, just return an error.
  */
-static void nfs_direct_write_schedule(struct nfs_direct_req *dreq, unsigned long user_addr, size_t count, loff_t pos, int sync)
+static ssize_t nfs_direct_write_schedule(struct nfs_direct_req *dreq, unsigned long user_addr, size_t count, loff_t pos, int sync)
 {
        struct nfs_open_context *ctx = dreq->ctx;
        struct inode *inode = ctx->dentry->d_inode;
        struct list_head *list = &dreq->list;
-       struct page **pages = dreq->pages;
        size_t wsize = NFS_SERVER(inode)->wsize;
-       unsigned int curpage, pgbase;
+       unsigned int pgbase;
+       int result;
+       ssize_t started = 0;
+       struct nfs_write_data *data;
 
-       curpage = 0;
        pgbase = user_addr & ~PAGE_MASK;
        do {
-               struct nfs_write_data *data;
                size_t bytes;
 
                bytes = wsize;
 
                BUG_ON(list_empty(list));
                data = list_entry(list->next, struct nfs_write_data, pages);
+
+               data->npages = nfs_direct_count_pages(user_addr, bytes);
+               down_read(¤t->mm->mmap_sem);
+               result = get_user_pages(current, current->mm, user_addr,
+                                       data->npages, 0, 0, data->pagevec, NULL);
+               up_read(¤t->mm->mmap_sem);
+               if (unlikely(result < data->npages))
+                       goto out_err;
+
                list_move_tail(&data->pages, &dreq->rewrite_list);
 
                data->inode = inode;
                data->args.context = ctx;
                data->args.offset = pos;
                data->args.pgbase = pgbase;
-               data->args.pages = &pages[curpage];
+               data->args.pages = data->pagevec;
                data->args.count = bytes;
                data->res.fattr = &data->fattr;
                data->res.count = bytes;
                                bytes,
                                (unsigned long long)data->args.offset);
 
+               started += bytes;
+               user_addr += bytes;
                pos += bytes;
                pgbase += bytes;
-               curpage += pgbase >> PAGE_SHIFT;
                pgbase &= ~PAGE_MASK;
 
                count -= bytes;
        } while (count != 0);
        BUG_ON(!list_empty(list));
+       return 0;
+
+out_err:
+       if (result > 0)
+               nfs_direct_release_pages(data->pagevec, result);
+
+       list_add(&data->pages, list);
+       while (!list_empty(list)) {
+               data = list_entry(list->next, struct nfs_write_data, pages);
+               list_del(&data->pages);
+               nfs_writedata_free(data);
+               if (put_dreq(dreq))
+                       nfs_direct_write_complete(dreq, inode);
+       }
+
+       if (started)
+               return 0;
+       return result < 0 ? (ssize_t) result : -EFAULT;
 }
 
-static ssize_t nfs_direct_write(struct kiocb *iocb, unsigned long user_addr, size_t count, loff_t pos, struct page **pages, int nr_pages)
+static ssize_t nfs_direct_write(struct kiocb *iocb, unsigned long user_addr, size_t count, loff_t pos)
 {
        ssize_t result;
        sigset_t oldset;
        if (dreq->commit_data == NULL || count < wsize)
                sync = FLUSH_STABLE;
 
-       dreq->pages = pages;
-       dreq->npages = nr_pages;
        dreq->inode = inode;
        dreq->ctx = get_nfs_open_context((struct nfs_open_context *)iocb->ki_filp->private_data);
        if (!is_sync_kiocb(iocb))
        nfs_begin_data_update(inode);
 
        rpc_clnt_sigmask(clnt, &oldset);
-       nfs_direct_write_schedule(dreq, user_addr, count, pos, sync);
-       result = nfs_direct_wait(dreq);
+       result = nfs_direct_write_schedule(dreq, user_addr, count, pos, sync);
+       if (!result)
+               result = nfs_direct_wait(dreq);
        rpc_clnt_sigunmask(clnt, &oldset);
 
        return result;
 ssize_t nfs_file_direct_read(struct kiocb *iocb, char __user *buf, size_t count, loff_t pos)
 {
        ssize_t retval = -EINVAL;
-       int page_count;
-       struct page **pages;
        struct file *file = iocb->ki_filp;
        struct address_space *mapping = file->f_mapping;
 
        if (retval)
                goto out;
 
-       retval = nfs_get_user_pages(READ, (unsigned long) buf,
-                                               count, &pages);
-       if (retval < 0)
-               goto out;
-       page_count = retval;
-
-       retval = nfs_direct_read(iocb, (unsigned long) buf, count, pos,
-                                               pages, page_count);
+       retval = nfs_direct_read(iocb, (unsigned long) buf, count, pos);
        if (retval > 0)
                iocb->ki_pos = pos + retval;
 
 ssize_t nfs_file_direct_write(struct kiocb *iocb, const char __user *buf, size_t count, loff_t pos)
 {
        ssize_t retval;
-       int page_count;
-       struct page **pages;
        struct file *file = iocb->ki_filp;
        struct address_space *mapping = file->f_mapping;
 
        if (retval)
                goto out;
 
-       retval = nfs_get_user_pages(WRITE, (unsigned long) buf,
-                                               count, &pages);
-       if (retval < 0)
-               goto out;
-       page_count = retval;
-
-       retval = nfs_direct_write(iocb, (unsigned long) buf, count,
-                                       pos, pages, page_count);
+       retval = nfs_direct_write(iocb, (unsigned long) buf, count, pos);
 
        /*
         * XXX: nfs_end_data_update() already ensures this file's