req->in.numargs = 1;
        req->in.args[0].size = sizeof(struct fuse_read_in);
        req->in.args[0].value = inarg;
-       req->out.argpages = 1;
        req->out.argvar = 1;
        req->out.numargs = 1;
        req->out.args[0].size = count;
        attr_ver = fuse_get_attr_version(fc);
 
        req->out.page_zeroing = 1;
+       req->out.argpages = 1;
        req->num_pages = 1;
        req->pages[0] = page;
        num_read = fuse_send_read(req, file, inode, pos, count, NULL);
        struct fuse_conn *fc = get_fuse_conn(inode);
        loff_t pos = page_offset(req->pages[0]);
        size_t count = req->num_pages << PAGE_CACHE_SHIFT;
+
+       req->out.argpages = 1;
        req->out.page_zeroing = 1;
        fuse_read_fill(req, file, inode, pos, count, FUSE_READ);
        req->misc.read.attr_ver = fuse_get_attr_version(fc);
        inarg->flags = file ? file->f_flags : 0;
        req->in.h.opcode = FUSE_WRITE;
        req->in.h.nodeid = get_node_id(inode);
-       req->in.argpages = 1;
        req->in.numargs = 2;
        if (fc->minor < 9)
                req->in.args[0].size = FUSE_COMPAT_WRITE_IN_SIZE;
        if (IS_ERR(req))
                return PTR_ERR(req);
 
+       req->in.argpages = 1;
        req->num_pages = 1;
        req->pages[0] = page;
        req->page_offset = offset;
        size_t count = 0;
        int err;
 
+       req->in.argpages = 1;
        req->page_offset = offset;
 
        do {
 }
 
 static int fuse_get_user_pages(struct fuse_req *req, const char __user *buf,
-                              unsigned nbytes, int write)
+                              unsigned *nbytesp, int write)
 {
+       unsigned nbytes = *nbytesp;
        unsigned long user_addr = (unsigned long) buf;
        unsigned offset = user_addr & ~PAGE_MASK;
        int npages;
 
-       /* This doesn't work with nfsd */
-       if (!current->mm)
-               return -EPERM;
+       /* Special case for kernel I/O: can copy directly into the buffer */
+       if (segment_eq(get_fs(), KERNEL_DS)) {
+               if (write)
+                       req->in.args[1].value = (void *) user_addr;
+               else
+                       req->out.args[0].value = (void *) user_addr;
+
+               return 0;
+       }
 
        nbytes = min(nbytes, (unsigned) FUSE_MAX_PAGES_PER_REQ << PAGE_SHIFT);
        npages = (nbytes + offset + PAGE_SIZE - 1) >> PAGE_SHIFT;
        npages = clamp(npages, 1, FUSE_MAX_PAGES_PER_REQ);
        down_read(¤t->mm->mmap_sem);
-       npages = get_user_pages(current, current->mm, user_addr, npages, write,
+       npages = get_user_pages(current, current->mm, user_addr, npages, !write,
                                0, req->pages, NULL);
        up_read(¤t->mm->mmap_sem);
        if (npages < 0)
 
        req->num_pages = npages;
        req->page_offset = offset;
+
+       if (write)
+               req->in.argpages = 1;
+       else
+               req->out.argpages = 1;
+
+       nbytes = (req->num_pages << PAGE_SHIFT) - req->page_offset;
+       *nbytesp = min(*nbytesp, nbytes);
+
        return 0;
 }
 
 
        while (count) {
                size_t nres;
-               size_t nbytes_limit = min(count, nmax);
-               size_t nbytes;
-               int err = fuse_get_user_pages(req, buf, nbytes_limit, !write);
+               size_t nbytes = min(count, nmax);
+               int err = fuse_get_user_pages(req, buf, &nbytes, write);
                if (err) {
                        res = err;
                        break;
                }
-               nbytes = (req->num_pages << PAGE_SHIFT) - req->page_offset;
-               nbytes = min(nbytes_limit, nbytes);
+
                if (write)
                        nres = fuse_send_write(req, file, inode, pos, nbytes,
                                               current->files);
        fuse_write_fill(req, NULL, ff, inode, page_offset(page), 0, 1);
 
        copy_highpage(tmp_page, page);
+       req->in.argpages = 1;
        req->num_pages = 1;
        req->pages[0] = tmp_page;
        req->page_offset = 0;