Commit 449cd5d2 authored by Linus Torvalds's avatar Linus Torvalds

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull misc fixes from Al Viro:
 "A couple of regression fixes, one for this merge window, one for the
  previous cycle"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  ipc/shm: Fix order of parameters when calling copy_compat_shmid_to_user
  iov_iter: fix page_copy_sane for compound pages
parents d9fde269 58aff0af
...@@ -1237,7 +1237,7 @@ COMPAT_SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, void __user *, uptr) ...@@ -1237,7 +1237,7 @@ COMPAT_SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, void __user *, uptr)
err = shmctl_stat(ns, shmid, cmd, &sem64); err = shmctl_stat(ns, shmid, cmd, &sem64);
if (err < 0) if (err < 0)
return err; return err;
if (copy_compat_shmid_to_user(&sem64, uptr, version)) if (copy_compat_shmid_to_user(uptr, &sem64, version))
err = -EFAULT; err = -EFAULT;
return err; return err;
......
...@@ -687,8 +687,10 @@ EXPORT_SYMBOL(_copy_from_iter_full_nocache); ...@@ -687,8 +687,10 @@ EXPORT_SYMBOL(_copy_from_iter_full_nocache);
static inline bool page_copy_sane(struct page *page, size_t offset, size_t n) static inline bool page_copy_sane(struct page *page, size_t offset, size_t n)
{ {
size_t v = n + offset; struct page *head = compound_head(page);
if (likely(n <= v && v <= (PAGE_SIZE << compound_order(page)))) size_t v = n + offset + page_address(page) - page_address(head);
if (likely(n <= v && v <= (PAGE_SIZE << compound_order(head))))
return true; return true;
WARN_ON(1); WARN_ON(1);
return false; return false;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment