The fast poll code incorrectly assumed that "sizeof pp" was the same

as "offsetof pp->entries". Which happens to be true on 32-bit platforms,
but not on 64-bit ones.

From Anton Blanchard.

fs/select.c

@@ -471,7 +471,7 @@ asmlinkage long sys_poll(struct pollfd * ufds, unsigned int nfds, long timeout)
 			walk->next = pp;
 
 		walk = pp;
-		if (copy_from_user(pp+1, ufds + nfds-i, 
+		if (copy_from_user(pp->entries, ufds + nfds-i, 
 				sizeof(struct pollfd)*pp->len)) {
 			err = -EFAULT;
 			goto out_fds;