diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2017-09-21 05:57:50 -1000 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2017-09-21 05:57:50 -1000 |
| commit | 449cd5d2a08ddf3cb99dc9eb066e494345eb2a92 (patch) | |
| tree | a426ebb831252623207b7c46c87f947ccdfbfedd | |
| parent | d9fde269823620e517fea34b28b41b587c4a81f5 (diff) | |
| parent | 58aff0af757356065f33290d96a9cd46dfbcae88 (diff) | |
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
Pull misc fixes from Al Viro:
"A couple of regression fixes, one for this merge window, one for the
previous cycle"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
ipc/shm: Fix order of parameters when calling copy_compat_shmid_to_user
iov_iter: fix page_copy_sane for compound pages
| -rw-r--r-- | ipc/shm.c | 2 | ||||
| -rw-r--r-- | lib/iov_iter.c | 6 |
2 files changed, 5 insertions, 3 deletions
diff --git a/ipc/shm.c b/ipc/shm.c index 1b3adfe3c60e..1e2b1692ba2c 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -1237,7 +1237,7 @@ COMPAT_SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, void __user *, uptr) err = shmctl_stat(ns, shmid, cmd, &sem64); if (err < 0) return err; - if (copy_compat_shmid_to_user(&sem64, uptr, version)) + if (copy_compat_shmid_to_user(uptr, &sem64, version)) err = -EFAULT; return err; diff --git a/lib/iov_iter.c b/lib/iov_iter.c index 52c8dd6d8e82..1c1c06ddc20a 100644 --- a/lib/iov_iter.c +++ b/lib/iov_iter.c @@ -687,8 +687,10 @@ EXPORT_SYMBOL(_copy_from_iter_full_nocache); static inline bool page_copy_sane(struct page *page, size_t offset, size_t n) { - size_t v = n + offset; - if (likely(n <= v && v <= (PAGE_SIZE << compound_order(page)))) + struct page *head = compound_head(page); + size_t v = n + offset + page_address(page) - page_address(head); + + if (likely(n <= v && v <= (PAGE_SIZE << compound_order(head)))) return true; WARN_ON(1); return false; |