projects/linux·commit 449cd5d2

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

449cd5d2 · Linus Torvalds <[email protected]> · 2017-09-21 05:57:50 -10:00

Pull misc fixes from Al Viro:
 "A couple of regression fixes, one for this merge window, one for the
  previous cycle"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  ipc/shm: Fix order of parameters when calling copy_compat_shmid_to_user
  iov_iter: fix page_copy_sane for compound pages
Commit
449cd5d2a08ddf3cb99dc9eb066e494345eb2a92
Parents
d9fde269 · 58aff0af

Merge commit. Changes below are compared with the first parent: d9fde269.

Changes

2 files changed · +5 −3

FileStatusAddDelContent
ipc/shm.cmodified+1−1View file
lib/iov_iter.cmodified+4−2View file

ipc/shm.c

View file
diff --git a/ipc/shm.c b/ipc/shm.c
index 1b3adfe..1e2b169 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -1237,7 +1237,7 @@ COMPAT_SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, void __user *, uptr)
err = shmctl_stat(ns, shmid, cmd, &sem64);
if (err < 0)
return err;
- if (copy_compat_shmid_to_user(&sem64, uptr, version))
+ if (copy_compat_shmid_to_user(uptr, &sem64, version))
err = -EFAULT;
return err;

lib/iov_iter.c

View file
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index 52c8dd6..1c1c06d 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -687,8 +687,10 @@ EXPORT_SYMBOL(_copy_from_iter_full_nocache);
static inline bool page_copy_sane(struct page *page, size_t offset, size_t n)
{
- size_t v = n + offset;
- if (likely(n <= v && v <= (PAGE_SIZE << compound_order(page))))
+ struct page *head = compound_head(page);
+ size_t v = n + offset + page_address(page) - page_address(head);
+
+ if (likely(n <= v && v <= (PAGE_SIZE << compound_order(head))))
return true;
WARN_ON(1);
return false;