Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull misc fixes from Al Viro:
 "A couple of regression fixes, one for this merge window, one for the
  previous cycle"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  ipc/shm: Fix order of parameters when calling copy_compat_shmid_to_user
  iov_iter: fix page_copy_sane for compound pages

2 files changed, 5 insertions, 3 deletions

diff --git a/ipc/shm.c b/ipc/shm.c
index 1b3adfe3c60e..1e2b1692ba2c 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -1237,7 +1237,7 @@ COMPAT_SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, void __user *, uptr)
                 err = shmctl_stat(ns, shmid, cmd, &sem64);
                 if (err < 0)
                         return err;
-                if (copy_compat_shmid_to_user(&sem64, uptr, version))
+                if (copy_compat_shmid_to_user(uptr, &sem64, version))
                         err = -EFAULT;
                 return err;
 
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index 52c8dd6d8e82..1c1c06ddc20a 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -687,8 +687,10 @@ EXPORT_SYMBOL(_copy_from_iter_full_nocache);
 
 static inline bool page_copy_sane(struct page *page, size_t offset, size_t n)
 {
-        size_t v = n + offset;
-        if (likely(n <= v && v <= (PAGE_SIZE << compound_order(page))))
+        struct page *head = compound_head(page);
+        size_t v = n + offset + page_address(page) - page_address(head);
+
+        if (likely(n <= v && v <= (PAGE_SIZE << compound_order(head))))
                 return true;
         WARN_ON(1);
         return false;