1 files changed, 5 insertions, 4 deletions

diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 8b57173c1dd..9c51f9f58ca 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -636,7 +636,6 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
         struct vm_area_struct *prev;
         struct vm_area_struct *vma;
         int err = 0;
-        pgoff_t pgoff;
         unsigned long vmstart;
         unsigned long vmend;
 
@@ -649,9 +648,9 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
                 vmstart = max(start, vma->vm_start);
                 vmend   = min(end, vma->vm_end);
 
-                pgoff = vma->vm_pgoff + ((start - vma->vm_start) >> PAGE_SHIFT);
                 prev = vma_merge(mm, prev, vmstart, vmend, vma->vm_flags,
-                                  vma->anon_vma, vma->vm_file, pgoff, new_pol);
+                                  vma->anon_vma, vma->vm_file, vma->vm_pgoff,
+                                  new_pol);
                 if (prev) {
                         vma = prev;
                         next = vma->vm_next;
@@ -1412,7 +1411,9 @@ asmlinkage long compat_sys_get_mempolicy(int __user *policy,
         err = sys_get_mempolicy(policy, nm, nr_bits+1, addr, flags);
 
         if (!err && nmask) {
-                err = copy_from_user(bm, nm, alloc_size);
+                unsigned long copy_size;
+                copy_size = min_t(unsigned long, sizeof(bm), alloc_size);
+                err = copy_from_user(bm, nm, copy_size);
                 /* ensure entire bitmap is zeroed */
                 err |= clear_user(nmask, ALIGN(maxnode-1, 8) / 8);
                 err |= compat_put_bitmap(nmask, bm, nr_bits);