1 files changed, 9 insertions, 2 deletions

diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
index d42738deec6d..e4a4f82ea13f 100644
--- a/fs/xfs/xfs_ioctl.c
+++ b/fs/xfs/xfs_ioctl.c
@@ -403,6 +403,7 @@ xfs_attrlist_by_handle(
 {
         int                     error = -ENOMEM;
         attrlist_cursor_kern_t  *cursor;
+        struct xfs_fsop_attrlist_handlereq __user       *p = arg;
         xfs_fsop_attrlist_handlereq_t al_hreq;
         struct dentry           *dentry;
         char                    *kbuf;
@@ -435,6 +436,11 @@ xfs_attrlist_by_handle(
         if (error)
                 goto out_kfree;
 
+        if (copy_to_user(&p->pos, cursor, sizeof(attrlist_cursor_kern_t))) {
+                error = -EFAULT;
+                goto out_kfree;
+        }
+
         if (copy_to_user(al_hreq.buffer, kbuf, al_hreq.buflen))
                 error = -EFAULT;
 
@@ -1379,10 +1385,11 @@ xfs_ioc_getbmap(
         unsigned int            cmd,
         void                    __user *arg)
 {
-        struct getbmapx         bmx;
+        struct getbmapx         bmx = { 0 };
         int                     error;
 
-        if (copy_from_user(&bmx, arg, sizeof(struct getbmapx)))
+        /* struct getbmap is a strict subset of struct getbmapx. */
+        if (copy_from_user(&bmx, arg, offsetof(struct getbmapx, bmv_iflags)))
                 return -EFAULT;
 
         if (bmx.bmv_count < 2)