diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index ae82d9c..f835964 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -790,6 +790,8 @@
 {
 	if (!unroll)
 		return;
+	if (WARN_ON(unroll > MAX_RW_COUNT))
+		return;
 	i->count += unroll;
 	if (unlikely(i->type & ITER_PIPE)) {
 		struct pipe_inode_info *pipe = i->pipe;
diff --git a/mm/filemap.c b/mm/filemap.c
index b7b973b..6f1be57 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -2050,7 +2050,7 @@
 			iocb->ki_pos += retval;
 			count -= retval;
 		}
-		iov_iter_revert(iter, iov_iter_count(iter) - count);
+		iov_iter_revert(iter, count - iov_iter_count(iter));
 
 		/*
 		 * Btrfs can have a short DIO read if we encounter