1 files changed, 6 insertions, 2 deletions

diff --git a/block/blk-map.c b/block/blk-map.c
index ade0a08c9099..e663ac2d8e68 100644
--- a/block/blk-map.c
+++ b/block/blk-map.c
@@ -54,7 +54,7 @@ static int __blk_rq_map_user(struct request_queue *q, struct request *rq,
          * direct dma. else, set up kernel bounce buffers
          */
         uaddr = (unsigned long) ubuf;
-        if (blk_rq_aligned(q, ubuf, len) && !map_data)
+        if (blk_rq_aligned(q, uaddr, len) && !map_data)
                 bio = bio_map_user(q, NULL, uaddr, len, reading, gfp_mask);
         else
                 bio = bio_copy_user(q, map_data, uaddr, len, reading, gfp_mask);
@@ -201,6 +201,9 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
         for (i = 0; i < iov_count; i++) {
                 unsigned long uaddr = (unsigned long)iov[i].iov_base;
 
+                if (!iov[i].iov_len)
+                        return -EINVAL;
+
                 if (uaddr & queue_dma_alignment(q)) {
                         unaligned = 1;
                         break;
@@ -288,6 +291,7 @@ int blk_rq_map_kern(struct request_queue *q, struct request *rq, void *kbuf,
                     unsigned int len, gfp_t gfp_mask)
 {
         int reading = rq_data_dir(rq) == READ;
+        unsigned long addr = (unsigned long) kbuf;
         int do_copy = 0;
         struct bio *bio;
         int ret;
@@ -297,7 +301,7 @@ int blk_rq_map_kern(struct request_queue *q, struct request *rq, void *kbuf,
         if (!len || !kbuf)
                 return -EINVAL;
 
-        do_copy = !blk_rq_aligned(q, kbuf, len) || object_is_on_stack(kbuf);
+        do_copy = !blk_rq_aligned(q, addr, len) || object_is_on_stack(kbuf);
         if (do_copy)
                 bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
         else