1 files changed, 5 insertions, 5 deletions

diff --git a/fs/ioctl.c b/fs/ioctl.c
index d6cc16476620..a59635e295fa 100644
--- a/fs/ioctl.c
+++ b/fs/ioctl.c
@@ -86,7 +86,7 @@ int fiemap_fill_next_extent(struct fiemap_extent_info *fieinfo, u64 logical,
                             u64 phys, u64 len, u32 flags)
 {
         struct fiemap_extent extent;
-        struct fiemap_extent *dest = fieinfo->fi_extents_start;
+        struct fiemap_extent __user *dest = fieinfo->fi_extents_start;
 
         /* only count the extents */
         if (fieinfo->fi_extents_max == 0) {
@@ -173,6 +173,7 @@ static int fiemap_check_ranges(struct super_block *sb,
 static int ioctl_fiemap(struct file *filp, unsigned long arg)
 {
         struct fiemap fiemap;
+        struct fiemap __user *ufiemap = (struct fiemap __user *) arg;
         struct fiemap_extent_info fieinfo = { 0, };
         struct inode *inode = filp->f_path.dentry->d_inode;
         struct super_block *sb = inode->i_sb;
@@ -182,8 +183,7 @@ static int ioctl_fiemap(struct file *filp, unsigned long arg)
         if (!inode->i_op->fiemap)
                 return -EOPNOTSUPP;
 
-        if (copy_from_user(&fiemap, (struct fiemap __user *)arg,
-                           sizeof(struct fiemap)))
+        if (copy_from_user(&fiemap, ufiemap, sizeof(fiemap)))
                 return -EFAULT;
 
         if (fiemap.fm_extent_count > FIEMAP_MAX_EXTENTS)
@@ -196,7 +196,7 @@ static int ioctl_fiemap(struct file *filp, unsigned long arg)
 
         fieinfo.fi_flags = fiemap.fm_flags;
         fieinfo.fi_extents_max = fiemap.fm_extent_count;
-        fieinfo.fi_extents_start = (struct fiemap_extent *)(arg + sizeof(fiemap));
+        fieinfo.fi_extents_start = ufiemap->fm_extents;
 
         if (fiemap.fm_extent_count != 0 &&
             !access_ok(VERIFY_WRITE, fieinfo.fi_extents_start,
@@ -209,7 +209,7 @@ static int ioctl_fiemap(struct file *filp, unsigned long arg)
         error = inode->i_op->fiemap(inode, &fieinfo, fiemap.fm_start, len);
         fiemap.fm_flags = fieinfo.fi_flags;
         fiemap.fm_mapped_extents = fieinfo.fi_extents_mapped;
-        if (copy_to_user((char *)arg, &fiemap, sizeof(fiemap)))
+        if (copy_to_user(ufiemap, &fiemap, sizeof(fiemap)))
                 error = -EFAULT;
 
         return error;