diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 6f2872fffb079d97a8f42811195aa93df6444d7f..bf7b31bebe2d5aaa648f4eeed1ec017102c7ad6f 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -3187,18 +3187,18 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
             argc = 0;
             guest_argp = arg2;
             for (gp = guest_argp; ; gp++) {
-                if (get_user_ual(guest_argp, gp))
+                if (get_user_ual(addr, gp))
                     goto efault;
-                if (!guest_argp)
+                if (!addr)
                     break;
                 argc++;
             }
             envc = 0;
             guest_envp = arg3;
             for (gp = guest_envp; ; gp++) {
-                if (get_user_ual(guest_envp, gp))
+                if (get_user_ual(addr, gp))
                     goto efault;
-                if (!guest_envp)
+                if (!addr)
                     break;
                 envc++;
             }