3 files changed, 10 insertions, 9 deletions

diff --git a/arch/mips/kernel/branch.c b/arch/mips/kernel/branch.c
index 76fd3f22c766..6b5df8bfab85 100644
--- a/arch/mips/kernel/branch.c
+++ b/arch/mips/kernel/branch.c
@@ -22,7 +22,8 @@
  */
 int __compute_return_epc(struct pt_regs *regs)
 {
-        unsigned int *addr, bit, fcr31, dspcontrol;
+        unsigned int __user *addr;
+        unsigned int bit, fcr31, dspcontrol;
         long epc;
         union mips_instruction insn;
 
@@ -33,7 +34,7 @@ int __compute_return_epc(struct pt_regs *regs)
         /*
          * Read the instruction
          */
-        addr = (unsigned int *) epc;
+        addr = (unsigned int __user *) epc;
         if (__get_user(insn.word, addr)) {
                 force_sig(SIGSEGV, current);
                 return -EFAULT;
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 5e9fa83c4ef0..6f3e5c1424d3 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -131,7 +131,7 @@ static void show_stacktrace(struct task_struct *task, struct pt_regs *regs)
         const int field = 2 * sizeof(unsigned long);
         long stackdata;
         int i;
-        unsigned long *sp = (unsigned long *)regs->regs[29];
+        unsigned long __user *sp = (unsigned long __user *)regs->regs[29];
 
         printk("Stack :");
         i = 0;
diff --git a/arch/mips/math-emu/dsemul.c b/arch/mips/math-emu/dsemul.c
index ea6ba7248489..653e325849e4 100644
--- a/arch/mips/math-emu/dsemul.c
+++ b/arch/mips/math-emu/dsemul.c
@@ -54,8 +54,7 @@ struct emuframe {
 int mips_dsemul(struct pt_regs *regs, mips_instruction ir, unsigned long cpc)
 {
         extern asmlinkage void handle_dsemulret(void);
-        mips_instruction *dsemul_insns;
-        struct emuframe *fr;
+        struct emuframe __user *fr;
         int err;
 
         if (ir == 0) {          /* a nop is easy */
@@ -87,8 +86,8 @@ int mips_dsemul(struct pt_regs *regs, mips_instruction ir, unsigned long cpc)
          */
 
         /* Ensure that the two instructions are in the same cache line */
-        dsemul_insns = (mips_instruction *) ((regs->regs[29] - sizeof(struct emuframe)) & ~0x7);
-        fr = (struct emuframe *) dsemul_insns;
+        fr = (struct emuframe __user *)
+                ((regs->regs[29] - sizeof(struct emuframe)) & ~0x7);
 
         /* Verify that the stack pointer is not competely insane */
         if (unlikely(!access_ok(VERIFY_WRITE, fr, sizeof(struct emuframe))))
@@ -113,12 +112,13 @@ int mips_dsemul(struct pt_regs *regs, mips_instruction ir, unsigned long cpc)
 
 int do_dsemulret(struct pt_regs *xcp)
 {
-        struct emuframe *fr;
+        struct emuframe __user *fr;
         unsigned long epc;
         u32 insn, cookie;
         int err = 0;
 
-        fr = (struct emuframe *) (xcp->cp0_epc - sizeof(mips_instruction));
+        fr = (struct emuframe __user *)
+                (xcp->cp0_epc - sizeof(mips_instruction));
 
         /*
          * If we can't even access the area, something is very wrong, but we'll