signal = math_emu_b3(opcode, regs);
                 } else if (opcode[0] == 0xed) {
                        get_user(*((__u32 *) (opcode+2)),
-                                (__u32 *)(location+1));
+                                (__u32 __user *)(location+1));
                        signal = math_emu_ed(opcode, regs);
                } else if (*((__u16 *) opcode) == 0xb299) {
                        get_user(*((__u16 *) (opcode+2)), location+1);
                info.si_signo = signal;
                info.si_errno = 0;
                info.si_code = SEGV_MAPERR;
-               info.si_addr = (void *) location;
+               info.si_addr = (void __user *) location;
                do_trap(interruption_code, signal,
                        "user address fault", regs, &info);
        } else
 specification_exception(struct pt_regs * regs, long interruption_code)
 {
         __u8 opcode[6];
-       __u16 *location = NULL;
+       __u16 __user *location = NULL;
        int signal = 0;
 
-       location = (__u16 *) get_check_address(regs);
+       location = (__u16 __user *) get_check_address(regs);
 
        /*
         * We got all needed information from the lowcore and can
                        break;
                 case 0xed:
                        get_user(*((__u32 *) (opcode+2)),
-                                (__u32 *)(location+1));
+                                (__u32 __user *)(location+1));
                        signal = math_emu_ed(opcode, regs);
                        break;
                case 0xb2: