switch (cmd) {
        case LIRC_GET_FEATURES:
-               result = put_user(ir->d.features, (__u32 *)arg);
+               result = put_user(ir->d.features, (__u32 __user *)arg);
                break;
        case LIRC_GET_REC_MODE:
                if (!(ir->d.features & LIRC_CAN_REC_MASK)) {
 
                result = put_user(LIRC_REC2MODE
                                  (ir->d.features & LIRC_CAN_REC_MASK),
-                                 (__u32 *)arg);
+                                 (__u32 __user *)arg);
                break;
        case LIRC_SET_REC_MODE:
                if (!(ir->d.features & LIRC_CAN_REC_MASK)) {
                        break;
                }
 
-               result = get_user(mode, (__u32 *)arg);
+               result = get_user(mode, (__u32 __user *)arg);
                if (!result && !(LIRC_MODE2REC(mode) & ir->d.features))
                        result = -EINVAL;
                /*
                 */
                break;
        case LIRC_GET_LENGTH:
-               result = put_user(ir->d.code_length, (__u32 *)arg);
+               result = put_user(ir->d.code_length, (__u32 __user *)arg);
                break;
        case LIRC_GET_MIN_TIMEOUT:
                if (!(ir->d.features & LIRC_CAN_SET_REC_TIMEOUT) ||
                        break;
                }
 
-               result = put_user(ir->d.min_timeout, (__u32 *)arg);
+               result = put_user(ir->d.min_timeout, (__u32 __user *)arg);
                break;
        case LIRC_GET_MAX_TIMEOUT:
                if (!(ir->d.features & LIRC_CAN_SET_REC_TIMEOUT) ||
                        break;
                }
 
-               result = put_user(ir->d.max_timeout, (__u32 *)arg);
+               result = put_user(ir->d.max_timeout, (__u32 __user *)arg);
                break;
        default:
                result = -EINVAL;
                        }
                } else {
                        lirc_buffer_read(ir->buf, buf);
-                       ret = copy_to_user((void *)buffer+written, buf,
+                       ret = copy_to_user((void __user *)buffer+written, buf,
                                           ir->buf->chunk_size);
                        if (!ret)
                                written += ir->buf->chunk_size;