diff --git a/net/bluetooth/hidp/hidp.h b/net/bluetooth/hidp/hidp.h
index c2775f587d2eec2f6ee5d49b8e93ebe8b7b55221..c8dfacd40a065fa58d408a0b62984f6589b660df 100644
--- a/net/bluetooth/hidp/hidp.h
+++ b/net/bluetooth/hidp/hidp.h
@@ -86,7 +86,7 @@ struct hidp_connadd_req {
 	int   intr_sock;	// Connteted interrupt socket
 	__u16 parser;
 	__u16 rd_size;
-	__u8 *rd_data;
+	__u8 __user *rd_data;
 	__u8  country;
 	__u8  subclass;
 	__u16 vendor;
diff --git a/net/bluetooth/hidp/sock.c b/net/bluetooth/hidp/sock.c
index 407fba43c1b973cda01122be9cc3dce198c2b930..93cf9e586178b5d2d1477dc80dd049e9ccd60ea3 100644
--- a/net/bluetooth/hidp/sock.c
+++ b/net/bluetooth/hidp/sock.c
@@ -189,7 +189,7 @@ static int hidp_sock_compat_ioctl(struct socket *sock, unsigned int cmd, unsigne
 
 		uca = compat_alloc_user_space(sizeof(*uca));
 
-		if (copy_from_user(&ca, (void *) arg, sizeof(ca)))
+		if (copy_from_user(&ca, (void __user *) arg, sizeof(ca)))
 			return -EFAULT;
 
 		if (put_user(ca.ctrl_sock, &uca->ctrl_sock) ||