Two ioctl functions in sound/oss/awe_wave.c were directly dereferencing
a user-supplied pointer in a few places.