2007-02-06 Josh Stone <joshua.i.stone@intel.com>

	* aux_syscalls.stp, inet_sock.stp, ioblock.stp, ioscheduler.stp,
	nfs.stp, nfs_proc.stp, nfsd.stp, rpc.stp, scsi.stp, signal.stp,
	socket.stp, task.stp, tcp.stp, vfs.stp: Protect pointer dereferences
	with kread wherever possible.  Some places still have hazards, as
	marked with FIXMEs.

	* errno.stp (returnstr): Don't use return in tapset C functions.
	* aux_syscalls.stp (__uget_timex_m): Ditto.
	* nfsd.stp (__get_fh): Ditto.
	* nfs.stp, vfs.stp (<many functions>): Ditto.
	* string.stp (substr): Ditto. Also make sure start index is valid.

	* syscalls.stp (syscall.execve): Change __string to kernel_string.

LKET/
	* nfs.stp, nfs_proc.stp, nfsd.stp, process.stp, tskdispatch.stp:
	Protect pointer dereferences with kread wherever possible.  Some
	places still have hazards, as marked with FIXMEs.

	* aio.stp (log_io_getevents): Don't use return in tapset C functions.
	* timestamp.stp (set_timing_method): Ditto.
	* utils.stp (filter_by_pid): Ditto.

27 files changed, 691 insertions, 804 deletions

diff --git a/tapset/ChangeLog b/tapset/ChangeLog
index 8e1766cd..9ac6e525 100644
--- a/tapset/ChangeLog
+++ b/tapset/ChangeLog
@@ -1,3 +1,19 @@
+2007-02-06  Josh Stone  <joshua.i.stone@intel.com>
+
+	* aux_syscalls.stp, inet_sock.stp, ioblock.stp, ioscheduler.stp,
+	nfs.stp, nfs_proc.stp, nfsd.stp, rpc.stp, scsi.stp, signal.stp,
+	socket.stp, task.stp, tcp.stp, vfs.stp: Protect pointer dereferences
+	with kread wherever possible.  Some places still have hazards, as
+	marked with FIXMEs.
+
+	* errno.stp (returnstr): Don't use return in tapset C functions.
+	* aux_syscalls.stp (__uget_timex_m): Ditto.
+	* nfsd.stp (__get_fh): Ditto.
+	* nfs.stp, vfs.stp (<many functions>): Ditto.
+	* string.stp (substr): Ditto. Also make sure start index is valid.
+
+	* syscalls.stp (syscall.execve): Change __string to kernel_string.
+
 2007-02-06  Frank Ch. Eigler  <fche@elastic.org>
 
 	* conversions.stp (kernel_long/int/short/char): New functions.
diff --git a/tapset/LKET/Changelog b/tapset/LKET/Changelog
index 96bfadc0..9f267636 100644
--- a/tapset/LKET/Changelog
+++ b/tapset/LKET/Changelog
@@ -1,3 +1,13 @@
+2007-02-06  Josh Stone  <joshua.i.stone@intel.com>
+
+	* nfs.stp, nfs_proc.stp, nfsd.stp, process.stp, tskdispatch.stp:
+	Protect pointer dereferences with kread wherever possible.  Some
+	places still have hazards, as marked with FIXMEs.
+
+	* aio.stp (log_io_getevents): Don't use return in tapset C functions.
+	* timestamp.stp (set_timing_method): Ditto.
+	* utils.stp (filter_by_pid): Ditto.
+
 2006-12-29  Li Guanglei <guanglei@cn.ibm.com>
 
 	From Gui Jian <guij@cn.ibm.com>
diff --git a/tapset/LKET/aio.stp b/tapset/LKET/aio.stp
index ea81d024..09b3a3b8 100755
--- a/tapset/LKET/aio.stp
+++ b/tapset/LKET/aio.stp
@@ -237,13 +237,11 @@ function log_io_getevents(ctx_id:long, min_nr:long, nr:long,
 	struct timespec __user *timeout = (struct timespec *)((long)THIS->timeout);
 	struct timespec ts;
 
-	if (unlikely(copy_from_user(&ts, timeout, sizeof(ts))))
-		return;
-
-	_lket_trace(_GROUP_AIO, _HOOKID_AIO_IO_GETEVENTS_ENTRY,
-		"%8b%4b%4b%8b%4b%4b", THIS->ctx_id, THIS->min_nr,
-		THIS->nr, THIS->events_uaddr, (_FMT_)ts.tv_sec, 
-		(_FMT_)ts.tv_nsec);
+	if (likely(0 == copy_from_user(&ts, timeout, sizeof(ts))))
+		_lket_trace(_GROUP_AIO, _HOOKID_AIO_IO_GETEVENTS_ENTRY,
+				"%8b%4b%4b%8b%4b%4b", THIS->ctx_id, THIS->min_nr,
+				THIS->nr, THIS->events_uaddr, (_FMT_)ts.tv_sec, 
+				(_FMT_)ts.tv_nsec);
 %}
 
 probe addevent.aio.io_getevents.return
diff --git a/tapset/LKET/nfs.stp b/tapset/LKET/nfs.stp
index 3e4c1e53..7267da74 100755
--- a/tapset/LKET/nfs.stp
+++ b/tapset/LKET/nfs.stp
@@ -1,13 +1,17 @@
 /* Helper functions */
 function __file_fsname:string (file:long) %{ /* pure */
 	struct file *file = (struct file *)(long)THIS->file;
-	if ((file == NULL) 
-		|| (file->f_dentry == NULL) 
-		|| (file->f_dentry->d_inode == NULL))
+	struct dentry *f_dentry = file? kread(&(file->f_dentry)) : NULL;
+	struct inode *d_inode = f_dentry? kread(&(f_dentry->d_inode)) : NULL;
+	if (d_inode == NULL)
 		strlcpy(THIS->__retvalue, "NULL", MAXSTRINGLEN);
 	else {
-		strlcpy(THIS->__retvalue, file->f_dentry->d_inode->i_sb->s_type->name, MAXSTRINGLEN);
+		struct super_block *i_sb = kread(&(d_inode->i_sb));
+		struct file_system_type *s_type = kread(&(i_sb->s_type));
+		const char *name = kread(&(s_type->name));
+		deref_string(THIS->__retvalue, name, MAXSTRINGLEN);
 	}
+	CATCH_DEREF_FAULT();
 %}
 
 probe never
diff --git a/tapset/LKET/nfs_proc.stp b/tapset/LKET/nfs_proc.stp
index 08a08152..418f6c21 100755
--- a/tapset/LKET/nfs_proc.stp
+++ b/tapset/LKET/nfs_proc.stp
@@ -10,6 +10,7 @@
 
 void getdevice(char *sid,int * major,int* min)
 {
+	/* FIXME: deref hazard! */
 	char c;
 	char * minor, *p;
 	int i = 0;
@@ -105,13 +106,15 @@ probe _addevent.nfs.proc.lookup.entry
 function log_proc_lookup(version:long,dir:long,filename:string)
 %{
 	struct inode * dir =  (struct inode * )((long)THIS->dir);
-	struct super_block * sb = dir->i_sb;
+	struct super_block *sb = kread(&(dir->i_sb));
 	int major_device,minor_device;
 
 	getdevice(sb->s_id,&major_device,&minor_device);
 	_lket_trace(_GROUP_NFS,_HOOKID_NFS_PROC_LOOKUP_ENTRY,"%1b%1b%8b%1b%0s",
 		(_FMT_)major_device,(_FMT_)minor_device,
-		NFS_FILEID(dir),THIS->version,THIS->filename);
+		NFS_FILEID(dir) /* FIXME: deref hazard! */,
+		THIS->version,THIS->filename);
+	CATCH_DEREF_FAULT();
 %}
 
 probe addevent.nfs.proc.lookup.return
@@ -141,14 +144,16 @@ probe _addevent.nfs.proc.read.entry
 function log_proc_read(version:long,rdata:long,count:long,offset:long)
 %{
 	struct nfs_read_data* rdata =  (struct nfs_read_data* )((long)THIS->rdata);
-	struct inode *inode = rdata->inode;
-	struct super_block * sb = inode->i_sb;
+	struct inode *inode = kread(&(rdata->inode));
+	struct super_block * sb = kread(&(inode->i_sb));
 	int major_device,minor_device;
 
 	getdevice(sb->s_id,&major_device,&minor_device);
 	_lket_trace(_GROUP_NFS,_HOOKID_NFS_PROC_READ_ENTRY,"%1b%1b%8b%1b%4b%8b",
 		(_FMT_)major_device,(_FMT_)minor_device,
-		NFS_FILEID(inode),THIS->version,THIS->count,THIS->offset);
+		NFS_FILEID(inode) /* FIXME: deref hazard! */,
+		THIS->version,THIS->count,THIS->offset);
+	CATCH_DEREF_FAULT();
 %}
 
 probe addevent.nfs.proc.read.return
@@ -178,14 +183,16 @@ probe _addevent.nfs.proc.write.entry
 function log_proc_write(version:long,wdata:long,count:long,offset:long)
 %{
 	struct nfs_write_data* wdata =  (struct nfs_write_data* )((long)THIS->wdata);
-	struct inode *inode = wdata->inode;
-	struct super_block * sb = inode->i_sb;
+	struct inode *inode = kread(&(wdata->inode));
+	struct super_block * sb = kread(&(inode->i_sb));
 	int major_device,minor_device;
 
 	getdevice(sb->s_id,&major_device,&minor_device);
 	_lket_trace(_GROUP_NFS,_HOOKID_NFS_PROC_WRITE_ENTRY,"%1b%1b%8b%1b%4b%8b",
 		(_FMT_)major_device,(_FMT_)minor_device,
-		NFS_FILEID(inode),THIS->version,THIS->count,THIS->offset);
+		NFS_FILEID(inode) /* FIXME: deref hazard! */,
+		THIS->version,THIS->count,THIS->offset);
+	CATCH_DEREF_FAULT();
 %}
 
 probe addevent.nfs.proc.write.return
@@ -215,15 +222,17 @@ probe _addevent.nfs.proc.commit.entry
 function log_proc_commit(version:long,cdata:long,count:long,offset:long)
 %{
 	struct nfs_write_data* cdata =  (struct nfs_write_data* )((long)THIS->cdata);
-	struct inode *inode = cdata->inode;
-	struct super_block * sb = inode->i_sb;
+	struct inode *inode = kread(&(cdata->inode));
+	struct super_block * sb = kread(&(inode->i_sb));
 	int major_device,minor_device;
 
 	getdevice(sb->s_id,&major_device,&minor_device);
 	
 	_lket_trace(_GROUP_NFS,_HOOKID_NFS_PROC_COMMIT_ENTRY,"%1b%1b%8b%1b%4b%8b",
 		(_FMT_)major_device,(_FMT_)minor_device,
-		NFS_FILEID(inode),THIS->version,THIS->count,THIS->offset);
+		NFS_FILEID(inode) /* FIXME: deref hazard! */,
+		THIS->version,THIS->count,THIS->offset);
+	CATCH_DEREF_FAULT();
 %}
 
 probe addevent.nfs.proc.commit.return
@@ -253,15 +262,17 @@ probe _addevent.nfs.proc.read_setup.entry
 function log_proc_read_setup(version:long,data:long,count:long,offset:long)
 %{
 	struct nfs_read_data* data =  (struct nfs_read_data* )((long)THIS->data);
-	struct inode *inode = data->inode;
-	struct super_block * sb = inode->i_sb;
+	struct inode *inode = kread(&(data->inode));
+	struct super_block * sb = kread(&(inode->i_sb));
 	int major_device,minor_device;
 
 	getdevice(sb->s_id,&major_device,&minor_device);
 	
 	_lket_trace(_GROUP_NFS,_HOOKID_NFS_PROC_READSETUP_ENTRY,"%1b%1b%8b%1b%4b%8b",
 		(_FMT_)major_device,(_FMT_)minor_device,
-		NFS_FILEID(inode),THIS->version,THIS->count,THIS->offset);
+		NFS_FILEID(inode) /* FIXME: deref hazard! */,
+		THIS->version,THIS->count,THIS->offset);
+	CATCH_DEREF_FAULT();
 %}
 
 probe addevent.nfs.proc.write_setup.entry
@@ -279,15 +290,17 @@ probe _addevent.nfs.proc.write_setup.entry
 function log_proc_write_setup(version:long,data:long,count:long,offset:long,how:long)
 %{
 	struct nfs_write_data* data =  (struct nfs_write_data* )((long)THIS->data);
-	struct inode *inode = data->inode;
-	struct super_block * sb = inode->i_sb;
+	struct inode *inode = kread(&(data->inode));
+	struct super_block * sb = kread(&(inode->i_sb));
 	int major_device,minor_device;
 
 	getdevice(sb->s_id,&major_device,&minor_device);
 	
 	_lket_trace(_GROUP_NFS,_HOOKID_NFS_PROC_WRITESETUP_ENTRY,"%1b%1b%8b%1b%1b%4b%8b",
 		(_FMT_)major_device,(_FMT_)minor_device,
-		NFS_FILEID(inode),THIS->version,THIS->how,THIS->count,THIS->offset);
+		NFS_FILEID(inode) /* FIXME: deref hazard! */,
+		THIS->version,THIS->how,THIS->count,THIS->offset);
+	CATCH_DEREF_FAULT();
 %}
 
 
@@ -306,15 +319,17 @@ probe _addevent.nfs.proc.commit_setup.entry
 function log_proc_commit_setup(version:long,data:long,count:long,offset:long)
 %{
 	struct nfs_write_data* data =  (struct nfs_write_data* )((long)THIS->data);
-	struct inode *inode = data->inode;
-	struct super_block * sb = inode->i_sb;
+	struct inode *inode = kread(&(data->inode));
+	struct super_block * sb = kread(&(inode->i_sb));
 	int major_device,minor_device;
 
 	getdevice(sb->s_id,&major_device,&minor_device);
 	
 	_lket_trace(_GROUP_NFS,_HOOKID_NFS_PROC_COMMITSETUP_ENTRY,"%1b%1b%8b%1b%4b%8b",
 		(_FMT_)major_device,(_FMT_)minor_device,
-		NFS_FILEID(inode),THIS->version,THIS->count,THIS->offset);
+		NFS_FILEID(inode) /* FIXME: deref hazard! */,
+		THIS->version,THIS->count,THIS->offset);
+	CATCH_DEREF_FAULT();
 %}
 
 
@@ -337,15 +352,17 @@ probe _addevent.nfs.proc.read_done.entry
 function log_proc_read_done(version:long,data:long,count:long,status:long)
 %{
 	struct nfs_read_data* data =  (struct nfs_read_data* )((long)THIS->data);
-	struct inode *inode = data->inode;
-	struct super_block * sb = inode->i_sb;
+	struct inode *inode = kread(&(data->inode));
+	struct super_block * sb = kread(&(inode->i_sb));
 	int major_device,minor_device;
 
 	getdevice(sb->s_id,&major_device,&minor_device);
 	
 	_lket_trace(_GROUP_NFS,_HOOKID_NFS_PROC_READDONE_ENTRY,"%1b%1b%8b%1b%4b%4b",
 		(_FMT_)major_device,(_FMT_)minor_device,
-		NFS_FILEID(inode),THIS->version,THIS->status,THIS->count);
+		NFS_FILEID(inode) /* FIXME: deref hazard! */,
+		THIS->version,THIS->status,THIS->count);
+	CATCH_DEREF_FAULT();
 %}
 
 probe addevent.nfs.proc.read_done.return
@@ -383,15 +400,17 @@ probe _addevent.nfs.proc.write_done.entry
 function log_proc_write_done(version:long,data:long,count:long,status:long)
 %{
 	struct nfs_write_data* data =  (struct nfs_write_data* )((long)THIS->data);
-	struct inode *inode = data->inode;
-	struct super_block * sb = inode->i_sb;
+	struct inode *inode = kread(&(data->inode));
+	struct super_block * sb = kread(&(inode->i_sb));
 	int major_device,minor_device;
 
 	getdevice(sb->s_id,&major_device,&minor_device);
 	
 	_lket_trace(_GROUP_NFS,_HOOKID_NFS_PROC_WRITEDONE_ENTRY,"%1b%1b%8b%1b%4b%4b",
 		(_FMT_)major_device,(_FMT_)minor_device,
-		NFS_FILEID(inode),THIS->version,THIS->status,THIS->count);
+		NFS_FILEID(inode) /* FIXME: deref hazard! */,
+		THIS->version,THIS->status,THIS->count);
+	CATCH_DEREF_FAULT();
 %}
 
 probe addevent.nfs.proc.write_done.return
@@ -429,15 +448,17 @@ probe _addevent.nfs.proc.commit_done.entry
 function log_proc_commit_done(version:long,data:long,count:long,status:long)
 %{
 	struct nfs_write_data* data =  (struct nfs_write_data* )((long)THIS->data);
-	struct inode *inode = data->inode;
-	struct super_block * sb = inode->i_sb;
+	struct inode *inode = kread(&(data->inode));
+	struct super_block * sb = kread(&(inode->i_sb));
 	int major_device,minor_device;
 
 	getdevice(sb->s_id,&major_device,&minor_device);
 	
 	_lket_trace(_GROUP_NFS,_HOOKID_NFS_PROC_COMMITDONE_ENTRY,"%1b%1b%8b%1b%4b%4b",
 		(_FMT_)major_device,(_FMT_)minor_device,
-		NFS_FILEID(inode),THIS->version,THIS->status,THIS->count);
+		NFS_FILEID(inode) /* FIXME: deref hazard! */,
+		THIS->version,THIS->status,THIS->count);
+	CATCH_DEREF_FAULT();
 %}
 
 probe addevent.nfs.proc.commit_done.return
@@ -472,14 +493,16 @@ function log_proc_open(version:long,inode:long,
                         filename:string,flag:long,mode:long)
 %{
 	struct inode *inode = (struct inode *)((long)THIS->inode);
-	struct super_block * sb = inode->i_sb;
+	struct super_block * sb = kread(&(inode->i_sb));
 	int major_device,minor_device;
 
 	getdevice(sb->s_id,&major_device,&minor_device);
 	
 	_lket_trace(_GROUP_NFS,_HOOKID_NFS_PROC_OPEN_ENTRY,"%1b%1b%8b%1b%0s%4b%4b",
 		(_FMT_)major_device,(_FMT_)minor_device,
-		NFS_FILEID(inode),THIS->version,THIS->filename,THIS->flag,THIS->mode);
+		NFS_FILEID(inode) /* FIXME: deref hazard! */,
+		THIS->version,THIS->filename,THIS->flag,THIS->mode);
+	CATCH_DEREF_FAULT();
 %}
 
 probe addevent.nfs.proc.open.return
@@ -510,14 +533,16 @@ function log_proc_release(version:long,inode:long,
                            filename:string,flag:long,mode:long)
 %{
 	struct inode *inode = (struct inode *)((long)THIS->inode);
-	struct super_block * sb = inode->i_sb;
+	struct super_block * sb = kread(&(inode->i_sb));
 	int major_device,minor_device;
 
 	getdevice(sb->s_id,&major_device,&minor_device);
 	
 	_lket_trace(_GROUP_NFS,_HOOKID_NFS_PROC_RELEASE_ENTRY,"%1b%1b%8b%1b%0s%4b%4b",
 		(_FMT_)major_device,(_FMT_)minor_device,
-		NFS_FILEID(inode),THIS->version,THIS->filename,THIS->flag,THIS->mode);
+		NFS_FILEID(inode) /* FIXME: deref hazard! */,
+		THIS->version,THIS->filename,THIS->flag,THIS->mode);
+	CATCH_DEREF_FAULT();
 %}
 
 probe addevent.nfs.proc.release.return
@@ -547,13 +572,15 @@ probe _addevent.nfs.proc.create.entry
 function log_proc_create(version:long,inode:long,filename:string,mode:long)
 %{
 	struct inode *inode = (struct inode *)((long)THIS->inode);
-       	struct super_block * sb = inode->i_sb;
+	struct super_block * sb = kread(&(inode->i_sb));
 	int major_device,minor_device;
 
 	getdevice(sb->s_id,&major_device,&minor_device);
 	_lket_trace(_GROUP_NFS,_HOOKID_NFS_PROC_CREATE_ENTRY,"%1b%1b%8b%1b%0s%4b",
 		(_FMT_)major_device,(_FMT_)minor_device,
-		NFS_FILEID(inode),THIS->version,THIS->filename,THIS->mode);
+		NFS_FILEID(inode) /* FIXME: deref hazard! */,
+		THIS->version,THIS->filename,THIS->mode);
+	CATCH_DEREF_FAULT();
 %}
 
 probe addevent.nfs.proc.create.return
@@ -584,13 +611,15 @@ function log_proc_remove(version:long,inode:long,
                         filename:string)
 %{
 	struct inode *inode = (struct inode *)((long)THIS->inode);
-       	struct super_block * sb = inode->i_sb;
+	struct super_block * sb = kread(&(inode->i_sb));
 	int major_device,minor_device;
 
 	getdevice(sb->s_id,&major_device,&minor_device);
 	_lket_trace(_GROUP_NFS,_HOOKID_NFS_PROC_REMOVE_ENTRY,"%1b%1b%8b%1b%0s",
 		(_FMT_)major_device,(_FMT_)minor_device,
-		NFS_FILEID(inode),THIS->version,THIS->filename);
+		NFS_FILEID(inode) /* FIXME: deref hazard! */,
+		THIS->version,THIS->filename);
+	CATCH_DEREF_FAULT();
 %}
 
 probe addevent.nfs.proc.remove.return
@@ -622,17 +651,20 @@ function log_proc_rename(version:long,old_dir:long,old_name:string,
 %{
 	struct inode *old_dir= (struct inode *)((long)THIS->old_dir);
 	struct inode *new_dir= (struct inode *)((long)THIS->new_dir);
-       	struct super_block * old_sb = old_dir->i_sb;
-       	struct super_block * new_sb = new_dir->i_sb;
+	struct super_block * old_sb = kread(&(old_dir->i_sb));
+	struct super_block * new_sb = kread(&(new_dir->i_sb));
 	int major_old,minor_old,major_new,minor_new;
 
 	getdevice(old_sb->s_id,&major_old,&minor_old);
 	getdevice(new_sb->s_id,&major_new,&minor_new);
 	
 	_lket_trace(_GROUP_NFS,_HOOKID_NFS_PROC_RENAME_ENTRY,"%1b%1b%1b%8b%0s%1b%1b%8b%0s",
-		THIS->version,(_FMT_)major_old,(_FMT_)minor_old,NFS_FILEID(old_dir),
-		THIS->old_name,(_FMT_)major_new,(_FMT_)minor_new,NFS_FILEID(new_dir),
+		THIS->version,(_FMT_)major_old,(_FMT_)minor_old,
+		NFS_FILEID(old_dir) /* FIXME: deref hazard! */,
+		THIS->old_name,(_FMT_)major_new,(_FMT_)minor_new,
+		NFS_FILEID(new_dir) /* FIXME: deref hazard! */,
 		THIS->new_name);
+	CATCH_DEREF_FAULT();
 %}
 
 probe addevent.nfs.proc.rename.return
diff --git a/tapset/LKET/nfsd.stp b/tapset/LKET/nfsd.stp
index b07063a3..2e42d194 100755
--- a/tapset/LKET/nfsd.stp
+++ b/tapset/LKET/nfsd.stp
@@ -5,6 +5,7 @@
 %{
 	void decode_fh(struct knfsd_fh *fh,__u64 * i_ino)
 	{
+		/* FIXME: deref hazard! */
 		int i;
 		
 		for(i = 0;i < 3;i++)
@@ -117,7 +118,9 @@ function log_nfsd_lookup(fhp:long,filename:string)%{ /*pure*/
 
 	decode_fh(&fhp->fh_handle,i_ino);		
 	_lket_trace(_GROUP_NFSD,_HOOKID_NFSD_LOOKUP_ENTRY,"%1b%8b%8b%8b%0s",
-		(_FMT_)fhp->fh_handle.fh_size,i_ino[0],i_ino[1],i_ino[2],THIS->filename);
+		(_FMT_)kread(&(fhp->fh_handle.fh_size)),
+		i_ino[0],i_ino[1],i_ino[2],THIS->filename);
+	CATCH_DEREF_FAULT();
 %}
 
 probe addevent.nfsd.lookup.return
@@ -153,8 +156,10 @@ function log_nfsd_create(fhp:long,filename:string,type:long,
 
 	decode_fh(&fhp->fh_handle,i_ino);		
 	_lket_trace(_GROUP_NFSD,_HOOKID_NFSD_CREATE_ENTRY,"%1b%8b%8b%8b%0s%4b%2b%4b",
-		(_FMT_)fhp->fh_handle.fh_size,i_ino[0],i_ino[1],i_ino[2],THIS->filename,
+		(_FMT_)kread(&(fhp->fh_handle.fh_size)),
+		i_ino[0],i_ino[1],i_ino[2],THIS->filename,
 		THIS->type,THIS->iap_valid,THIS->iap_mode);
+	CATCH_DEREF_FAULT();
 %}
 
 probe addevent.nfsd.create.return
@@ -191,8 +196,10 @@ function log_nfsd_createv3(fhp:long,filename:string,createmode:long,
 
 	decode_fh(&fhp->fh_handle,i_ino);		
 	_lket_trace(_GROUP_NFSD,_HOOKID_NFSD_CREATEV3_ENTRY,"%1b%8b%8b%8b%0s%1b%2b%4b",
-		(_FMT_)fhp->fh_handle.fh_size,i_ino[0],i_ino[1],i_ino[2],THIS->filename,
+		(_FMT_)kread(&(fhp->fh_handle.fh_size)),
+		i_ino[0],i_ino[1],i_ino[2],THIS->filename,
 		THIS->createmode,THIS->iap_valid,THIS->iap_mode);
+	CATCH_DEREF_FAULT();
 %}
 
 probe addevent.nfsd.createv3.return
@@ -227,8 +234,10 @@ function log_nfsd_unlink(fhp:long,filename:string,type:long)%{ /*pure*/
 
 	decode_fh(&fhp->fh_handle,i_ino);		
 	_lket_trace(_GROUP_NFSD,_HOOKID_NFSD_UNLINK_ENTRY,"%1b%8b%8b%8b%0s%4b",
-		(_FMT_)fhp->fh_handle.fh_size,i_ino[0],i_ino[1],i_ino[2],
+		(_FMT_)kread(&(fhp->fh_handle.fh_size)),
+		i_ino[0],i_ino[1],i_ino[2],
 		THIS->filename,THIS->type);
+	CATCH_DEREF_FAULT();
 %}
 
 probe addevent.nfsd.unlink.return
@@ -264,9 +273,11 @@ function log_nfsd_rename(fhp:long,filename:string,tfhp:long,tname:string)%{ /*pu
 	decode_fh(&fhp->fh_handle,old_ino);		
 	decode_fh(&tfhp->fh_handle,i_ino);		
 	_lket_trace(_GROUP_NFSD,_HOOKID_NFSD_RENAME_ENTRY,"%1b%8b%8b%8b%0s%1b%8b%8b%8b%0s",
-		(_FMT_)fhp->fh_handle.fh_size,old_ino[0],old_ino[1],old_ino[2],
-		THIS->filename, (_FMT_)tfhp->fh_handle.fh_size,i_ino[0],i_ino[1],i_ino[2],
-		THIS->tname);
+		(_FMT_)kread(&(fhp->fh_handle.fh_size)),
+		old_ino[0],old_ino[1],old_ino[2], THIS->filename,
+		(_FMT_)kread(&(tfhp->fh_handle.fh_size)),
+		i_ino[0],i_ino[1],i_ino[2], THIS->tname);
+	CATCH_DEREF_FAULT();
 %}
 
 probe addevent.nfsd.rename.return
@@ -301,8 +312,10 @@ function log_nfsd_open(fhp:long,type:long,access:long)%{ /*pure*/
 
 	decode_fh(&fhp->fh_handle,i_ino);		
 	_lket_trace(_GROUP_NFSD,_HOOKID_NFSD_OPEN_ENTRY,"%1b%8b%8b%8b%4b%1b",
-		(_FMT_)fhp->fh_handle.fh_size,i_ino[0],i_ino[1],i_ino[2],
+		(_FMT_)kread(&(fhp->fh_handle.fh_size)),
+		i_ino[0],i_ino[1],i_ino[2],
 		THIS->type,THIS->access);
+	CATCH_DEREF_FAULT();
 %}
 
 probe addevent.nfsd.open.return
@@ -366,8 +379,10 @@ function log_nfsd_read(fhp:long,count:long,offset:long,
 
 	decode_fh(&fhp->fh_handle,i_ino);		
 	_lket_trace(_GROUP_NFSD,_HOOKID_NFSD_READ_ENTRY,"%1b%8b%8b%8b%8b%8b%8b%8b",
-		(_FMT_)fhp->fh_handle.fh_size,i_ino[0],i_ino[1],i_ino[2],
-		THIS->count,THIS->offset,(_FMT_)vec->iov_len,THIS->vlen);
+		(_FMT_)kread(&(fhp->fh_handle.fh_size)),
+		i_ino[0],i_ino[1],i_ino[2], THIS->count,THIS->offset,
+		(_FMT_)kread(&(vec->iov_len)), THIS->vlen);
+	CATCH_DEREF_FAULT();
 %}
 
 probe addevent.nfsd.read.return
@@ -403,8 +418,10 @@ function log_nfsd_write(fhp:long,count:long,offset:long,
 
 	decode_fh(&fhp->fh_handle,i_ino);		
 	_lket_trace(_GROUP_NFSD,_HOOKID_NFSD_WRITE_ENTRY,"%1b%8b%8b%8b%8b%8b%8b%8b",
-		(_FMT_)fhp->fh_handle.fh_size,i_ino[0],i_ino[1],i_ino[2],
-		THIS->count,THIS->offset,(_FMT_)vec->iov_len,THIS->vlen);
+		(_FMT_)kread(&(fhp->fh_handle.fh_size)),
+		i_ino[0],i_ino[1],i_ino[2], THIS->count,THIS->offset,
+		(_FMT_)kread(&(vec->iov_len)), THIS->vlen);
+	CATCH_DEREF_FAULT();
 %}
 
 probe addevent.nfsd.write.return
@@ -438,8 +455,9 @@ function log_nfsd_commit(fhp:long,count:long,offset:long)%{ /*pure*/
 
 	decode_fh(&fhp->fh_handle,i_ino);		
 	_lket_trace(_GROUP_NFSD,_HOOKID_NFSD_COMMIT_ENTRY,"%1b%8b%8b%8b%8b%8b",
-		(_FMT_)fhp->fh_handle.fh_size,i_ino[0],i_ino[1],i_ino[2],
-		THIS->count,THIS->offset);
+		(_FMT_)kread(&(fhp->fh_handle.fh_size)),
+		i_ino[0],i_ino[1],i_ino[2], THIS->count,THIS->offset);
+	CATCH_DEREF_FAULT();
 %}
 
 probe addevent.nfsd.commit.return
@@ -499,8 +517,9 @@ function log_nfsd_proc_lookup(fh:long,version:long,filename:string)%{ /*pure*/
 
 	decode_fh(&fhp->fh_handle,i_ino);		
 	_lket_trace(_GROUP_NFSD,_HOOKID_NFSD_PROC_LOOKUP_ENTRY,"%1b%8b%8b%8b%1b%0s",
-		(_FMT_)fhp->fh_handle.fh_size,i_ino[0],i_ino[1],i_ino[2],
-		THIS->version,THIS->filename);
+		(_FMT_)kread(&(fhp->fh_handle.fh_size)),
+		i_ino[0],i_ino[1],i_ino[2], THIS->version,THIS->filename);
+	CATCH_DEREF_FAULT();
 %}
 
 probe addevent.nfsd.proc.lookup.return
@@ -536,8 +555,10 @@ function log_nfsd_proc_read(fhp:long,version:long,count:long,offset:long,
 
 	decode_fh(&fhp->fh_handle,i_ino);		
 	_lket_trace(_GROUP_NFSD,_HOOKID_NFSD_PROC_READ_ENTRY,"%1b%8b%8b%8b%1b%8b%8b%8b%8b",
-		(_FMT_)fhp->fh_handle.fh_size,i_ino[0],i_ino[1],i_ino[2],THIS->version,
-		THIS->count,THIS->offset,(_FMT_)vec->iov_len,THIS->vlen);
+		(_FMT_)kread(&(fhp->fh_handle.fh_size)),
+		i_ino[0],i_ino[1],i_ino[2],THIS->version,
+		THIS->count,THIS->offset,(_FMT_)kread(&(vec->iov_len)), THIS->vlen);
+	CATCH_DEREF_FAULT();
 %}
 
 probe addevent.nfsd.proc.read.return
@@ -573,8 +594,10 @@ function log_nfsd_proc_write(fhp:long,version:long,count:long,offset:long,
 
 	decode_fh(&fhp->fh_handle,i_ino);		
 	_lket_trace(_GROUP_NFSD,_HOOKID_NFSD_PROC_WRITE_ENTRY,"%1b%8b%8b%8b%1b%8b%8b%8b%8b",
-		(_FMT_)fhp->fh_handle.fh_size,i_ino[0],i_ino[1],i_ino[2],THIS->version,
-		THIS->count,THIS->offset,(_FMT_)vec->iov_len,THIS->vlen);
+		(_FMT_)kread(&(fhp->fh_handle.fh_size)),
+		i_ino[0],i_ino[1],i_ino[2],THIS->version,
+		THIS->count,THIS->offset,(_FMT_)kread(&(vec->iov_len)), THIS->vlen);
+	CATCH_DEREF_FAULT();
 %}
 
 probe addevent.nfsd.proc.write.return
@@ -608,8 +631,10 @@ function log_nfsd_proc_commit(fhp:long,version:long,count:long,offset:long)%{ /*
 
 	decode_fh(&fhp->fh_handle,i_ino);		
 	_lket_trace(_GROUP_NFSD,_HOOKID_NFSD_PROC_COMMIT_ENTRY,"%1b%8b%8b%8b%1b%8b%8b",
-		(_FMT_)fhp->fh_handle.fh_size,i_ino[0],i_ino[1],i_ino[2],THIS->version,
+		(_FMT_)kread(&(fhp->fh_handle.fh_size)),
+		i_ino[0],i_ino[1],i_ino[2],THIS->version,
 		THIS->count,THIS->offset);
+	CATCH_DEREF_FAULT();
 %}
 
 probe addevent.nfsd.proc.commit.return
@@ -671,8 +696,10 @@ function log_nfsd_proc_remove(fhp:long,version:long,filename:string)%{ /*pure*/
 
 	decode_fh(&fhp->fh_handle,i_ino);		
 	_lket_trace(_GROUP_NFSD,_HOOKID_NFSD_PROC_REMOVE_ENTRY,"%1b%8b%8b%8b%1b%0s",
-		(_FMT_)fhp->fh_handle.fh_size,i_ino[0],i_ino[1],i_ino[2],THIS->version,
+		(_FMT_)kread(&(fhp->fh_handle.fh_size)),
+		i_ino[0],i_ino[1],i_ino[2],THIS->version,
 		THIS->filename);
+	CATCH_DEREF_FAULT();
 %}
 
 probe addevent.nfsd.proc.remove.return
@@ -708,9 +735,11 @@ function log_nfsd_proc_rename(fhp:long,version:long,filename:string,
 	decode_fh(&fhp->fh_handle,o_ino);	
 	decode_fh(&tfhp->fh_handle,i_ino);	
 	_lket_trace(_GROUP_NFSD,_HOOKID_NFSD_PROC_RENAME_ENTRY,"%1b%1b%8b%8b%8b%0s%1b%8b%8b%8b%0s",
-		THIS->version,(_FMT_)fhp->fh_handle.fh_size,o_ino[0],o_ino[1],o_ino[2],
-		THIS->filename, (_FMT_)tfhp->fh_handle.fh_size,i_ino[0],i_ino[1],i_ino[2],
-		THIS->tname);
+		THIS->version,(_FMT_)kread(&(fhp->fh_handle.fh_size)),
+		o_ino[0],o_ino[1],o_ino[2], THIS->filename,
+		(_FMT_)kread(&(tfhp->fh_handle.fh_size)),
+		i_ino[0],i_ino[1],i_ino[2], THIS->tname);
+	CATCH_DEREF_FAULT();
 %}
 
 probe addevent.nfsd.proc.rename.return
@@ -744,8 +773,10 @@ function log_nfsd_proc_create(fhp:long,version:long,filename:string)%{ /*pure*/
 
 	decode_fh(&fhp->fh_handle,i_ino);		
 	_lket_trace(_GROUP_NFSD,_HOOKID_NFSD_PROC_CREATE_ENTRY,"%1b%8b%8b%8b%1b%0s",
-		(_FMT_)fhp->fh_handle.fh_size,i_ino[0],i_ino[1],i_ino[2],
+		(_FMT_)kread(&(fhp->fh_handle.fh_size)),
+		i_ino[0],i_ino[1],i_ino[2],
 		THIS->version,THIS->filename);
+	CATCH_DEREF_FAULT();
 %}
 
 probe addevent.nfsd.proc.create.return
diff --git a/tapset/LKET/process.stp b/tapset/LKET/process.stp
index fb02614b..41f6d3f1 100755
--- a/tapset/LKET/process.stp
+++ b/tapset/LKET/process.stp
@@ -14,7 +14,8 @@ function log_execve_tracedata(var:long)
 	long tmp=(long)THIS->var;
 	_lket_trace(_GROUP_PROCESS, _HOOKID_PROCESS_EXECVE, "%4b%4b%4b%0s", 
 		(_FMT_)current->pid, (_FMT_)current->tgid, 
-		(_FMT_)current->parent->tgid, (char *)tmp); 
+		(_FMT_)current->parent->tgid,
+		(char *)tmp /* FIXME: deref hazard! */); 
 %}
 
 
@@ -26,8 +27,12 @@ function log_fork_tracedata(task:long)
 	_lket_trace(_GROUP_PROCESS, THIS->var_id, "%4b", (_FMT_)pid); 
 	*/
 	struct task_struct *task = (struct task_struct *)((long)THIS->task);
-	_lket_trace(_GROUP_PROCESS, _HOOKID_PROCESS_FORK, "%4b%4b%4b", (_FMT_)task->pid, 
-		(_FMT_)task->tgid, (_FMT_)task->parent->tgid); 
+	struct task_struct *parent = kread(&(task->parent));
+	_lket_trace(_GROUP_PROCESS, _HOOKID_PROCESS_FORK, "%4b%4b%4b",
+		(_FMT_)kread(&(task->pid)),
+		(_FMT_)kread(&(task->tgid)),
+		(_FMT_)kread(&(parent->tgid))); 
+	CATCH_DEREF_FAULT();
 %}
 
 
@@ -47,6 +52,7 @@ function process_snapshot()
 
 	/* iterate all the processes, and record the pid and process
 	name for each entry */
+	/* FIXME: need some sort of lock before doing this! */
 	for_each_process(tsk)  {
 		_lket_trace(_GROUP_PROCESS, _HOOKID_PROCESS_SNAPSHOT, "%4b%4b%4b%0s", 
 			(_FMT_)tsk->pid, (_FMT_)tsk->tgid, (_FMT_)tsk->parent->tgid, tsk->comm);
diff --git a/tapset/LKET/timestamp.stp b/tapset/LKET/timestamp.stp
index 471177a9..b450bd67 100755
--- a/tapset/LKET/timestamp.stp
+++ b/tapset/LKET/timestamp.stp
@@ -37,12 +37,11 @@ function set_timing_method(method:long)
 %{
 	if(THIS->method == TIMING_SCHEDCLOCK) {
 		pfn_schedclock = (pfn_schedclock_type)kallsyms_lookup_name("sched_clock");
-		if(!pfn_schedclock) {
+		if(!pfn_schedclock)
 			_stp_warn("Failed to lookup specified timing method sched_clock()\n");
-			return;
-		}
-	}
-	if(THIS->method > 0 && THIS->method <= MAX_TIMING_METHOD)
+		else
+			timing_method = THIS->method;
+	} else if(THIS->method > 0 && THIS->method <= MAX_TIMING_METHOD)
 		timing_method = THIS->method;
 %}
 
diff --git a/tapset/LKET/tskdispatch.stp b/tapset/LKET/tskdispatch.stp
index eeca9f06..05103f96 100755
--- a/tapset/LKET/tskdispatch.stp
+++ b/tapset/LKET/tskdispatch.stp
@@ -63,8 +63,11 @@ function log_ctxswitch_tracedata(var_id:long, prev:long, next_pid:long)
 	prev_tsk = (struct task_struct *)((long)THIS->prev);
 	next_tsk = (struct task_struct *)((long)THIS->next_pid);
 
-	_lket_trace(_GROUP_TASK, THIS->var_id, "%4b%4b%1b", (_FMT_)prev_tsk->pid, 
-		(_FMT_)next_tsk->pid, (_FMT_)prev_tsk->state); 
+	_lket_trace(_GROUP_TASK, THIS->var_id, "%4b%4b%1b",
+		(_FMT_)kread(&(prev_tsk->pid)),
+		(_FMT_)kread(&(next_tsk->pid)),
+		(_FMT_)kread(&(prev_tsk->state))); 
+	CATCH_DEREF_FAULT();
 %}
 
 function log_cpuidle_tracedata(var_id:long)
diff --git a/tapset/LKET/utils.stp b/tapset/LKET/utils.stp
index 5bff6a9f..8edab81e 100755
--- a/tapset/LKET/utils.stp
+++ b/tapset/LKET/utils.stp
@@ -23,13 +23,10 @@ function filter_by_pid:long()
 		 */ 
 		if( _stp_target != 0 && cur->tgid != _stp_target) {
 			THIS->__retvalue = 0;
-			return;
-		}
-
-		THIS->__retvalue = 1;
+		} else
+			THIS->__retvalue = 1;
 	} else  /*skip the events generated by stap itself*/
 		THIS->__retvalue = 0;
-	return;
 %}
 
 function reset_maxaction()
diff --git a/tapset/aux_syscalls.stp b/tapset/aux_syscalls.stp
index 4d578fd5..b9ff9776 100644
--- a/tapset/aux_syscalls.stp
+++ b/tapset/aux_syscalls.stp
@@ -34,15 +34,13 @@ function _struct_compat_timeval_u:string(uaddr:long)
 
 function _struct_timeval:string(addr:long)
 %{ /* pure */
-	struct timeval *tv;
-	char *ptr = (char *)(unsigned long)THIS->addr;
+	struct timeval *tv = (struct timeval *)(unsigned long)THIS->addr;
 
-	if (ptr == NULL)
+	if (tv == NULL)
 		strlcpy (THIS->__retvalue, "NULL", MAXSTRINGLEN);
-	else {
-		tv=(struct timeval *) ptr;
-		snprintf(THIS->__retvalue, MAXSTRINGLEN, "[%ld.%06ld]", tv->tv_sec, tv->tv_usec);
-	}
+	else
+		snprintf(THIS->__retvalue, MAXSTRINGLEN, "[%ld.%06ld]",
+				kread(&(tv->tv_sec)), kread(&(tv->tv_usec)));
 %}
 
 function _struct_timezone_u:string(uaddr:long)
@@ -166,15 +164,14 @@ function _struct_compat_timespec_u:string(uaddr:long)
 
 function _struct_timespec:string(addr:long)
 %{ /* pure */
-	struct timespec *ts;
-	char *ptr = (char *)(unsigned long)THIS->addr;
+	struct timespec *ts = (struct timespec *)(unsigned long)THIS->addr;
 
-	if (ptr == NULL)
+	if (ts == NULL)
 		strlcpy (THIS->__retvalue, "NULL", MAXSTRINGLEN);
 	else {
-		ts =  (struct timespec *) ptr;
 		snprintf(THIS->__retvalue, MAXSTRINGLEN, "[%ld.%09ld]", 
-			(unsigned long)ts->tv_sec, (unsigned long)ts->tv_nsec);
+			(unsigned long)kread(&(ts->tv_sec)),
+			(unsigned long)kread(&(ts->tv_nsec)));
 	}
 %}
 
@@ -231,16 +228,16 @@ function _struct_compat_itimerval_u:string(uaddr:long)
 
 function _struct_itimerval:string(addr:long)
 %{ /* pure */
-	struct itimerval *itv;
-	char *ptr = (char *)(unsigned long)THIS->addr;
+	struct itimerval *itv = (char *)(unsigned long)THIS->addr;
 
-	if (ptr == NULL)
+	if (itv == NULL)
 		strlcpy (THIS->__retvalue, "NULL", MAXSTRINGLEN);
 	else {
-		itv = (struct itimerval *) ptr;
 		snprintf(THIS->__retvalue, MAXSTRINGLEN, "[%d.%06d,%d.%06d]", 
-			(int)itv->it_interval.tv_sec, (int)itv->it_interval.tv_usec,
-			(int)itv->it_value.tv_sec, (int)itv->it_value.tv_usec);
+			(int)kread(&(itv->it_interval.tv_sec)),
+			(int)kread(&(itv->it_interval.tv_usec)),
+			(int)kread(&(itv->it_value.tv_sec)),
+			(int)kread(&(itv->it_value.tv_usec)));
 	}
 %}
 
@@ -637,16 +634,6 @@ function __get_argv:string(a:long)
 %}
 
 /*
-* This function is used when a long is really a pointer and we need
-* the string it points to. Should be rarely necessary.
-*/
-function __string:string (a:long)
-%{ /* pure */
-	char *str =(char *)(long)THIS->a;
-	strlcpy(THIS->__retvalue, str, MAXSTRINGLEN);
-%}
-
-/*
  * Return a integer member value of struct
  * timezone user  space pointer  parameter
  * CALLERS:
@@ -683,8 +670,7 @@ function __uget_timex_m:long(u_addr:long,member:long)
 
    if(copy_from_user(&tx,ptr,sz)) {
       THIS->__retvalue = -EFAULT;
-      return;
-   }
+   } else
    switch(THIS->member) {
       case 0:  THIS->__retvalue =  tx.modes;
                break;
diff --git a/tapset/errno.stp b/tapset/errno.stp
index 74634e28..061947b9 100644
--- a/tapset/errno.stp
+++ b/tapset/errno.stp
@@ -357,31 +357,33 @@ function returnstr:string (returnp:long) %{ /* pure */
 
 	/* XXX: unfortunate duplication with return.stp:retval() */
 
-        if (CONTEXT->regs) {
+	if (CONTEXT->regs) {
 #if defined (__i386__)
-                ret = CONTEXT->regs->eax;
+		ret = CONTEXT->regs->eax;
 #elif defined (__x86_64__)
-                ret = CONTEXT->regs->rax;
+		ret = CONTEXT->regs->rax;
 #elif defined (__powerpc64__)
-                ret = CONTEXT->regs->gpr[3];
+		ret = CONTEXT->regs->gpr[3];
 #elif defined (__ia64__)
-                ret = CONTEXT->regs->r8;
+		ret = CONTEXT->regs->r8;
 #elif defined (__sparc64__)
-                ret = CONTEXT->regs->u_regs[UREG_RETPC];
+		ret = CONTEXT->regs->u_regs[UREG_RETPC];
 #elif defined (__s390x__)
 		ret = CONTEXT->regs->gprs[2];
 #else
-                return;
-#endif
-        } else
-                return;
-	
-	if (ret < 0 && ret > -Maxerrno && errlist[-ret])
-		snprintf (THIS->__retvalue, MAXSTRINGLEN, "%ld (%s)", ret, errlist[-ret]);
-	else if (THIS->returnp == 2)
-		snprintf (THIS->__retvalue, MAXSTRINGLEN, "0x%lx", ret);
-	else if (THIS->returnp == 3)
-		snprintf (THIS->__retvalue, MAXSTRINGLEN, "%#lo", ret);
-	else 	
-		snprintf (THIS->__retvalue, MAXSTRINGLEN, "%ld", ret);
+		goto no_ret;
+#endif
+
+		if (ret < 0 && ret > -Maxerrno && errlist[-ret])
+			snprintf (THIS->__retvalue, MAXSTRINGLEN, "%ld (%s)", ret, errlist[-ret]);
+		else if (THIS->returnp == 2)
+			snprintf (THIS->__retvalue, MAXSTRINGLEN, "0x%lx", ret);
+		else if (THIS->returnp == 3)
+			snprintf (THIS->__retvalue, MAXSTRINGLEN, "%#lo", ret);
+		else 	
+			snprintf (THIS->__retvalue, MAXSTRINGLEN, "%ld", ret);
+	} else {
+no_ret:
+		strlcpy(THIS->__retvalue, "N/A", MAXSTRINGLEN);
+	}
 %}
diff --git a/tapset/inet_sock.stp b/tapset/inet_sock.stp
index 995bdcfb..b3daeb68 100644
--- a/tapset/inet_sock.stp
+++ b/tapset/inet_sock.stp
@@ -25,23 +25,18 @@
 // Get local port number
 function inet_get_local_port:long(sock:long)
 %{
-	unsigned long ptr = (unsigned long) THIS->sock;
-	struct inet_sock *inet = (struct inet_sock *) ptr;
-        THIS->__retvalue = deref(sizeof(LPORT), &(LPORT));
-        if (0) {
-deref_fault:
-            CONTEXT->last_error = "pointer dereference fault";
-        }
+	struct inet_sock *inet = (struct inet_sock *) (long) THIS->sock;
+	THIS->__retvalue = kread(&(LPORT));
+	CATCH_DEREF_FAULT();
 %}
 
 // Get IP source address string
 function inet_get_ip_source:string(sock:long)
 %{
-	unsigned long ptr = (unsigned long) THIS->sock;
-	struct inet_sock *inet = (struct inet_sock *) ptr;
-	unsigned char addr[4];
-
-	memcpy(addr, DADDR, sizeof(addr));
+	struct inet_sock *inet = (struct inet_sock *) (long) THIS->sock;
+	union { __u32 d; unsigned char addr[4]; } u;
+	u.d = kread(DADDR);
 	sprintf(THIS->__retvalue, "%d.%d.%d.%d",
-           addr[0], addr[1],  addr[2], addr[3]);
+			u.addr[0], u.addr[1], u.addr[2], u.addr[3]);
+	CATCH_DEREF_FAULT();
 %}
diff --git a/tapset/ioblock.stp b/tapset/ioblock.stp
index a9be060b..761818fc 100644
--- a/tapset/ioblock.stp
+++ b/tapset/ioblock.stp
@@ -15,102 +15,56 @@
 /* get i-node number of mapped file */
 function __bio_ino:long(bio:long)
 %{
-        struct bio  *bio;
-        struct page *bv_page;
-        struct address_space *mapping;
-        struct inode *host;
-
-	bio = (struct bio *)(long)THIS->bio;
-        bv_page = (struct page*)deref(sizeof(bio->bi_io_vec[0].bv_page),
-        	&(bio->bi_io_vec[0].bv_page));
-        if (bv_page == NULL) {
-        	THIS->__retvalue = -1;
-        	goto end;
-        }
-        mapping = (struct address_space*)deref(sizeof(bv_page->mapping),
-        	&(bv_page->mapping));
-        if (mapping == NULL) {
-        	THIS->__retvalue = -1;
-        	goto end;
-        }
-        host = (struct inode*)deref(sizeof(mapping->host),
-        	&(mapping->host));
-        if (host == NULL) {
-        	THIS->__retvalue = -1;
-        	goto end;
-        }
-        THIS->__retvalue = deref(sizeof(host->i_ino), &(host->i_ino));
-
-        if (0) {
-deref_fault:
-        	CONTEXT->last_error = "pointer dereference fault";
-        }
-end: ;
+    struct bio *bio = (struct bio *)(long)THIS->bio;
+    struct page *bv_page = bio? kread(&(bio->bi_io_vec[0].bv_page)) : NULL;
+    struct address_space *mapping = bv_page? kread(&(bv_page->mapping)) : NULL;
+    struct inode *host = mapping? kread(&(mapping->host)) : NULL;
+    if (host == NULL)
+        THIS->__retvalue = -1;
+    else
+        THIS->__retvalue = kread(&(host->i_ino));
+    CATCH_DEREF_FAULT();
 %}
 
 /* returns 0 for read, 1 for write */
 function bio_rw_num:long(rw:long)
 %{
-        long rw = (long)THIS->rw;
-        THIS->__retvalue = (rw & (1 << BIO_RW));
+    long rw = (long)THIS->rw;
+    THIS->__retvalue = (rw & (1 << BIO_RW));
 %}
 
 /* returns R for read, W for write */
 function bio_rw_str(rw)
 {
-        return bio_rw_num(rw) == BIO_READ ? "R" : "W"
+    return bio_rw_num(rw) == BIO_READ ? "R" : "W"
 }
 
 /* returns start sector */
 function __bio_start_sect:long(bio:long)
 %{ 
-	struct bio *bio;
-        struct block_device *bi_bdev;
-        struct hd_struct *bd_part;
-
-	bio = (struct bio *)(long)THIS->bio;
-        bi_bdev = (struct block_device *)deref(sizeof(bio->bi_bdev), 
-		&(bio->bi_bdev));
-        if (bi_bdev == NULL) {
-        	THIS->__retvalue = -1;
-		goto end;
-        } 
-        bd_part = (struct hd_struct *)deref(sizeof(bi_bdev->bd_part),
-		 &(bi_bdev->bd_part));
-        if (bd_part == NULL) {
-        	THIS->__retvalue = -1;
-		goto end;
-        }
-
-       /*
-          There is a bug in deref() that prevents the code below. 
-          THIS->__retvalue = deref(sizeof(bd_part->start_sect), 
-		&(bd_part->start_sect));
-       */
-
-       THIS->__retvalue = bd_part->start_sect;
-
-       if (0) {
-deref_fault:
-       		CONTEXT->last_error = "pointer dereference fault";
-       } 
-end: ;
+    struct bio *bio = (struct bio *)(long)THIS->bio;
+    struct block_device *bi_bdev = bio? kread(&(bio->bi_bdev)) : NULL;
+    struct hd_struct *bd_part = bi_bdev? kread(&(bi_bdev->bd_part)) : NULL;
+    if (bd_part == NULL)
+        THIS->__retvalue = -1;
+    else
+        THIS->__retvalue = kread(&(bd_part->start_sect));
+    CATCH_DEREF_FAULT();
 %}
 
 /* returns the block device name */
 function __bio_devname:string(bio:long)
 %{
-        char b[BDEVNAME_SIZE];
-        struct bio *bio = (struct bio *)(long)THIS->bio;
-        if (bio == NULL || bio->bi_bdev == NULL) {
-                strlcpy(THIS->__retvalue, "N/A", MAXSTRINGLEN);
-                return;
-        }
-        deref_string(THIS->__retvalue, bdevname(bio->bi_bdev,b), MAXSTRINGLEN);
-        if (0) {
-deref_fault:
-                CONTEXT->last_error = "pointer dereference fault";
-        }
+    char b[BDEVNAME_SIZE];
+    struct bio *bio = (struct bio *)(long)THIS->bio;
+    struct block_device *bdev = kread(&(bio->bi_bdev));
+	if (bdev == NULL) {
+		strlcpy(THIS->__retvalue, "N/A", MAXSTRINGLEN);
+	} else {
+		const char *name = bdevname(bdev, b); /* FIXME: deref hazard! */
+		deref_string(THIS->__retvalue, name, MAXSTRINGLEN);
+	}
+	CATCH_DEREF_FAULT();
 %}
 
 global BIO_READ, BIO_WRITE
diff --git a/tapset/ioscheduler.stp b/tapset/ioscheduler.stp
index ba732b65..49be6217 100644
--- a/tapset/ioscheduler.stp
+++ b/tapset/ioscheduler.stp
@@ -109,30 +109,30 @@ probe ioscheduler.elv_completed_request
 
 function disk_major_from_request:long(var_q:long)
 %{ /* pure */
-	struct request_queue *q;
-	struct request *rq;
+	struct request_queue *q = (struct request_queue *)((long)THIS->var_q);
+	struct list_head *queue_head = &(q->queue_head);
 
-	q = (struct request_queue *)((long)THIS->var_q);
-
-	if(list_empty(&(q->queue_head)))
+	if (list_empty(&(q->queue_head))) /* FIXME: deref hazard! */
 		THIS->__retvalue = -1;
 	else  {
-		rq = list_entry_rq(q->queue_head.next);
-		THIS->__retvalue =  rq->rq_disk->first_minor;
+		struct request *rq = list_entry_rq(q->queue_head.next); /* FIXME: deref hazard! */
+		struct gendisk *rq_disk = kread(&(rq->rq_disk));
+		THIS->__retvalue = kread(&(rq_disk->major));
 	}
+	CATCH_DEREF_FAULT();
 %}
 
 function disk_minor_from_request:long(var_q:long)
 %{ /* pure */
-	struct request_queue *q;
-	struct request *rq;
-
-	q = (struct request_queue *)((long)THIS->var_q);
+	struct request_queue *q = (struct request_queue *)((long)THIS->var_q);
+	struct list_head *queue_head = &(q->queue_head);
 
-	if(list_empty(&(q->queue_head)))
+	if (list_empty(&(q->queue_head))) /* FIXME: deref hazard! */
 		THIS->__retvalue = -1;
 	else  {
-		rq = list_entry_rq(q->queue_head.next);
-		THIS->__retvalue =  rq->rq_disk->first_minor;
+		struct request *rq = list_entry_rq(q->queue_head.next); /* FIXME: deref hazard! */
+		struct gendisk *rq_disk = kread(&(rq->rq_disk));
+		THIS->__retvalue = kread(&(rq_disk->first_minor));
 	}
+	CATCH_DEREF_FAULT();
 %}
diff --git a/tapset/nfs.stp b/tapset/nfs.stp
index 39040c68..083688ca 100644
--- a/tapset/nfs.stp
+++ b/tapset/nfs.stp
@@ -2,282 +2,245 @@
 #include <linux/kernel.h>
 #include <linux/nfs_fs.h>
 %}
-/*Get struct nfs_inode from struct inode*/
-%{ 
-  struct nfs_inode * __nfs_i (struct inode *inode)
-  {
-    struct nfs_inode * nfsi = NFS_I(inode);
-
-    return (nfsi);
-  }
-%}
 
 /*Get cache_validity flag from struct inode*/
 function __nfsi_cache_valid:long(inode:long) %{ /* pure */
-    struct inode * inode = (struct inode *)(THIS->inode);
-    struct nfs_inode * nfsi;
+    struct inode * inode = (struct inode *)(long)(THIS->inode);
 
     if(inode == NULL) 
-    {
         THIS->__retvalue = -1;
-        return;
+    else {
+        struct nfs_inode * nfsi = NFS_I(inode);
+        THIS->__retvalue = kread(&(nfsi->cache_validity));
     }
-    nfsi = __nfs_i(inode);
-    THIS->__retvalue = nfsi->cache_validity;
+    CATCH_DEREF_FAULT();
 %}
 
 /*Get read_cache_jiffies from struct inode*/
 function __nfsi_rcache_time :long (inode:long) %{ /* pure */
-    struct inode * inode = (struct inode *)(THIS->inode);
-    struct nfs_inode * nfsi ;
+    struct inode * inode = (struct inode *)(long)(THIS->inode);
 
     if(inode == NULL) 
-    {
         THIS->__retvalue = -1;
-        return;
+    else {
+        struct nfs_inode * nfsi = NFS_I(inode);
+        THIS->__retvalue = kread(&(nfsi->read_cache_jiffies));
     }
-
-    nfsi = (struct nfs_inode *) __nfs_i(inode);
-
-    THIS->__retvalue = nfsi->read_cache_jiffies;
+    CATCH_DEREF_FAULT();
 %}
 
 /*Get attrtimeo from struct inode*/
 function __nfsi_attr_time :long (inode:long) %{ /* pure */
-    struct inode * inode = (struct inode *)(THIS->inode);
-    struct nfs_inode * nfsi ;
+    struct inode * inode = (struct inode *)(long)(THIS->inode);
 
     if(inode == NULL) 
-    {
         THIS->__retvalue = -1;
-        return;
+    else {
+        struct nfs_inode * nfsi = NFS_I(inode);
+        THIS->__retvalue = kread(&(nfsi->attrtimeo));
     }
-    nfsi= (struct nfs_inode *) __nfs_i(inode);
-
-    THIS->__retvalue = nfsi->attrtimeo;
+    CATCH_DEREF_FAULT();
 %}
 
 /*Get ndirty from struct inode*/
 function __nfsi_ndirty:long (inode:long) %{ /* pure */
-      struct inode *inode = (struct inode *)((long)THIS->inode);
-      struct nfs_inode *nfsi ;
-
-      if(inode == NULL) 
-      {
-          THIS->__retvalue = -1;
-          return;
-      }
-      nfsi = NFS_I(inode);
- 
-      THIS->__retvalue = nfsi->ndirty;
+    struct inode * inode = (struct inode *)(long)(THIS->inode);
+
+    if(inode == NULL) 
+        THIS->__retvalue = -1;
+    else {
+        struct nfs_inode * nfsi = NFS_I(inode);
+        THIS->__retvalue = kread(&(nfsi->ndirty));
+    }
+    CATCH_DEREF_FAULT();
 %}
 
 /*Get rsize from struct inode*/
 function __nfs_server_rsize:long (inode:long) %{ /* pure */
-       struct inode * inode = (struct inode *)((long)THIS->inode);
-
-       if(inode == NULL) 
-       {
-           THIS->__retvalue = -1;
-           return;
-       }
-       THIS->__retvalue = NFS_SERVER(inode)->rsize;
+    struct inode * inode = (struct inode *)(long)(THIS->inode);
+
+    if(inode == NULL) 
+        THIS->__retvalue = -1;
+    else {
+        struct nfs_server * nfs_srv = NFS_SERVER(inode); /* FIXME: deref hazard! */
+        THIS->__retvalue = kread(&(nfs_srv->rsize));
+    }
+    CATCH_DEREF_FAULT();
 %}
 
 /*Get version from struct inode*/
 function __nfs_version:long (inode:long) %{ /* pure */
-       struct inode * inode = (struct inode *)((long)THIS->inode);
-
-       if(inode == NULL) 
-       {
-           THIS->__retvalue = -1;
-           return;
-       }
-       THIS->__retvalue = NFS_PROTO(inode)->version;
+    struct inode * inode = (struct inode *)(long)(THIS->inode);
+
+    if(inode == NULL) 
+        THIS->__retvalue = -1;
+    else {
+        const struct nfs_rpc_ops *rpc_ops = NFS_PROTO(inode); /* FIXME: deref hazard! */
+        THIS->__retvalue = kread(&(rpc_ops->version));
+    }
+    CATCH_DEREF_FAULT();
 %}
 
 /*Get wsize from struct inode*/
 function __nfs_server_wsize:long (inode:long) %{ /* pure */
-       struct inode * inode = (struct inode *)((long)THIS->inode);
-
-       if(inode == NULL) 
-       {
-           THIS->__retvalue = -1;
-           return;
-       }
-       THIS->__retvalue = NFS_SERVER(inode)->wsize;
+    struct inode * inode = (struct inode *)(long)(THIS->inode);
+
+    if(inode == NULL) 
+        THIS->__retvalue = -1;
+    else {
+        struct nfs_server * nfs_srv = NFS_SERVER(inode); /* FIXME: deref hazard! */
+        THIS->__retvalue = kread(&(nfs_srv->wsize));
+    }
+    CATCH_DEREF_FAULT();
 %}
 
 /*Get rpages from struct inode*/
 function __nfs_rpages:long (inode:long) %{ /* pure */
-       struct inode * inode = (struct inode *)((long)THIS->inode);
-
-       if(inode == NULL) 
-       {
-           THIS->__retvalue = -1;
-           return;
-       }
-       THIS->__retvalue = NFS_SERVER(inode)->rpages;
+    struct inode * inode = (struct inode *)(long)(THIS->inode);
+
+    if(inode == NULL) 
+        THIS->__retvalue = -1;
+    else {
+        struct nfs_server * nfs_srv = NFS_SERVER(inode); /* FIXME: deref hazard! */
+        THIS->__retvalue = kread(&(nfs_srv->rpages));
+    }
+    CATCH_DEREF_FAULT();
 %}
 
 /*Get wpages from struct inode*/
 function __nfs_wpages:long(inode:long) %{ /* pure */
-      struct inode *inode = (struct inode*)((long)THIS->inode);
-      if(inode == NULL) 
-      {
-          THIS->__retvalue = -1;
-          return;
-      }
-      THIS->__retvalue = NFS_SERVER(inode)->wpages;
+    struct inode * inode = (struct inode *)(long)(THIS->inode);
+
+    if(inode == NULL) 
+        THIS->__retvalue = -1;
+    else {
+        struct nfs_server * nfs_srv = NFS_SERVER(inode); /* FIXME: deref hazard! */
+        THIS->__retvalue = kread(&(nfs_srv->wpages));
+    }
+    CATCH_DEREF_FAULT();
 %}
 
 /*Get struct inode from struct page*/
 function __p2i :long(page:long) %{ /* pure */
-      struct page *page = (struct page *)((long)THIS->page);
-
-      if ((page == NULL) || (page->mapping == NULL)) {
-                THIS->__retvalue = 0;
-                return;
-        }
-
-        THIS->__retvalue = deref(sizeof(page->mapping->host),
-                &(page->mapping->host));
-        if (0) {
-deref_fault:
-                CONTEXT->last_error = "pointer dereference fault";
-        }
+    struct page *page = (struct page *)((long)THIS->page);
+    struct address_space *mapping = page? kread(&(page->mapping)) : NULL;
+
+    if (mapping == NULL)
+        THIS->__retvalue = 0;
+    else
+        THIS->__retvalue = (long)kread(&(mapping->host));
+    CATCH_DEREF_FAULT();
 %}
 
 /*Get i_flags from struct page*/
 function __p2i_flag : long (page:long) %{ /* pure */
-      struct page *page = (struct page *) (THIS->page);
-
-      if ((page == NULL) || (page->mapping == NULL) \
-          ||(page->mapping->host == NULL)) {
-                THIS->__retvalue = -1;
-                return;
-        }
+    struct page *page = (struct page *)((long)THIS->page);
+    struct address_space *mapping = page? kread(&(page->mapping)) : NULL;
+    struct inode *host = mapping? kread(&(mapping->host)) : NULL;
 
-        THIS->__retvalue = deref(sizeof(page->mapping->host->i_flags),
-                &(page->mapping->host->i_flags));
-        if (0) {
-deref_fault:
-                CONTEXT->last_error = "pointer dereference fault";
-        }
+    if (host == NULL)
+        THIS->__retvalue = -1;
+    else
+        THIS->__retvalue = kread(&(host->i_flags));
+    CATCH_DEREF_FAULT();
 %}
 
 /*Get i_state from struct page*/
 function __p2i_state :long (page:long) %{ /* pure */
-      struct page *page = (struct page *) (THIS->page);
-      
-      if ((page == NULL) || (page->mapping == NULL) \
-          ||(page->mapping->host == NULL)) {
-                THIS->__retvalue = -1;
-                return;
-        }
+    struct page *page = (struct page *)((long)THIS->page);
+    struct address_space *mapping = page? kread(&(page->mapping)) : NULL;
+    struct inode *host = mapping? kread(&(mapping->host)) : NULL;
 
-        THIS->__retvalue = deref(sizeof(page->mapping->host->i_state),
-                &(page->mapping->host->i_state));
-        if (0) {
-deref_fault:
-                CONTEXT->last_error = "pointer dereference fault";
-        }
+    if (host == NULL)
+        THIS->__retvalue = -1;
+    else
+        THIS->__retvalue = kread(&(host->i_state));
+    CATCH_DEREF_FAULT();
 %}
 
 /*Get i_size from struct page*/
 function __p2i_size :long (page:long) %{ /* pure */
-      struct page *page = (struct page *) (THIS->page);
-
-      if ((page == NULL) || (page->mapping == NULL) \
-          ||(page->mapping->host == NULL)) {
-                THIS->__retvalue = -1;
-                return;
-        }
+    struct page *page = (struct page *)((long)THIS->page);
+    struct address_space *mapping = page? kread(&(page->mapping)) : NULL;
+    struct inode *host = mapping? kread(&(mapping->host)) : NULL;
 
-        THIS->__retvalue = deref(sizeof(page->mapping->host->i_size),
-                &(page->mapping->host->i_size));
-        if (0) {
-deref_fault:
-                CONTEXT->last_error = "pointer dereference fault";
-        }
+    if (host == NULL)
+        THIS->__retvalue = -1;
+    else
+        THIS->__retvalue = kread(&(host->i_size));
+    CATCH_DEREF_FAULT();
 %}
 
 /*Get s_flags from struct page*/
 function __p2sb_flag:long (page:long) %{ /* pure */
-      struct page *page = (struct page *)(THIS->page);
-      
-      if ((page == NULL) || (page->mapping == NULL) \
-          ||(page->mapping->host == NULL)) {
-                THIS->__retvalue = -1;
-                return;
-        }
+    struct page *page = (struct page *)((long)THIS->page);
+    struct address_space *mapping = page? kread(&(page->mapping)) : NULL;
+    struct inode *host = mapping? kread(&(mapping->host)) : NULL;
+	struct super_block *i_sb = host? kread(&(host->i_sb)) : NULL;
 
-        THIS->__retvalue = deref(sizeof(page->mapping->host->i_flags),
-                &(page->mapping->host->i_flags));
-        if (0) {
-deref_fault:
-                CONTEXT->last_error = "pointer dereference fault";
-        }
+    if (i_sb == NULL)
+        THIS->__retvalue = -1;
+    else
+        THIS->__retvalue = kread(&(i_sb->s_flags));
+    CATCH_DEREF_FAULT();
 %}
 
 function __d_loff_t :long (ppos :long) %{ /* pure */
-        loff_t * ppos = (loff_t *) ((long)THIS->ppos);
-     
-        if (ppos == NULL)
-        {
-                THIS->__retvalue = -1;
-                return;
-        }
+    loff_t * ppos = (loff_t *) ((long)THIS->ppos);
 
-        THIS->__retvalue = *ppos;
+    if (ppos == NULL)
+        THIS->__retvalue = -1;
+    else
+        THIS->__retvalue = kread(ppos);
+    CATCH_DEREF_FAULT();
 %}
 
 function __file_inode:long (file:long) %{ /* pure */
-	struct file *file = (struct file *)(long)THIS->file;
-	if ((file == NULL) || (file->f_dentry == NULL)) {
-		THIS->__retvalue = 0;
-		return;
-	}
-	THIS->__retvalue = deref(sizeof(file->f_dentry->d_inode),
-		&(file->f_dentry->d_inode));
-	if (0) {
-deref_fault:
-		CONTEXT->last_error = "pointer dereference fault";
-	}
+    struct file *file = (struct file *)(long)THIS->file;
+    struct dentry *f_dentry = file? kread(&(file->f_dentry)) : NULL;
+    if (f_dentry == NULL)
+        THIS->__retvalue = 0;
+    else
+        THIS->__retvalue = (long)kread(&(f_dentry->d_inode));
+    CATCH_DEREF_FAULT();
 %}
 
 function __file_id:long (file:long) %{ /* pure */
-	struct file *file = (struct file *)(long)THIS->file;
-	if ((file == NULL) || (file->f_dentry == NULL)) {
-		THIS->__retvalue = 0;
-		return;
-	}
-	THIS->__retvalue = (long)&(file->f_dentry->d_inode->i_sb->s_id);
+    struct file *file = (struct file *)(long)THIS->file;
+    struct dentry *f_dentry = file? kread(&(file->f_dentry)) : NULL;
+    if (f_dentry == NULL)
+        THIS->__retvalue = 0;
+    else {
+        struct inode *d_inode = kread(&(f_dentry->d_inode));
+        struct super_block *i_sb = kread(&(d_inode->i_sb));
+        THIS->__retvalue = (long)&(i_sb->s_id);
+    }
+    CATCH_DEREF_FAULT();
 %}
 
 function __file_mode:long (file:long) %{ /* pure */
-	struct file *file = (struct file *)(long)THIS->file;
-	if ((file == NULL) || (file->f_dentry == NULL)) {
-		THIS->__retvalue = 0;
-		return;
-	}
-	THIS->__retvalue = deref(sizeof(file->f_dentry->d_inode->i_mode),
-		&(file->f_dentry->d_inode->i_mode));
-	if (0) {
-deref_fault:
-		CONTEXT->last_error = "pointer dereference fault";
-	}
+    struct file *file = (struct file *)(long)THIS->file;
+    struct dentry *f_dentry = file? kread(&(file->f_dentry)) : NULL;
+    if (f_dentry == NULL)
+        THIS->__retvalue = 0;
+    else {
+        struct inode *d_inode = kread(&(f_dentry->d_inode));
+        THIS->__retvalue = kread(&(d_inode->i_mode));
+    }
+    CATCH_DEREF_FAULT();
 %}
 
 function __file_parentname:string (file:long) %{ /* pure */
-	struct file *file = (struct file *)(long)THIS->file;
-	if ((file == NULL) 
-		|| (file->f_dentry == NULL) 
-		|| (file->f_dentry->d_parent == NULL))
-		strlcpy(THIS->__retvalue, "NULL", MAXSTRINGLEN);
-	else {
-		strlcpy(THIS->__retvalue, file->f_dentry->d_parent->d_name->name, MAXSTRINGLEN);
-	}
+    struct file *file = (struct file *)(long)THIS->file;
+    struct dentry *f_dentry = file? kread(&(file->f_dentry)) : NULL;
+    struct dentry *d_parent = f_dentry? kread(&(f_dentry->d_parent)) : NULL;
+    if (d_parent == NULL)
+        strlcpy(THIS->__retvalue, "NULL", MAXSTRINGLEN);
+    else {
+        const unsigned char *name = kread(&(d_parent->d_name.name));
+        deref_string(THIS->__retvalue, name, MAXSTRINGLEN);
+    }
+    CATCH_DEREF_FAULT();
 %}
 
 probe nfs.fop.entries = nfs.fop.llseek,
diff --git a/tapset/nfs_proc.stp b/tapset/nfs_proc.stp
index b8226630..21e5371e 100644
--- a/tapset/nfs_proc.stp
+++ b/tapset/nfs_proc.stp
@@ -12,6 +12,7 @@
 %{
      __u32 get_ip(struct rpc_task * task)
      {
+        /* FIXME: deref hazards! */
         struct rpc_clnt * tk_client;
         struct rpc_xprt * cl_xprt;
         struct sockaddr_in *addr;
@@ -25,6 +26,7 @@
      }
      int get_prot(struct rpc_task * task)
      {
+        /* FIXME: deref hazards! */
         struct rpc_clnt * tk_client;
         struct rpc_xprt * cl_xprt;
         tk_client = task->tk_client;
@@ -40,18 +42,18 @@
 function __i2n_ip_proto :long(dir:long,index:long) %{ /* pure */
         int index = (int) (THIS->index);
         struct inode * dir = (struct inode *)(THIS->dir);
-        struct rpc_clnt * clnt = NFS_CLIENT(dir);
-        struct rpc_xprt * cl_xprt = clnt->cl_xprt;
-        struct sockaddr_in * addr = (struct sockaddr_in *)&(cl_xprt->addr);
+        struct rpc_clnt * clnt = NFS_CLIENT(dir); /* FIXME: deref hazard! */
+        struct rpc_xprt * cl_xprt = kread(&(clnt->cl_xprt));
 
         if(index == 0) {
-                if (addr->sin_family == AF_INET) {
+                if (kread(&(cl_xprt->addr.sin_family)) == AF_INET) {
                         /* Now consider ipv4 only */
-                        THIS->__retvalue = addr->sin_addr.s_addr;
+                        THIS->__retvalue = kread(&(cl_xprt->addr.sin_addr.s_addr));
                 } else
                         THIS->__retvalue = 0;
         } else
-                THIS->__retvalue = cl_xprt->prot;
+                THIS->__retvalue = kread(&(cl_xprt->prot));
+        CATCH_DEREF_FAULT();
 %}
 
 /*
@@ -75,20 +77,23 @@ function __nfs_read_data_info:long (rdata :long,index :long) %{ /* pure */
 			THIS->__retvalue = get_prot(task);
 			break;
 		case 2:
-			THIS->__retvalue = rres->count;
+			THIS->__retvalue = kread(&(rres->count));
 			break;
-		case 3:
-			THIS->__retvalue = rres->fattr->valid;
+		case 3: {
+			struct nfs_fattr *fattr = kread(&(rres->fattr));
+			THIS->__retvalue = kread(&(fattr->valid));
 			break;
+			}
 #ifdef CONFIG_NFS_V4
 		case 4:
-			THIS->__retvalue = rdata->timestamp;
+			THIS->__retvalue = kread(&(rdata->timestamp));
 			break;
 #endif
 		default:
 			THIS->__retvalue = 0;
 			break;
 	}
+	CATCH_DEREF_FAULT();
 %}
 
 /*
@@ -114,16 +119,17 @@ function __nfs_write_data_info:long (wdata :long,index :long) %{ /* pure */
 
 function __nfsv4_bitmask :long(dir:long,i:long) %{ /* pure */
         int i = (int) (THIS->i);
-	struct inode * dir = (struct inode *)(THIS->dir);
-        struct nfs_server * server = NFS_SERVER(dir);
+	struct inode * dir = (struct inode *)(long)(THIS->dir);
+        struct nfs_server * server = NFS_SERVER(dir); /* FIXME: deref hazard! */
 
-        THIS->__retvalue = server->attr_bitmask[i];
+        THIS->__retvalue = kread(&(server->attr_bitmask[i]));
 
+        CATCH_DEREF_FAULT();
 %}
 
 function __getfh_inode :long(dir:long) %{ /* pure */
-	struct inode * dir = (struct inode *)(THIS->dir);
-	struct nfs_fh * fh = NFS_FH(dir);
+	struct inode * dir = (struct inode *)(long)(THIS->dir);
+	struct nfs_fh * fh = NFS_FH(dir); /* FIXME: deref hazard! */
 
 	THIS->__retvalue =(long) fh;
 %}
diff --git a/tapset/nfsd.stp b/tapset/nfsd.stp
index 8d8a09a0..49f04f51 100644
--- a/tapset/nfsd.stp
+++ b/tapset/nfsd.stp
@@ -6,26 +6,6 @@
 #include <linux/nfsd/xdr3.h>
 %}
 
-%{
-/*Get file handle from struct svc_fh */
-char * fh_fmt(struct svc_fh * fhp)
-{
-	 struct knfsd_fh *fh = &fhp->fh_handle;
-
-	static char buf[80];
-	sprintf(buf, "%d: %08x %08x %08x %08x %08x %08x",
-		fh->fh_size,
-		fh->fh_base.fh_pad[0],
-		fh->fh_base.fh_pad[1],
-		fh->fh_base.fh_pad[2],
-		fh->fh_base.fh_pad[3],
-		fh->fh_base.fh_pad[4],
-		fh->fh_base.fh_pad[5]);
-	return buf;
-}
-
-%}
-
 /*
  *1 : nfsd.proc2.lookup
  *2 : nfsd.proc3.lookup
@@ -61,7 +41,6 @@ function __get_fh:long(argp:long,index:long) %{ /* pure */
 	struct nfsd_renameargs *argpren = NULL;
 	struct nfsd3_renameargs *argpren3 = NULL;
 	struct svc_fh * fhp = NULL;
-	char * buf;
 
 	switch(index)
 	{
@@ -112,32 +91,30 @@ function __get_fh:long(argp:long,index:long) %{ /* pure */
 		break;
 	}
 	
-	if(fhp == NULL)
-	{
-		_stp_printf("the fhp is NULL");
-		return;
-	}
-	else
-	{
-	/*	buf = fh_fmt(fhp);
-		strlcpy (THIS->__retvalue,buf,80);*/
-		THIS->__retvalue = (long)fhp;
-	}
+	THIS->__retvalue = (long)fhp;
 %}
-/*Get file handler from struct svc_fh , it will call
-fh_fmt function*/
+/*Get file handler from struct svc_fh */
 function __svc_fh:string(fh :long) %{  /* pure */
-	struct svc_fh * fhp = (struct svc_fh *) (THIS->fh);
-	char * buf ;
-	
-	buf =  fh_fmt(fhp); 	
-	strlcpy (THIS->__retvalue,buf,80);
+	struct svc_fh * fhp = (struct svc_fh *) (long)(THIS->fh);
+	struct knfsd_fh *fh = &fhp->fh_handle;
+
+	snprintf(THIS->__retvalue, MAXSTRINGLEN,
+			"%d: %08x %08x %08x %08x %08x %08x",
+			kread(&(fh->fh_size)),
+			kread(&(fh->fh_base.fh_pad[0])),
+			kread(&(fh->fh_base.fh_pad[1])),
+			kread(&(fh->fh_base.fh_pad[2])),
+			kread(&(fh->fh_base.fh_pad[3])),
+			kread(&(fh->fh_base.fh_pad[4])),
+			kread(&(fh->fh_base.fh_pad[5])))
+	CATCH_DEREF_FAULT();
 %}
 
 function p_long:long(cnt:long) %{ /* pure */
 	unsigned long * count = (unsigned long *)((long)THIS->cnt);
 	
-	THIS->__retvalue = *count;
+	THIS->__retvalue = kread(count);
+	CATCH_DEREF_FAULT();
 %}
 /*
 *probe nfsd.dispatch
diff --git a/tapset/rpc.stp b/tapset/rpc.stp
index ef001e9e..7a1c978d 100644
--- a/tapset/rpc.stp
+++ b/tapset/rpc.stp
@@ -822,79 +822,111 @@ probe sunrpc.sched.delay.return = kernel.function("rpc_delay").return ?,
 function xid_from_clnt:long(clnt:long)
 %{
 	struct rpc_clnt *clnt = (struct rpc_clnt *)(long)THIS->clnt;
-	THIS->__retvalue = clnt ? clnt->cl_xprt->xid : 0;
+	if (clnt == NULL)
+		THIS->__retvalue = 0;
+	else {
+		struct rpc_xprt *cl_xprt = kread(&(clnt->cl_xprt));
+		THIS->__retvalue = kread(&(cl_xprt->xid));
+	}
+	CATCH_DEREF_FAULT();
 %}
 
 function prog_from_clnt:long(clnt:long)
 %{
 	struct rpc_clnt *clnt = (struct rpc_clnt *)(long)THIS->clnt;
+	if (clnt == NULL)
+		THIS->__retvalue = 0;
+	else {
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,19)
-	THIS->__retvalue = clnt ? clnt->cl_prog : 0;
+		THIS->__retvalue = kread(&(clnt->cl_prog));
 #else
-	THIS->__retvalue = clnt ? clnt->cl_pmap->pm_prog : 0;
+		struct rpc_portmap *cl_pmap = kread(&(clnt->cl_pmap));
+		THIS->__retvalue = kread(&(cl_pmap->pm_prog));
 #endif
+	}
+	CATCH_DEREF_FAULT();
 %}
 
 function vers_from_clnt:long(clnt:long)
 %{
 	struct rpc_clnt *clnt = (struct rpc_clnt *)(long)THIS->clnt;
+	if (clnt == NULL)
+		THIS->__retvalue = 0;
+	else {
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,19)
-	THIS->__retvalue = clnt ? clnt->cl_vers : 0;
+		THIS->__retvalue = kread(&(clnt->cl_vers));
 #else
-	THIS->__retvalue = clnt ? clnt->cl_pmap->pm_vers : 0;
+		struct rpc_portmap *cl_pmap = kread(&(clnt->cl_pmap));
+		THIS->__retvalue = kread(&(cl_pmap->pm_vers));
 #endif
+	}
+	CATCH_DEREF_FAULT();
 %}
 
 function prot_from_clnt:long(clnt:long)
 %{
 	struct rpc_clnt *clnt = (struct rpc_clnt *)(long)THIS->clnt;
-	THIS->__retvalue = clnt ? clnt->cl_xprt->prot : 0;
+	if (clnt == NULL)
+		THIS->__retvalue = 0;
+	else {
+		struct rpc_xprt *cl_xprt = kread(&(clnt->cl_xprt));
+		THIS->__retvalue = kread(&(cl_xprt->prot));
+	}
+	CATCH_DEREF_FAULT();
 %}
 
 function port_from_clnt:long(clnt:long)
 %{
 	struct rpc_clnt *clnt = (struct rpc_clnt *)(long)THIS->clnt;
-	if(clnt != NULL) {
-		struct sockaddr_in *addr = (struct sockaddr_in *)&(clnt->cl_xprt->addr);
-		if(addr != NULL && addr->sin_family == AF_INET) {
-			/* Now consider ipv4 only */
-			THIS->__retvalue = ntohs(addr->sin_port);
-			return;
-		}
-	}
-	THIS->__retvalue = 0;
+	struct rpc_xprt *cl_xprt = clnt? kread(&(clnt->cl_xprt)) : NULL;
+	if (cl_xprt && kread(&(cl_xprt->addr.sin_family)) == AF_INET) {
+		/* Now consider ipv4 only */
+		THIS->__retvalue = ntohs(kread(&(cl_xprt->addr.sin_port)));
+	} else
+		THIS->__retvalue = 0;
+	CATCH_DEREF_FAULT();
 %}
 
 function clones_from_clnt:long(clnt:long)
 %{
 	struct rpc_clnt *clnt = (struct rpc_clnt *)(long)THIS->clnt;
-	THIS->__retvalue = atomic_read(&clnt->cl_count);
+	THIS->__retvalue = atomic_read(&clnt->cl_count); /* FIXME: deref hazard! */
 %}
 
 function tasks_from_clnt:long(clnt:long)
 %{
 	struct rpc_clnt *clnt = (struct rpc_clnt *)(long)THIS->clnt;
-	THIS->__retvalue = atomic_read(&clnt->cl_users);
+	THIS->__retvalue = atomic_read(&clnt->cl_users); /* FIXME: deref hazard! */
 %}
 
 function proc_from_msg:long(msg:long)
 %{
 	struct rpc_message *msg = (struct rpc_message *)(long)THIS->msg;
-	THIS->__retvalue = msg ? msg->rpc_proc->p_proc : 0;
+	if (msg == NULL)
+		THIS->__retvalue = 0;
+	else {
+		struct rpc_procinfo *rpc_proc = kread(&(msg->rpc_proc));
+		THIS->__retvalue = kread(&(rpc_proc->p_proc));
+	}
+	CATCH_DEREF_FAULT();
 %}
 
 function vers_from_prog:long(program:long, vers:long)
 %{
 	struct rpc_program *program = (struct rpc_program *)(long)THIS->program;
-	if (!program || THIS->vers >= program->nrvers || !program->version[THIS->vers])
+	if (program && THIS->vers < kread(&(program->nrvers))) {
+		struct rpc_version **version_array = kread(&(program->version));
+		struct rpc_version *version = kread(&(version_array[THIS->vers]));
+		THIS->__retvalue = kread(&(version->number));
+	} else
 		THIS->__retvalue = 0;
-	else
-		THIS->__retvalue = program->version[THIS->vers]->number;
+	CATCH_DEREF_FAULT();
 %}
 
 function addr_from_rqst:long(rqstp:long)
 %{
 	struct svc_rqst *rqstp = (struct svc_rqst *)(long)THIS->rqstp;
-	THIS->__retvalue = rqstp ? rqstp->rq_addr.sin_addr.s_addr : 0;
+	THIS->__retvalue = rqstp ? kread(&(rqstp->rq_addr.sin_addr.s_addr)) : 0;
+	CATCH_DEREF_FAULT();
 %}
 
diff --git a/tapset/scsi.stp b/tapset/scsi.stp
index 23256893..5e467686 100644
--- a/tapset/scsi.stp
+++ b/tapset/scsi.stp
@@ -77,12 +77,13 @@ probe scsi.iocompleted
 function scsi_timer_pending:long(var:long)
 %{
         struct scsi_cmnd *cmd = (struct scsi_cmnd *)((long)THIS->var);
-        THIS->__retvalue = timer_pending(&cmd->eh_timeout);
+        THIS->__retvalue = timer_pending(&cmd->eh_timeout); /* FIXME: deref hazard! */
 %}
 
 function get_devstate_from_req:long(var:long)
 %{
 	struct request_queue *q = (struct request_queue *)((long)THIS->var);
-        struct scsi_device *sdev = (struct scsi_device *)(q->queuedata);
-	THIS->__retvalue = sdev->sdev_state;
+	struct scsi_device *sdev = (struct scsi_device *)kread(&(q->queuedata));
+	THIS->__retvalue = kread(&(sdev->sdev_state));
+	CATCH_DEREF_FAULT();
 %}
diff --git a/tapset/signal.stp b/tapset/signal.stp
index da220bab..33a2202c 100644
--- a/tapset/signal.stp
+++ b/tapset/signal.stp
@@ -450,19 +450,14 @@ probe signal.procmask = kernel.function("sigprocmask")
 }
 
 function get_sigset:long(sigset:long) %{ /* pure */
-
+    int i;
     sigset_t *sigset = (sigset_t *)((long)THIS->sigset);
-
-if(_NSIG_BPW == 64)
-    THIS->__retvalue = deref(sizeof(sigset_t), sigset);
-else if(_NSIG_BPW == 32)
-    THIS->__retvalue = deref(sizeof(int), &(sigset->sig[0])) |
-        ((u_int64_t)deref(sizeof(int), &(sigset->sig[1])))<<32;
-
-    if(0)  {
-deref_fault:
-        CONTEXT->last_error = "pointer deref error";
+    THIS->__retvalue = kread(&(sigset->sig[0]));
+    for (i=1; i<_NSIG_WORDS; ++i) {
+        uint64_t part = kread(&(sigset->sig[i]));
+        THIS->__retvalue |= part << (_NSIG_BPW*i);
     }
+    CATCH_DEREF_FAULT();
 %}
 
 probe signal.procmask.return = kernel.function("sigprocmask").return
diff --git a/tapset/socket.stp b/tapset/socket.stp
index 451dd36e..58732185 100644
--- a/tapset/socket.stp
+++ b/tapset/socket.stp
@@ -513,17 +513,18 @@ function sock_flags_num2str:string (flags:long)
 #define SOCK_PASSSEC 4   /* introduced in 2.6.18 */
 #endif
 	char str[60];
+	unsigned long flags = THIS->flags;
 
 	str[0] = '\0';
-	if (test_bit (SOCK_ASYNC_NOSPACE, &THIS->flags))
+	if (test_bit (SOCK_ASYNC_NOSPACE, &flags))
 		strcat (str, "ASYNC_NOSPACE|");
-	if (test_bit (SOCK_ASYNC_WAITDATA, &THIS->flags))
+	if (test_bit (SOCK_ASYNC_WAITDATA, &flags))
 		strcat (str, "ASYNC_WAITDATA|");
-	if (test_bit (SOCK_NOSPACE, &THIS->flags))
+	if (test_bit (SOCK_NOSPACE, &flags))
 		strcat (str, "NOSPACE|");
-	if (test_bit (SOCK_PASSCRED, &THIS->flags))
+	if (test_bit (SOCK_PASSCRED, &flags))
 		strcat (str, "PASSCRED|");
-	if (test_bit (SOCK_PASSSEC, &THIS->flags))
+	if (test_bit (SOCK_PASSSEC, &flags))
 		strcat (str, "PASSSEC|");
 	if (str[0] != '\0') str[strlen(str)-1] = '\0';
 	strlcpy (THIS->__retvalue, str, MAXSTRINGLEN);
@@ -938,147 +939,77 @@ function _success_check(ret:long)
 
 function _get_sock_addr:long (file:long)
 %{
-	struct socket *sockp;
-	struct file *filep;
-	
-	filep = (struct file *) deref (sizeof(struct file *), &(THIS->file));
-	if (filep == NULL) {
+	struct file *filep = (struct file *)(long)(THIS->file);
+	struct socket *sockp = filep? kread(&(filep->private_data)) : NULL;
+	if (sockp == NULL)
 		THIS->__retvalue = -1;
-		goto end;
-	}
-	sockp = (struct socket *) deref (sizeof(filep->private_data),
-	        &(filep->private_data));
-	if (sockp == NULL) {
-		THIS->__retvalue = -1;
-		goto end;
-	}
-	THIS->__retvalue = (long) sockp;
-	
-	if (0) {
-deref_fault:
-		CONTEXT->last_error = "pointer dereference fault";
-	}
-end: ;
+	else
+		THIS->__retvalue = (long) sockp;
+	CATCH_DEREF_FAULT();
 %}
 
 function _get_sock_size:long (iov:long, nr_segs:long)
 %{
-	struct iovec *iovp;
-	long size = 0;
-	int i;
-
-	iovp = (struct iovec *) deref (sizeof(struct iov *), &(THIS->iov));
-	if (iovp == NULL) {
+	struct iovec *iovp = (struct iovec *)(long)(THIS->iov);
+	if (iovp == NULL)
 		THIS->__retvalue = -1;
-		goto end;
-	}
-	
-	for (i = 0 ; i < THIS->nr_segs ; i++)
-		size += iovp[i].iov_len;
-
-	THIS->__retvalue = size;
-	
-	if (0) {
-deref_fault:
-		CONTEXT->last_error = "pointer dereference fault";
+	else {
+		int i;
+		THIS->__retvalue = 0;
+		for (i = 0 ; i < THIS->nr_segs ; i++)
+			THIS->__retvalue += kread(&(iovp[i].iov_len));
 	}
-end: ;
+	CATCH_DEREF_FAULT();
 %}
 
 function _sock_prot_num:long (sock:long)
 %{
-	struct socket *sktp;
-	struct sock *skp;
-
-	sktp = (struct socket *) deref (sizeof (struct socket *), &(THIS->sock));
-	if (sktp == NULL) {
-		THIS->__retvalue = -1;
-		goto end;
-	}
-	skp = (struct sock *) deref (sizeof (sktp->sk), &(sktp->sk));
-	if (skp == NULL) {
+	struct socket *sktp = (struct socket *)(long)(THIS->sock);
+	struct sock *skp = sktp? kread(&(sktp->sk)) : NULL;
+	if (skp == NULL)
 		THIS->__retvalue = -1;
-		goto end;
-	}
-	THIS->__retvalue = (long) skp->sk_protocol;
-
-	if (0) {
-deref_fault:
-		CONTEXT->last_error = "pointer dereference fault";
-	}
-end: ;
+	else
+		THIS->__retvalue = kread(&(skp->sk_protocol));
+	CATCH_DEREF_FAULT();
 %}
 
 function _sock_fam_num:long (sock:long)
 %{
-	struct socket *sockp;
-	struct proto_ops *ops;
-
-	sockp = (struct socket *) deref (sizeof (struct socket *), &(THIS->sock));
-	if (sockp == NULL) {
+	struct socket *sockp = (struct socket *)(long)(THIS->sock);
+	const struct proto_ops *ops = sockp? kread(&(sockp->ops)) : NULL;
+	if (ops == NULL)
 		THIS->__retvalue = -1;
-		goto end;
-	}
-	ops = (struct proto_ops *) deref (sizeof (sockp->ops), &(sockp->ops));
-	if (ops == NULL) {
-		THIS->__retvalue = -1;
-		goto end;
-	}
-	THIS->__retvalue = (long) ops->family;
-	if (0) {
-deref_fault:
-		CONTEXT->last_error = "pointer dereference fault";
-	}
-end: ;
+	else
+		THIS->__retvalue = kread(&(ops->family));
+	CATCH_DEREF_FAULT();
 %}
 
 function _sock_state_num:long (sock:long)
 %{
-	struct socket *sockp;
-
-	sockp = (struct socket *) deref (sizeof (struct sock *), &(THIS->sock));
-	if (sockp == NULL) {
+	struct socket *sockp = (struct socket *)(long)(THIS->sock);
+	if (sockp == NULL)
 		THIS->__retvalue = -1;
-		goto end;
-	}
-	THIS->__retvalue = sockp->state;
-	if (0) {
-deref_fault:
-		CONTEXT->last_error = "pointer dereference fault";
-	}
-end: ;
+	else
+		THIS->__retvalue = kread(&(sockp->state));
+	CATCH_DEREF_FAULT();
 %}
 
 function _sock_type_num:long (sock:long)
 %{
-	struct socket *sockp;
-
-	sockp = (struct socket *) deref (sizeof(struct socket *), &(THIS->sock));
-	if (sockp == NULL) {
+	struct socket *sockp = (struct socket *)(long)(THIS->sock);
+	if (sockp == NULL)
 		THIS->__retvalue = -1;
-		goto end;
-	}
-	THIS->__retvalue = (long) sockp->type;
-	if (0) {
-deref_fault:
-		CONTEXT->last_error = "pointer dereference fault";
-	}
-end: ;
+	else
+		THIS->__retvalue = kread(&(sockp->type));
+	CATCH_DEREF_FAULT();
 %}
 
 function _sock_flags_num:long (sock:long)
 %{
-	struct socket *sockp;
-
-	sockp = (struct socket *) deref (sizeof(struct socket *), &(THIS->sock));
-	if (sockp == NULL) {
+	struct socket *sockp = (struct socket *)(long)(THIS->sock);
+	if (sockp == NULL)
 		THIS->__retvalue = -1;
-		goto end;
-	}
-	THIS->__retvalue = sockp->flags;
-	if (0) {
-deref_fault:
-		CONTEXT->last_error = "pointer dereference fault";
-	}
-end: ;
+	else
+		THIS->__retvalue = kread(&(sockp->flags));
+	CATCH_DEREF_FAULT();
 %}
diff --git a/tapset/string.stp b/tapset/string.stp
index 15791134..2f43aecc 100644
--- a/tapset/string.stp
+++ b/tapset/string.stp
@@ -20,10 +20,8 @@ function strlen:long(s:string) %{ /* pure */
 * @return Returns the substring.
 */
 function substr:string(str:string,start:long, length:long) %{ /* pure */
-	int length = THIS->length + 1 > MAXSTRINGLEN ? MAXSTRINGLEN : THIS->length + 1;
-	if (THIS->start < 0   || length < 1) {
-		return;
-	} else
+	int length = THIS->length >= MAXSTRINGLEN ? MAXSTRINGLEN : THIS->length + 1;
+	if (THIS->start >= 0 && length > 0 && THIS->start < strlen(THIS->str))
 		strlcpy(THIS->__retvalue, THIS->str + THIS->start, length);
 %}
 
diff --git a/tapset/syscalls.stp b/tapset/syscalls.stp
index 6601a229..f3d9a581 100644
--- a/tapset/syscalls.stp
+++ b/tapset/syscalls.stp
@@ -488,7 +488,7 @@ probe syscall.epoll_wait.return = kernel.function("sys_epoll_wait").return {
 #	struct pt_regs * regs)
 probe syscall.execve = kernel.function("do_execve") {
 	name = "execve"
-	filename = __string($filename)
+	filename = kernel_string($filename)
 	args = __get_argv($argv)
 	argstr = sprintf("%s %s", filename, args)
 }
diff --git a/tapset/task.stp b/tapset/task.stp
index cbf61f3a..2f183838 100644
--- a/tapset/task.stp
+++ b/tapset/task.stp
@@ -16,11 +16,8 @@ function task_current:long () %{ /* pure */
 // Return the parent task_struct of the given task
 function task_parent:long (task:long) %{ /* pure */
     struct task_struct *t = (struct task_struct *)(long)THIS->task;
-    THIS->__retvalue = deref(sizeof(t->parent), &(t->parent));
-    if (0) {
-deref_fault:
-        CONTEXT->last_error = "pointer dereference fault";
-    }
+    THIS->__retvalue = (long)kread(&(t->parent));
+    CATCH_DEREF_FAULT();
 %}
 
 
@@ -34,11 +31,8 @@ deref_fault:
 //   EXIT_DEAD             32
 function task_state:long (task:long) %{ /* pure */
     struct task_struct *t = (struct task_struct *)(long)THIS->task;
-    THIS->__retvalue = deref(sizeof(t->state), &(t->state));
-    if (0) {
-deref_fault:
-        CONTEXT->last_error = "pointer dereference fault";
-    }
+    THIS->__retvalue = kread(&(t->state));
+    CATCH_DEREF_FAULT();
 %}
 
 
@@ -46,111 +40,78 @@ deref_fault:
 function task_execname:string (task:long) %{ /* pure */
     struct task_struct *t = (struct task_struct *)(long)THIS->task;
     deref_string(THIS->__retvalue, t->comm, MAXSTRINGLEN);
-    if (0) {
-deref_fault:
-        CONTEXT->last_error = "pointer dereference fault";
-    }
+    CATCH_DEREF_FAULT();
 %}
 
 
 // Return the process id of the given task
 function task_pid:long (task:long) %{ /* pure */
     struct task_struct *t = (struct task_struct *)(long)THIS->task;
-    THIS->__retvalue = deref(sizeof(t->tgid), &(t->tgid));
-    if (0) {
-deref_fault:
-        CONTEXT->last_error = "pointer dereference fault";
-    }
+    THIS->__retvalue = kread(&(t->tgid));
+    CATCH_DEREF_FAULT();
 %}
 
 
 // Return the thread id of the given task
 function task_tid:long (task:long) %{ /* pure */
     struct task_struct *t = (struct task_struct *)(long)THIS->task;
-    THIS->__retvalue = deref(sizeof(t->pid), &(t->pid));
-    if (0) {
-deref_fault:
-        CONTEXT->last_error = "pointer dereference fault";
-    }
+    THIS->__retvalue = kread(&(t->pid));
+    CATCH_DEREF_FAULT();
 %}
 
 
 // Return the group id of the given task
 function task_gid:long (task:long) %{ /* pure */
     struct task_struct *t = (struct task_struct *)(long)THIS->task;
-    THIS->__retvalue = deref(sizeof(t->gid), &(t->gid));
-    if (0) {
-deref_fault:
-        CONTEXT->last_error = "pointer dereference fault";
-    }
+    THIS->__retvalue = kread(&(t->gid));
+    CATCH_DEREF_FAULT();
 %}
 
 
 // Return the effective group id of the given task
 function task_egid:long (task:long) %{ /* pure */
     struct task_struct *t = (struct task_struct *)(long)THIS->task;
-    THIS->__retvalue = deref(sizeof(t->egid), &(t->egid));
-    if (0) {
-deref_fault:
-        CONTEXT->last_error = "pointer dereference fault";
-    }
+    THIS->__retvalue = kread(&(t->egid));
+    CATCH_DEREF_FAULT();
 %}
 
 
 // Return the user id of the given task
 function task_uid:long (task:long) %{ /* pure */
     struct task_struct *t = (struct task_struct *)(long)THIS->task;
-    THIS->__retvalue = deref(sizeof(t->uid), &(t->uid));
-    if (0) {
-deref_fault:
-        CONTEXT->last_error = "pointer dereference fault";
-    }
+    THIS->__retvalue = kread(&(t->uid));
+    CATCH_DEREF_FAULT();
 %}
 
 
 // Return the effective user id of the given task
 function task_euid:long (task:long) %{ /* pure */
     struct task_struct *t = (struct task_struct *)(long)THIS->task;
-    THIS->__retvalue = deref(sizeof(t->euid), &(t->euid));
-    if (0) {
-deref_fault:
-        CONTEXT->last_error = "pointer dereference fault";
-    }
+    THIS->__retvalue = kread(&(t->euid));
+    CATCH_DEREF_FAULT();
 %}
 
 
 // Return the priority value of the given task
 function task_prio:long (task:long) %{ /* pure */
     struct task_struct *t = (struct task_struct *)(long)THIS->task;
-    int prio = deref(sizeof(t->prio), &(t->prio));
-    THIS->__retvalue = prio - MAX_RT_PRIO;
-    if (0) {
-deref_fault:
-        CONTEXT->last_error = "pointer dereference fault";
-    }
+    THIS->__retvalue =  kread(&(t->prio)) - MAX_RT_PRIO;
+    CATCH_DEREF_FAULT();
 %}
 
 
 // Return the nice value of the given task
 function task_nice:long (task:long) %{ /* pure */
     struct task_struct *t = (struct task_struct *)(long)THIS->task;
-    int static_prio = deref(sizeof(t->static_prio), &(t->static_prio));
-    THIS->__retvalue = static_prio - MAX_RT_PRIO - 20;
-    if (0) {
-deref_fault:
-        CONTEXT->last_error = "pointer dereference fault";
-    }
+    THIS->__retvalue = kread(&(t->static_prio)) - MAX_RT_PRIO - 20;
+    CATCH_DEREF_FAULT();
 %}
 
 
 // Return the scheduled cpu for the given task
 function task_cpu:long (task:long) %{ /* pure */
     struct task_struct *t = (struct task_struct *)(long)THIS->task;
-    struct thread_info *ti =
-        (struct thread_info *)deref(sizeof(t->thread_info), &(t->thread_info));
-    THIS->__retvalue = deref(sizeof(ti->cpu), &(ti->cpu));
-    if (0) {
-deref_fault:
-        CONTEXT->last_error = "pointer dereference fault";
-    }
+    struct thread_info *ti = kread(&(t->thread_info));
+    THIS->__retvalue = kread(&(ti->cpu));
+    CATCH_DEREF_FAULT();
 %}
diff --git a/tapset/tcp.stp b/tapset/tcp.stp
index 01adad77..b09c74cb 100644
--- a/tapset/tcp.stp
+++ b/tapset/tcp.stp
@@ -20,14 +20,15 @@
 // timeout (TCP_RTO_MAX)
 function tcp_get_info_rto:long(sock:long)
 %{
-	unsigned long ptr = (unsigned long) THIS->sock;
+	struct sock *sk = (struct sock *)(long) THIS->sock;
 #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,10)
-	struct tcp_opt *tp = tcp_sk((struct sock *)ptr);
-	THIS->__retvalue = (int64_t) jiffies_to_usecs(tp->rto);
+	struct tcp_opt *tp = tcp_sk(sk);
+	THIS->__retvalue = (int64_t) jiffies_to_usecs(kread(&(tp->rto)));
 #else
-	const struct inet_connection_sock *icsk = inet_csk((struct sock *)ptr);
-	THIS->__retvalue = (int64_t) jiffies_to_usecs(icsk->icsk_rto);
+	const struct inet_connection_sock *icsk = inet_csk(sk);
+	THIS->__retvalue = (int64_t) jiffies_to_usecs(kread(&(icsk->icsk_rto)));
 #endif
+	CATCH_DEREF_FAULT();
 %}
 
 //Get congestion window segment size. Initial value of congestion window size 
@@ -36,13 +37,14 @@ function tcp_get_info_rto:long(sock:long)
 //is performing slow start or congestion avoidance. 
 function tcp_get_info_snd_cwnd:long(sock:long)
 %{
-	unsigned long ptr = (unsigned long) THIS->sock;
+	struct sock *sk = (struct sock *)(long) THIS->sock;
 #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,10)
-	struct tcp_opt *tp = tcp_sk((struct sock *)ptr);
+	struct tcp_opt *tp = tcp_sk(sk);
 #else
-	struct tcp_sock *tp = tcp_sk((struct sock *)ptr);
+	struct tcp_sock *tp = tcp_sk(sk);
 #endif
-	THIS->__retvalue = (int64_t) tp->snd_cwnd;
+	THIS->__retvalue = (int64_t) kread(&(tp->snd_cwnd));
+	CATCH_DEREF_FAULT();
 %}
 
 //
@@ -63,10 +65,9 @@ function tcp_get_info_snd_cwnd:long(sock:long)
 // 
 function tcp_ts_get_info_state:long(sock:long)
 %{
-        unsigned long ptr = (unsigned long) THIS->sock;
-	struct sock * sk =  (struct sock *) ptr; 
-	
-	THIS->__retvalue = (int64_t) sk->sk_state;
+	struct sock *sk = (struct sock *)(long) THIS->sock;
+	THIS->__retvalue = (int64_t) kread(&(sk->sk_state));
+	CATCH_DEREF_FAULT();
 %}
 
 
@@ -75,28 +76,29 @@ function tcp_ts_get_info_state:long(sock:long)
 // avoidance.
 function tcp_ts_get_info_snd_ssthresh:long(sock:long)
 %{
-	unsigned long ptr = (unsigned long) THIS->sock;
+	struct sock *sk = (struct sock *)(long) THIS->sock;
 #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,10)
-	struct tcp_opt *tp = tcp_sk((struct sock *)ptr);
+	struct tcp_opt *tp = tcp_sk(sk);
 #else
-	struct tcp_sock *tp = tcp_sk((struct sock *)ptr);
+	struct tcp_sock *tp = tcp_sk(sk);
 #endif
-
-	THIS->__retvalue = (int64_t) tp->snd_ssthresh;
+	THIS->__retvalue = (int64_t) kread(&(tp->snd_ssthresh));
+	CATCH_DEREF_FAULT();
 %}
 
 // Get receiver's advertised segment size.  TCP typically never sends more
 // than what receiver can accept.
 function tcp_ts_get_info_rcv_mss:long(sock:long)
 %{
-	unsigned long ptr = (unsigned long) THIS->sock;
+	struct sock *sk = (struct sock *)(long) THIS->sock;
 #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,10)
-	struct tcp_opt *tp = tcp_sk((struct sock *)ptr);
-	THIS->__retvalue = (int64_t) tp->ack.rcv_mss;
+	struct tcp_opt *tp = tcp_sk(sk);
+	THIS->__retvalue = (int64_t) kread(&(tp->ack.rcv_mss));
 #else
-	const struct inet_connection_sock *icsk = inet_csk((struct sock *)ptr);
-	THIS->__retvalue = (int64_t) icsk->icsk_ack.rcv_mss;
+	const struct inet_connection_sock *icsk = inet_csk(sk);
+	THIS->__retvalue = (int64_t) kread(&(icsk->icsk_ack.rcv_mss));
 #endif
+	CATCH_DEREF_FAULT();
 %}
 
 // probe tcp.sendmsg
diff --git a/tapset/vfs.stp b/tapset/vfs.stp
index 6b66624e..e10a2ed5 100644
--- a/tapset/vfs.stp
+++ b/tapset/vfs.stp
@@ -6,20 +6,20 @@ function __bdevname:string (bdev:long) %{ /* pure */
 	struct block_device *bdev = (struct block_device *)(long)THIS->bdev;
 	if (bdev == NULL) {
 		strlcpy(THIS->__retvalue, "N/A", MAXSTRINGLEN);
-		return;
+	} else {
+		const char *name = bdevname(bdev, b); /* FIXME: deref hazard! */
+		deref_string(THIS->__retvalue, name, MAXSTRINGLEN);
 	}
 
-	deref_string(THIS->__retvalue, bdevname(bdev,b), MAXSTRINGLEN);
-	if (0) {
-deref_fault:
-		CONTEXT->last_error = "pointer dereference fault";
-	}
+	CATCH_DEREF_FAULT();
 %}
 
 /*
   We don't want to have to do a bdevname() call every time
   we want a devname, so we'll hash them here.
 */
+/* XXX: Is this hashing really that helpful?  The call to bdevname()
+ * isn't very involved... */
 global __devnames
 function __find_bdevname(dev, bdev)
 {
@@ -38,120 +38,108 @@ function __find_bdevname(dev, bdev)
 function ppos_pos:long (ppos:long) %{ /* pure */
 	loff_t *ppos = (loff_t *)(long)THIS->ppos;
 	THIS->__retvalue = (int64_t) kread(ppos);
-	if (0) {
-deref_fault:
-		CONTEXT->last_error = "pointer dereference fault";
-	}
+	CATCH_DEREF_FAULT();
 %}
 
 function __page_ino:long (page:long) %{ /* pure */
 	struct page *page = (struct page *)(long)THIS->page;
-	if ((page == NULL) || (page->mapping == NULL)) {
+	struct address_space *mapping = page? kread(&(page->mapping)) : NULL;
+	if (mapping == NULL) {
 		THIS->__retvalue = -1;
-		return;
-	}
-
-	THIS->__retvalue = deref(sizeof(page->mapping->host->i_ino),
-		&(page->mapping->host->i_ino));
-	if (0) {
-deref_fault:
-		CONTEXT->last_error = "pointer dereference fault";
+	} else {
+		struct inode *host = kread(&(mapping->host));
+		THIS->__retvalue = kread(&(host->i_ino));
 	}
+	CATCH_DEREF_FAULT();
 %}
 
 function __page_dev:long (page:long) %{ /* pure */
 	struct page *page = (struct page *)(long)THIS->page;
-	if ((page == NULL) || (page->mapping == NULL)) {
+	struct address_space *mapping = page? kread(&(page->mapping)) : NULL;
+	if (mapping == NULL) {
 		THIS->__retvalue = -1;
-		return;
-	}
-	THIS->__retvalue = deref(sizeof(page->mapping->host->i_sb->s_dev),
-		&(page->mapping->host->i_sb->s_dev));
-	if (0) {
-deref_fault:
-		CONTEXT->last_error = "pointer dereference fault";
+	} else {
+		struct inode *host = kread(&(mapping->host));
+		struct super_block *i_sb = kread(&(host->i_sb));
+		THIS->__retvalue = kread(&(i_sb->s_dev));
 	}
+	CATCH_DEREF_FAULT();
 %}
 
 function __page_bdev:long (page:long) %{ /* pure */
 	struct page *page = (struct page *)(long)THIS->page;
-	if ((page == NULL) || (page->mapping == NULL)) {
+	struct address_space *mapping = page? kread(&(page->mapping)) : NULL;
+	if (mapping == NULL) {
 		THIS->__retvalue = 0;
-		return;
-	}
-	THIS->__retvalue = deref(sizeof(page->mapping->host->i_sb->s_bdev),
-		&(page->mapping->host->i_sb->s_bdev));
-	if (0) {
-deref_fault:
-		CONTEXT->last_error = "pointer dereference fault";
+	} else {
+		struct inode *host = kread(&(mapping->host));
+		struct super_block *i_sb = kread(&(host->i_sb));
+		THIS->__retvalue = (long)kread(&(i_sb->s_bdev));
 	}
+	CATCH_DEREF_FAULT();
 %}
 
 function __file_dev:long (file:long) %{ /* pure */
 	struct file *file = (struct file *)(long)THIS->file;
-	if ((file == NULL) || (file->f_dentry == NULL)) {
+	struct dentry *f_dentry = file? kread(&(file->f_dentry)) : NULL;
+	if (f_dentry == NULL) {
 		THIS->__retvalue = 0;
-		return;
-	}
-	THIS->__retvalue = deref(sizeof(file->f_dentry->d_inode->i_sb->s_dev),
-		&(file->f_dentry->d_inode->i_sb->s_dev));
-	if (0) {
-deref_fault:
-		CONTEXT->last_error = "pointer dereference fault";
+	} else {
+		struct inode *d_inode = kread(&(f_dentry->d_inode));
+		struct super_block *i_sb = kread(&(d_inode->i_sb));
+		THIS->__retvalue = kread(&(i_sb->s_dev));
 	}
+	CATCH_DEREF_FAULT();
 %}
 
 function __file_bdev:long (file:long) %{ /* pure */
 	struct file *file = (struct file *)(long)THIS->file;
-	if ((file == NULL) || (file->f_dentry == NULL)) {
+	struct dentry *f_dentry = file? kread(&(file->f_dentry)) : NULL;
+	if (f_dentry == NULL) {
 		THIS->__retvalue = 0;
-		return;
-	}
-	THIS->__retvalue = deref(sizeof(file->f_dentry->d_inode->i_sb->s_bdev),
-		&(file->f_dentry->d_inode->i_sb->s_bdev));
-	if (0) {
-deref_fault:
-		CONTEXT->last_error = "pointer dereference fault";
+	} else {
+		struct inode *d_inode = kread(&(f_dentry->d_inode));
+		struct super_block *i_sb = kread(&(d_inode->i_sb));
+		THIS->__retvalue = (long)kread(&(i_sb->s_bdev));
 	}
+	CATCH_DEREF_FAULT();
 %}
 
 function __file_ino:long (file:long) %{ /* pure */
 	struct file *file = (struct file *)(long)THIS->file;
-	if ((file == NULL) || (file->f_dentry == NULL)) {
+	struct dentry *f_dentry = file? kread(&(file->f_dentry)) : NULL;
+	if (f_dentry == NULL) {
 		THIS->__retvalue = 0;
-		return;
-	}
-	THIS->__retvalue = deref(sizeof(file->f_dentry->d_inode->i_ino),
-		&(file->f_dentry->d_inode->i_ino));
-	if (0) {
-deref_fault:
-		CONTEXT->last_error = "pointer dereference fault";
+	} else {
+		struct inode *d_inode = kread(&(f_dentry->d_inode));
+		THIS->__retvalue = kread(&(d_inode->i_ino));
 	}
+	CATCH_DEREF_FAULT();
 %}
 
 function __file_maxbytes:long (file:long) %{ /* pure */
 	struct file *file = (struct file *)(long)THIS->file;
-	if ((file == NULL) || (file->f_dentry == NULL)) {
+	struct dentry *f_dentry = file? kread(&(file->f_dentry)) : NULL;
+	if (f_dentry == NULL) {
 		THIS->__retvalue = 0;
-		return;
-	}
-	THIS->__retvalue = deref(sizeof(file->f_dentry->d_inode->i_sb->s_maxbytes),
-		&(file->f_dentry->d_inode->i_sb->s_maxbytes));
-	if (0) {
-deref_fault:
-		CONTEXT->last_error = "pointer dereference fault";
+	} else {
+		struct inode *d_inode = kread(&(f_dentry->d_inode));
+		struct super_block *i_sb = kread(&(d_inode->i_sb));
+		THIS->__retvalue = kread(&(i_sb->s_maxbytes));
 	}
+	CATCH_DEREF_FAULT();
 %}
 
 function __file_filename:string (file:long) %{ /* pure */
 	struct file *file = (struct file *)(long)THIS->file;
-	if ((file == NULL) 
-		|| (file->f_dentry == NULL) 
-		|| (file->f_dentry->d_name.name == NULL)) 
+	struct dentry *f_dentry = file? kread(&(file->f_dentry)) : NULL;
+	const unsigned char *name = f_dentry? kread(&(f_dentry->d_name.name)) : NULL;
+	if (name == NULL) {
 		strlcpy(THIS->__retvalue, "NULL", MAXSTRINGLEN);
-	else {
-		strlcpy(THIS->__retvalue, file->f_dentry->d_name.name, MAXSTRINGLEN);
+	} else {
+		deref_string(THIS->__retvalue, name, MAXSTRINGLEN);
 	}
+	CATCH_DEREF_FAULT();
 %}
 
 probe generic.fop.llseek = kernel.function ("generic_file_llseek")