> The problem here is that the ioctl buffer contained a pointer to another
> userspace buffer.

iirc, it's exactly what FKIOCTL was for.

> Since we don't want applications to say a buffer is
> in kernel space, an additional parameter would have to be passed through
> (or maybe a different 'l' so that the kernel vmspace gets used later)
> the fo_ioctl() call - and that would be a larger change.

larger, but far better than ad-hoc additions of ioctls, IMO.

YAMAMOTO Takashi