Patch just for comment, do not apply. In network land, there exists struct ifreq, which passed contains per-ioctl data passed to the net driver. Recently, I marked the user pointer component with '__user', struct ifreq { ... union { struct sockaddr ifru_addr; struct sockaddr ifru_dstaddr; struct sockaddr ifru_broadaddr; struct sockaddr ifru_netmask; struct sockaddr ifru_hwaddr; short ifru_flags; int ifru_ivalue; int ifru_mtu; struct ifmap ifru_map; char ifru_slave[IFNAMSIZ]; /* Just fits the size */ char ifru_newname[IFNAMSIZ]; char __user * ifru_data; struct if_settings ifru_settings; } ifr_ifru; }; However, Al noticed that network drivers were doing struct mii_ioctl_data *data = (struct mii_ioctl_data *) &ifr->ifr_data; So, we have some code that will copy_to_user from the pointer stored in ->ifr_data [aka ifr_ifru.ifru_data], and other code that uses the address of irf_data to indicate an anonymous BLOB of data stored in the union. I'm a bit curious why sparse complained about taking the _address_ of pointer, but nonetheless it's an ugliness that should be contained before it spreads :) Attached is a proposed cleanup patch for comment. The ugliness is confined to include/linux/mii.h, and I avoid use the ifru_data field completely. Untested, but compiles. Jeff