
+ 	size_t safe_len;
< 	buffer = vmemdup_user(buf, lbuf);
---
> 	safe_len = strnlen_user(buf, lbuf);
> 	if (safe_len == 0 || safe_len > lbuf)
> 		return -EFAULT;
> 	buffer = vmemdup_user(buf, safe_len);
