
< 	kern_buf = memdup_user(buf, nbytes);
---
+ 	if (nbytes > SSIZE_MAX || nbytes == 0)
+ 		return -EINVAL;
+ 	kern_buf = memdup_user(buf, nbytes);
