
< 	cmd_buf = memdup_user(buffer, count + 1);
---
> 	size_t alloc_size = count >= SIZE_MAX ? SIZE_MAX : count + 1;
> 	cmd_buf = memdup_user(buffer, alloc_size);
