
< 	cmd_buf = memdup_user(buffer, count + 1);
---
> 	if (count == SIZE_MAX)
> 		return -EINVAL;
> 	cmd_buf = memdup_user(buffer, count + 1);
