
+ size_t buf_len;
< kern_buf = memdup_user(buf, nbytes);
---
+ buf_len = strnlen_user(buf, PAGE_SIZE);
+ if (buf_len == 0 || buf_len > PAGE_SIZE)
+     return -EINVAL;
+ if (nbytes > buf_len)
+     nbytes = buf_len;
+ kern_buf = memdup_user(buf, nbytes);
