diff
- char user_val[16], *cmd_buf;
+ char user_val[16], cmd_buf[9];  // 8 bytes + null terminator
...
- cmd_buf = memdup_user(buf, count);
- if (IS_ERR(cmd_buf))
-     return PTR_ERR(cmd_buf);
+ if (copy_from_user(cmd_buf, buf, min(count, sizeof(cmd_buf) - 1)))
+     return -EFAULT;
+ cmd_buf[min(count, sizeof(cmd_buf) - 1)] = '\0';
