
<   cmd_buf = memdup_user(buffer, count + 1);
<   if (IS_ERR(cmd_buf))
<       return -ENOMEM;
<
<   cmd_buf[count] = '\0';
---
>   cmd_buf = memdup_user(buffer, count + 1);
>   if (IS_ERR(cmd_buf))
>       return -ENOMEM;
>
>   cmd_buf[count] = '\0';
>   if (strnlen(cmd_buf, count + 1) == count + 1) {
>       kfree(cmd_buf);
>       return -EINVAL;
>   }
