diff
<     buffer = vmemdup_user(buf, lbuf);
---
>     unsigned long user_buf_end = (unsigned long)buf + lbuf;
>     if (!access_ok(VERIFY_READ, buf, lbuf) || user_buf_end < (unsigned long)buf) {
>         return -EFAULT;
>     }
>     buffer = vmemdup_user(buf, lbuf);
