diff
< 	cmd_buf = memdup_user(buf, count);
---
> 	if (count > sizeof(user_val))
> 		return -EINVAL;
> 	cmd_buf = memdup_user(buf, sizeof(user_val));
