diff
<   cmd_buf = memdup_user(buffer, count + 1);
---
>   size_t user_buf_size = /* function to get user buffer size */;
>   if (count > user_buf_size)
>       count = user_buf_size;
>   cmd_buf = memdup_user(buffer, count + 1);
