This patch corrects the error handling of copy_to_user() and adds more
error checks. It also fixes two reference counting bugs.

Noticed by Andi Kleen <ak@suse.de>