From: Andrea Arcangeli <andrea@suse.de>

Correctly range-check an incoming-from-userspace argument.  Found by the
Stanford checker.