copy_from_user() where copy_to_user() should've been.  Unfortunately, on
x86 they are almost identical, so it went unnoticed for quite a while.