[dezgeg]

One correction to the strncpy_from_user part, specifically this:

> The process could try to read another process’s memory by giving a pointer that maps into another process’s address space.

This cannot happen, there is no such thing as "a pointer that maps into another process's address space". A virtual address in Linux (on x86 and probably almost all arches) accesses either the processes own memory map (where access to unmapped addresses causes a fault even when done from ring 0) or the kernel virtual mapping.