mm/mempolicy.c: make copy_from_user() provably correct