This can overflow. loadsize needs to be max, not min so that it is capped at sizeof(cpuset_t).

This should be using mp_maxid, not smp_cpus to account for sparse CPU IDs. However, all this really needs to verify is what the old check was doing. Other code will catch if we have bits set that can fit into a cpuset_t that are > mp_maxid. What this check needs to verify instead is that userland hasn't set bits that don't fit into the kernel's cpuset_t. In that case, the existing code that used sizeof(cpuset_t) directly in place of factsize is correct. However, since the malloc above now (correctly) is capped to only cpuset_t, you can't check the extra bits directly from mask. Instead, you need to be fetching the words from userland explicitly via fueword() or the like, so something like:

if (cpusetsize > sizeof(cpuset_t)) {
    char *end;
    char *cp;
    int val;

    end = cp = (char *)&maskp->__bits;
    end += cpusetsize;
    cp += sizeof(cpuset_t);
    while (cp  != end) {
        val = fubyte(cp);
        if (val == -1) {
            error = EFAULT;
            goto out;
        } else if (val != 0) {
            error = EINVAL;
            goto out;
        }
        cp++;
    }
}

(It may be worth trying to fetch words first if possible rather than fetching bytes by adding a second loop before the first one that uses while (cp + sizeof(long) < end) and using fueword instead of fubyte.)