it is the use of unsafe_put_user without access_ok(), not access_ok() alone