rds: signedness bug

In the original code if the copy_from_user() fails in rds_rdma_pages()
then the error handling fails and we get a stack trace from kmalloc().

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/rds/rdma.c b/net/rds/rdma.c
index 48064673fc76dc7b19792fe3d5a7bcb49592ef98..1a41debca1ce6aa6d57d7c6fda1e135c7babdf30 100644 (file)
--- a/net/rds/rdma.c
+++ b/net/rds/rdma.c
@@ -522,7 +522,7 @@ int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm,
        struct rds_rdma_args *args;
        struct rds_iovec vec;
        struct rm_rdma_op *op = &rm->rdma;
-       unsigned int nr_pages;
+       int nr_pages;
        unsigned int nr_bytes;
        struct page **pages = NULL;
        struct rds_iovec __user *local_vec;