From mboxrd@z Thu Jan  1 00:00:00 1970
From: Dan Carpenter <dan.carpenter@oracle.com>
Subject: [patch] compat_ioctl: cleanup a type in do_i2c_rdwr_ioctl()
Date: Wed, 24 Oct 2012 10:11:47 +0300
Message-ID: <20121024071146.GA2536@elgon.mountain>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Cc: linux-fsdevel@vger.kernel.org, kernel-janitors@vger.kernel.org
To: Alexander Viro <viro@zeniv.linux.org.uk>
Return-path: <linux-fsdevel-owner@vger.kernel.org>
Received: from rcsinet15.oracle.com ([148.87.113.117]:32688 "EHLO
	rcsinet15.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S934374Ab2JXHLy (ORCPT
	<rfc822;linux-fsdevel@vger.kernel.org>);
	Wed, 24 Oct 2012 03:11:54 -0400
Content-Disposition: inline
Sender: linux-fsdevel-owner@vger.kernel.org
List-ID: <linux-fsdevel.vger.kernel.org>

We check that:

        if (nmsgs > I2C_RDRW_IOCTL_MAX_MSGS)
                return -EINVAL;

Since "nmsgs" is signed, it means the check can underflow.  It's
harmless, but messy.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index f505402..f4222a4 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -680,7 +680,8 @@ static int do_i2c_rdwr_ioctl(unsigned int fd, unsigned int cmd,
 	struct i2c_msg			__user *tmsgs;
 	struct i2c_msg32		__user *umsgs;
 	compat_caddr_t			datap;
-	int				nmsgs, i;
+	unsigned int			nmsgs;
+	int				i;
 
 	if (get_user(nmsgs, &udata->nmsgs))
 		return -EFAULT;