SUNRPC: Prevent length underflow in read_flush()

Make sure we compare an unsigned length to an unsigned count in
read_flush().

Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>

1 files changed, 5 insertions, 5 deletions

diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 73f053d0cc7a..d27bbe0ee907 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -1244,18 +1244,18 @@ static ssize_t read_flush(struct file *file, char __user *buf,
         struct cache_detail *cd = PDE(file->f_path.dentry->d_inode)->data;
         char tbuf[20];
         unsigned long p = *ppos;
-        int len;
+        size_t len;
 
         sprintf(tbuf, "%lu\n", cd->flush_time);
         len = strlen(tbuf);
         if (p >= len)
                 return 0;
         len -= p;
-        if (len > count) len = count;
+        if (len > count)
+                len = count;
         if (copy_to_user(buf, (void*)(tbuf+p), len))
-                len = -EFAULT;
-        else
-                *ppos += len;
+                return -EFAULT;
+        *ppos += len;
         return len;
 }