nr_segs is unsigned long and thus cannot be negative. We checked against 0 few lines before. Signed-off-by: Carsten Otte <cotte@de.ibm.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
@@ -470,7 +470,7 @@ static ssize_t do_readv_writev(int type, struct file *file,
* verify all the pointers
*/
ret = -EINVAL;
- if ((nr_segs > UIO_MAXIOV) || (nr_segs <= 0))
+ if (nr_segs > UIO_MAXIOV)
goto out;
if (!file->f_op)