Length undergoes type conversion when passed (indirectly) as an
argument for parameter of type 'unsigned int'. If length is negative
this is a bug (the value after conversion is large).
Declare 'length' to be an unsigned type instead of a signed type.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Tobin C. Harding <me@tobin.cc> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>