On Sun, Sep 13, 2020 at 08:02:35PM +0530, Souptick Joarder wrote: > It is possible that a buggy caller of unpin_user_pages() > (specially in error handling path) may end up calling it with > npages < 0 which is unnecessary. > @@ -328,6 +328,9 @@ void unpin_user_pages(struct page **pages, unsigned long npages) > { > unsigned long index; > > + if (WARN_ON_ONCE(npages < 0)) > + return; But npages is unsigned long. So it can't be less than zero.