[PATCH] SG_SET_RESERVED_SIZE negative oops

I propose the 2.6.0-test8 two-line patch below to teach
SG_SET_RESERVED_SIZE to reject a negative size, rather than oops-ing.

drivers/block/scsi_ioctl.c

@@ -124,6 +124,8 @@ static int sg_set_reserved_size(request_queue_t *q, int *p)
 	if (err)
 		return err;
 
+	if (size < 0)
+		return -EINVAL;
 	if (size > (q->max_sectors << 9))
 		return -EINVAL;
 

drivers/scsi/sg.c

@@ -877,6 +877,8 @@ sg_ioctl(struct inode *inode, struct file *filp,
 		result = get_user(val, (int *) arg);
 		if (result)
 			return result;
+		if (val < 0)
+			return -EINVAL;
 		if (val != sfp->reserve.bufflen) {
 			if (sg_res_in_use(sfp) || sfp->mmap_called)
 				return -EBUSY;