[S390] keyboard: integer underflow bug

The "ct" variable should be an unsigned int. Both struct kbdiacrs
->kb_cnt and struct kbd_data ->accent_table_size are unsigned ints.

Making it signed causes a problem in KBDIACRUC because the user could
set the signed bit and cause a buffer overflow.

Cc: <[e-mail]>
Signed-off-by: Dan Carpenter <[e-mail]>
Signed-off-by: Martin Schwidefsky <[e-mail]>

drivers/s390/char/keyboard.c

···
 	  unsigned int cmd, unsigned long arg)
 {
 	void __user *argp;
-	int ct, perm;
+	unsigned int ct;
+	int perm;
 
 	argp = (void __user *)arg;