already in 2.6


diff -urN 28rc1/drivers/net/tun.c 28rc1_aac/drivers/net/tun.c
--- 28rc1/drivers/net/tun.c	2004-08-08 02:26:05.000000000 +0300
+++ 28rc1_aac/drivers/net/tun.c	2004-10-24 00:58:10.000000000 +0300
@@ -188,7 +188,7 @@
 	size_t len = count;
 
 	if (!(tun->flags & TUN_NO_PI)) {
-		if ((len -= sizeof(pi)) < 0)
+		if ((len -= sizeof(pi)) > len)
 			return -EINVAL;
 
 		memcpy_fromiovec((void *)&pi, iv, sizeof(pi));