hermas_bap_pread,  hermes_bap_pwrite, and hermes_bap_pwrite_pad all have a parameter "len" that is declared unsigned,
but checked for a value less than zero. Auditing the callers, it is possible for len to be passed a negative value, so len should be an int.

Thanks to LinuxICC (http://linuxicc.sf.net)
Signed-off-by: Gabriel A. Devenyi <ace@staticwave.ca>
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>