--- drivers/scsi/sd.c

+++ drivers/scsi/sd.c

@@ -1040,6 +1040,12 @@ static unsigned int sd_completed_bytes(s

u64 end_lba = blk_rq_pos(scmd->request) + (scsi_bufflen(scmd) / 512);

u64 bad_lba;

int info_valid;

+ /*

+ * resid is optional but mostly filled in. When it's unused,

+ * its value is zero, so we assume the whole buffer transferred

+ */

+ unsigned int transferred = scsi_bufflen(scmd) - scsi_get_resid(scmd);

+ unsigned int good_bytes;

if (!blk_fs_request(scmd->request))

return 0;

@@ -1073,7 +1079,8 @@ static unsigned int sd_completed_bytes(s

/* This computation should always be done in terms of

* the resolution of the device's medium.

*/

- return (bad_lba - start_lba) * scmd->device->sector_size;

+ good_bytes = (bad_lba - start_lba) * scmd->device->sector_size;

+ return min(good_bytes, transferred);

}

/**

@@ -2049,11 +2056,10 @@ static void sd_probe_async(void *data, a

index = sdkp->index;

dev = &sdp->sdev_gendev;

- if (index < SD_MAX_DISKS) {

- gd->major = sd_major((index & 0xf0) >> 4);

- gd->first_minor = ((index & 0xf) << 4) | (index & 0xfff00);

- gd->minors = SD_MINORS;

- }

+ gd->major = sd_major((index & 0xf0) >> 4);

+ gd->first_minor = ((index & 0xf) << 4) | (index & 0xfff00);

+ gd->minors = SD_MINORS;

+

gd->fops = &sd_fops;

gd->private_data = &sdkp->driver;

gd->queue = sdkp->device->request_queue;

@@ -2142,6 +2148,12 @@ static int sd_probe(struct device *dev)

if (error)

goto out_put;

+ if (index >= SD_MAX_DISKS) {

+ error = -ENODEV;

+ sdev_printk(KERN_WARNING, sdp, "SCSI disk (sd) name space exhausted.\n");

+ goto out_free_index;

+ }

+

error = sd_format_disk_name("sd", index, gd->disk_name, DISK_NAME_LEN);

if (error)

goto out_free_index;