Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6: (48 commits)
  [SCSI] aacraid: do not set valid bit in sense information
  [SCSI] ses: add new Enclosure ULD
  [SCSI] enclosure: add support for enclosure services
  [SCSI] sr: fix test unit ready responses
  [SCSI] u14-34f: fix data direction bug
  [SCSI] aacraid: pci_set_dma_max_seg_size opened up for late model controllers
  [SCSI] fix BUG when sum(scatterlist) > bufflen
  [SCSI] arcmsr: updates (1.20.00.15)
  [SCSI] advansys: make 3 functions static
  [SCSI] Small cleanups for scsi_host.h
  [SCSI] dc395x: fix uninitialized var warning
  [SCSI] NCR53C9x: remove driver
  [SCSI] remove m68k NCR53C9x based drivers
  [SCSI] dec_esp: Remove driver
  [SCSI] kernel-doc: fix scsi docbook
  [SCSI] update my email address
  [SCSI] add protocol definitions
  [SCSI] sd: handle bad lba in sense information
  [SCSI] qla2xxx: Update version number to 8.02.00-k8.
  [SCSI] qla2xxx: Correct issue where incorrect init-fw mailbox command was used on non-NPIV capable ISPs.
  ...

1 files changed, 16 insertions, 18 deletions

diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 51a5557f42dd..37df8bbe7f46 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -929,6 +929,7 @@ static int sd_done(struct scsi_cmnd *SCpnt)
         unsigned int xfer_size = scsi_bufflen(SCpnt);
         unsigned int good_bytes = result ? 0 : xfer_size;
         u64 start_lba = SCpnt->request->sector;
+        u64 end_lba = SCpnt->request->sector + (xfer_size / 512);
         u64 bad_lba;
         struct scsi_sense_hdr sshdr;
         int sense_valid = 0;
@@ -967,26 +968,23 @@ static int sd_done(struct scsi_cmnd *SCpnt)
                         goto out;
                 if (xfer_size <= SCpnt->device->sector_size)
                         goto out;
-                switch (SCpnt->device->sector_size) {
-                case 256:
+                if (SCpnt->device->sector_size < 512) {
+                        /* only legitimate sector_size here is 256 */
                         start_lba <<= 1;
-                        break;
-                case 512:
-                        break;
-                case 1024:
-                        start_lba >>= 1;
-                        break;
-                case 2048:
-                        start_lba >>= 2;
-                        break;
-                case 4096:
-                        start_lba >>= 3;
-                        break;
-                default:
-                        /* Print something here with limiting frequency. */
-                        goto out;
-                        break;
+                        end_lba <<= 1;
+                } else {
+                        /* be careful ... don't want any overflows */
+                        u64 factor = SCpnt->device->sector_size / 512;
+                        do_div(start_lba, factor);
+                        do_div(end_lba, factor);
                 }
+
+                if (bad_lba < start_lba  || bad_lba >= end_lba)
+                        /* the bad lba was reported incorrectly, we have
+                         * no idea where the error is
+                         */
+                        goto out;
+
                 /* This computation should always be done in terms of
                  * the resolution of the device's medium.
                  */