1 files changed, 18 insertions, 6 deletions

diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index ffa0689ee840..c52273c1327a 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1153,6 +1153,12 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
         u64 end_lba = blk_rq_pos(scmd->request) + (scsi_bufflen(scmd) / 512);
         u64 bad_lba;
         int info_valid;
+        /*
+         * resid is optional but mostly filled in.  When it's unused,
+         * its value is zero, so we assume the whole buffer transferred
+         */
+        unsigned int transferred = scsi_bufflen(scmd) - scsi_get_resid(scmd);
+        unsigned int good_bytes;
 
         if (scmd->request->cmd_type != REQ_TYPE_FS)
                 return 0;
@@ -1186,7 +1192,8 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
         /* This computation should always be done in terms of
          * the resolution of the device's medium.
          */
-        return (bad_lba - start_lba) * scmd->device->sector_size;
+        good_bytes = (bad_lba - start_lba) * scmd->device->sector_size;
+        return min(good_bytes, transferred);
 }
 
 /**
@@ -2252,11 +2259,10 @@ static void sd_probe_async(void *data, async_cookie_t cookie)
         index = sdkp->index;
         dev = &sdp->sdev_gendev;
 
-        if (index < SD_MAX_DISKS) {
-                gd->major = sd_major((index & 0xf0) >> 4);
-                gd->first_minor = ((index & 0xf) << 4) | (index & 0xfff00);
-                gd->minors = SD_MINORS;
-        }
+        gd->major = sd_major((index & 0xf0) >> 4);
+        gd->first_minor = ((index & 0xf) << 4) | (index & 0xfff00);
+        gd->minors = SD_MINORS;
+
         gd->fops = &sd_fops;
         gd->private_data = &sdkp->driver;
         gd->queue = sdkp->device->request_queue;
@@ -2346,6 +2352,12 @@ static int sd_probe(struct device *dev)
         if (error)
                 goto out_put;
 
+        if (index >= SD_MAX_DISKS) {
+                error = -ENODEV;
+                sdev_printk(KERN_WARNING, sdp, "SCSI disk (sd) name space exhausted.\n");
+                goto out_free_index;
+        }
+
         error = sd_format_disk_name("sd", index, gd->disk_name, DISK_NAME_LEN);
         if (error)
                 goto out_free_index;