--- drivers/scsi/sd.c

+++ drivers/scsi/sd.c

@@ -2049,11 +2049,10 @@ static void sd_probe_async(void *data, a

index = sdkp->index;

dev = &sdp->sdev_gendev;

- if (index < SD_MAX_DISKS) {

- gd->major = sd_major((index & 0xf0) >> 4);

- gd->first_minor = ((index & 0xf) << 4) | (index & 0xfff00);

- gd->minors = SD_MINORS;

- }

+ gd->major = sd_major((index & 0xf0) >> 4);

+ gd->first_minor = ((index & 0xf) << 4) | (index & 0xfff00);

+ gd->minors = SD_MINORS;

+

gd->fops = &sd_fops;

gd->private_data = &sdkp->driver;

gd->queue = sdkp->device->request_queue;

@@ -2142,6 +2141,12 @@ static int sd_probe(struct device *dev)

if (error)

goto out_put;

+ if (index >= SD_MAX_DISKS) {

+ error = -ENODEV;

+ sdev_printk(KERN_WARNING, sdp, "SCSI disk (sd) name space exhausted.\n");

+ goto out_free_index;

+ }

+

error = sd_format_disk_name("sd", index, gd->disk_name, DISK_NAME_LEN);

if (error)

goto out_free_index;