From: Randy Dunlap With CONFIG_LBD=n, 'sz' (32 bits) can overflow when capacity is multiplied (even * 2), as seen in a report from Dale Blount on lkml. Also make sure that 'mb' will not overflow. Signed-off-by: Randy Dunlap Signed-off-by: Andrew Morton --- drivers/scsi/sd.c | 9 +++++---- 1 files changed, 5 insertions(+), 4 deletions(-) diff -puN drivers/scsi/sd.c~scsi-disk-report-size-without-overflow drivers/scsi/sd.c --- devel/drivers/scsi/sd.c~scsi-disk-report-size-without-overflow 2005-10-20 21:15:57.000000000 -0700 +++ devel-akpm/drivers/scsi/sd.c 2005-10-20 21:15:57.000000000 -0700 @@ -49,6 +49,7 @@ #include #include #include +#include #include #include @@ -1253,16 +1254,16 @@ got_data: * Jacques Gelinas (Jacques@solucorp.qc.ca) */ int hard_sector = sector_size; - sector_t sz = sdkp->capacity * (hard_sector/256); + u64 sz = sdkp->capacity * (hard_sector/256); request_queue_t *queue = sdp->request_queue; - sector_t mb; + u64 mb; blk_queue_hardsect_size(queue, hard_sector); /* avoid 64-bit division on 32-bit platforms */ mb = sz >> 1; - sector_div(sz, 1250); + do_div(sz, 1250); mb -= sz - 974; - sector_div(mb, 1950); + do_div(mb, 1950); printk(KERN_NOTICE "SCSI device %s: " "%llu %d-byte hdwr sectors (%llu MB)\n", _