Re: bug report: sd: off by one in sd_read_block_limits()

["Martin K. Petersen" <martin.petersen@oracle.com>]

>>>>> "Dan" == Dan Carpenter <error27@gmail.com> writes:

Dan> drivers/scsi/sd.c +1986 sd_read_block_limits(39) warn: buffer
Dan> overflow 'buffer' 32 <= 32
Dan>   1951 const int vpd_len = 32;

sd: Fix block limits VPD page length

Commit e3deec09 incorrectly assumed that the page length was limited to
32 bytes.  The B0 VPD page length is defined to be 60 bytes when the
device supports thin provisioning.

Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

---

diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 1dd4d84..3ed2644 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1948,7 +1948,7 @@ static void sd_read_block_limits(struct scsi_disk *sdkp)
 {
 	struct request_queue *q = sdkp->disk->queue;
 	unsigned int sector_sz = sdkp->device->sector_size;
-	const int vpd_len = 32;
+	const int vpd_len = 60;
 	unsigned char *buffer = kmalloc(vpd_len, GFP_KERNEL);
 
 	if (!buffer ||