Merge branch 'upstream'

diff --cc drivers/scsi/libata-scsi.c
index 094c9c88a095944b18dc9e9d4cebe324fc7074d3,cfbceb5047183e3096bb494bc3e2419c8956cd93..0e65bfe92e6fd7c860a14bddf71b51d00abd3989
--- 1/drivers/scsi/libata-scsi.c
--- 2/drivers/scsi/libata-scsi.c
+++ b/drivers/scsi/libata-scsi.c
@@@ -1132,11 -1152,18 +1152,12 @@@ static unsigned int ata_scsi_rw_xlat(st
                        tf->hob_lbah = (block >> 40) & 0xff;
                        tf->hob_lbam = (block >> 32) & 0xff;
                        tf->hob_lbal = (block >> 24) & 0xff;
 -              } else { 
 -                      /* use LBA28 */
 -
 -                      /* The request -may- be too large for LBA28. */
 -                      if ((block >> 28) || (n_block > 256))
 -                              goto out_of_range;
 -
 -                      tf->device |= (block >> 24) & 0xf;
 -              }
 +              } else
 +                      /* request too large even for LBA48 */
 +                      goto out_of_range;
  
-               ata_rwcmd_protocol(qc);
+               if (unlikely(ata_rwcmd_protocol(qc) < 0))
+                       goto invalid_fld;
  
                qc->nsect = n_block;
                tf->nsect = n_block & 0xff;
@@@ -1151,10 -1178,11 +1172,11 @@@
                u32 sect, head, cyl, track;
  
                /* The request -may- be too large for CHS addressing. */
 -              if ((block >> 28) || (n_block > 256))
 +              if (!lba_28_ok(block, n_block))
                        goto out_of_range;
  
-               ata_rwcmd_protocol(qc);
+               if (unlikely(ata_rwcmd_protocol(qc) < 0))
+                       goto invalid_fld;
  
                /* Convert LBA to CHS */
                track = (u32)block / dev->sectors;

diff --cc include/linux/ata.h
Simple merge