diff --git a/[refs] b/[refs]
index 490b40e404b9..ccae9917bf7b 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 53bd6a601a87bb6d0df844872bc15fd4e8d127ce
+refs/heads/master: 997694defd085f4dd168c6e7e0e82382c5be9db4
diff --git a/trunk/drivers/usb/gadget/inode.c b/trunk/drivers/usb/gadget/inode.c
index a38b6af2c358..4655522a08d9 100644
--- a/trunk/drivers/usb/gadget/inode.c
+++ b/trunk/drivers/usb/gadget/inode.c
@@ -1015,7 +1015,7 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
 			else {
 				len = min (len, (size_t)dev->req->actual);
 // FIXME don't call this with the spinlock held ...
-				if (copy_to_user (buf, &dev->req->buf, len))
+				if (copy_to_user (buf, dev->req->buf, len))
 					retval = -EFAULT;
 				clean_req (dev->gadget->ep0, dev->req);
 				/* NOTE userspace can't yet choose to stall */