diff --git a/[refs] b/[refs]
index ea0641068572..2f1661e7172e 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 818827669d85b84241696ffef2de485db46b0b5e
+refs/heads/master: fad7f01e61bf737fe8a3740d803f000db57ecac6
diff --git a/trunk/drivers/scsi/sg.c b/trunk/drivers/scsi/sg.c
index ed69292babde..50c07bca727d 100644
--- a/trunk/drivers/scsi/sg.c
+++ b/trunk/drivers/scsi/sg.c
@@ -615,7 +615,10 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
 	else
 		hp->dxfer_direction = (mxsize > 0) ? SG_DXFER_FROM_DEV : SG_DXFER_NONE;
 	hp->dxfer_len = mxsize;
-	hp->dxferp = (char __user *)buf + cmd_size;
+	if (hp->dxfer_direction == SG_DXFER_TO_DEV)
+		hp->dxferp = (char __user *)buf + cmd_size;
+	else
+		hp->dxferp = NULL;
 	hp->sbp = NULL;
 	hp->timeout = old_hdr.reply_len;	/* structure abuse ... */
 	hp->flags = input_size;	/* structure abuse ... */