From 3c661ea3db850723c8691133c673b9a98e62d7e3 Mon Sep 17 00:00:00 2001 From: FUJITA Tomonori Date: Tue, 2 Sep 2008 16:20:20 +0900 Subject: [PATCH] --- yaml --- r: 110516 b: refs/heads/master c: fad7f01e61bf737fe8a3740d803f000db57ecac6 h: refs/heads/master v: v3 --- [refs] | 2 +- trunk/drivers/scsi/sg.c | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/[refs] b/[refs] index ea0641068572..2f1661e7172e 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: 818827669d85b84241696ffef2de485db46b0b5e +refs/heads/master: fad7f01e61bf737fe8a3740d803f000db57ecac6 diff --git a/trunk/drivers/scsi/sg.c b/trunk/drivers/scsi/sg.c index ed69292babde..50c07bca727d 100644 --- a/trunk/drivers/scsi/sg.c +++ b/trunk/drivers/scsi/sg.c @@ -615,7 +615,10 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos) else hp->dxfer_direction = (mxsize > 0) ? SG_DXFER_FROM_DEV : SG_DXFER_NONE; hp->dxfer_len = mxsize; - hp->dxferp = (char __user *)buf + cmd_size; + if (hp->dxfer_direction == SG_DXFER_TO_DEV) + hp->dxferp = (char __user *)buf + cmd_size; + else + hp->dxferp = NULL; hp->sbp = NULL; hp->timeout = old_hdr.reply_len; /* structure abuse ... */ hp->flags = input_size; /* structure abuse ... */