diff --git a/[refs] b/[refs]
index 16eefe8ab425..12cf91564162 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: a737b88df8d0b4476ae53daaa6db137df0541203
+refs/heads/master: 3094141c6532a4f748425c21c091001f218da8ae
diff --git a/trunk/drivers/scsi/sg.c b/trunk/drivers/scsi/sg.c
index 2968c6b83ddb..78d616315d8e 100644
--- a/trunk/drivers/scsi/sg.c
+++ b/trunk/drivers/scsi/sg.c
@@ -1686,14 +1686,9 @@ static int sg_start_req(Sg_request *srp, unsigned char *cmd)
 		int len, size = sizeof(struct sg_iovec) * iov_count;
 		struct iovec *iov;
 
-		iov = kmalloc(size, GFP_ATOMIC);
-		if (!iov)
-			return -ENOMEM;
-
-		if (copy_from_user(iov, hp->dxferp, size)) {
-			kfree(iov);
-			return -EFAULT;
-		}
+		iov = memdup_user(hp->dxferp, size);
+		if (IS_ERR(iov))
+			return PTR_ERR(iov);
 
 		len = iov_length(iov, iov_count);
 		if (hp->dxfer_len < len) {