diff options
| -rw-r--r-- | drivers/scsi/sg.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c index ed69292babde..50c07bca727d 100644 --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c | |||
| @@ -615,7 +615,10 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos) | |||
| 615 | else | 615 | else |
| 616 | hp->dxfer_direction = (mxsize > 0) ? SG_DXFER_FROM_DEV : SG_DXFER_NONE; | 616 | hp->dxfer_direction = (mxsize > 0) ? SG_DXFER_FROM_DEV : SG_DXFER_NONE; |
| 617 | hp->dxfer_len = mxsize; | 617 | hp->dxfer_len = mxsize; |
| 618 | hp->dxferp = (char __user *)buf + cmd_size; | 618 | if (hp->dxfer_direction == SG_DXFER_TO_DEV) |
| 619 | hp->dxferp = (char __user *)buf + cmd_size; | ||
| 620 | else | ||
| 621 | hp->dxferp = NULL; | ||
| 619 | hp->sbp = NULL; | 622 | hp->sbp = NULL; |
| 620 | hp->timeout = old_hdr.reply_len; /* structure abuse ... */ | 623 | hp->timeout = old_hdr.reply_len; /* structure abuse ... */ |
| 621 | hp->flags = input_size; /* structure abuse ... */ | 624 | hp->flags = input_size; /* structure abuse ... */ |