6 files changed, 14 insertions, 7 deletions

diff --git a/arch/x86/kernel/pci-gart_64.c b/arch/x86/kernel/pci-gart_64.c
index ae7e0161ce46..79b514b381b1 100644
--- a/arch/x86/kernel/pci-gart_64.c
+++ b/arch/x86/kernel/pci-gart_64.c
@@ -435,7 +435,7 @@ static int gart_map_sg(struct device *dev, struct scatterlist *sg, int nents,
 
 error:
         flush_gart();
-        gart_unmap_sg(dev, sg, nents, dir);
+        gart_unmap_sg(dev, sg, out, dir);
         /* When it was forced or merged try again in a dumb way */
         if (force_iommu || iommu_merge) {
                 out = dma_map_sg_nonforce(dev, sg, nents, dir);
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 081e3dfb64d4..7ef515b3382d 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4689,6 +4689,7 @@ static int ata_sg_setup(struct ata_queued_cmd *qc)
                  * data in this function or read data in ata_sg_clean.
                  */
                 offset = lsg->offset + lsg->length - qc->pad_len;
+                sg_init_table(psg, 1);
                 sg_set_page(psg, nth_page(sg_page(lsg), offset >> PAGE_SHIFT),
                                 qc->pad_len, offset_in_page(offset));
 
diff --git a/drivers/mmc/host/imxmmc.c b/drivers/mmc/host/imxmmc.c
index fc72e1fadb6a..f2070a19cfa7 100644
--- a/drivers/mmc/host/imxmmc.c
+++ b/drivers/mmc/host/imxmmc.c
@@ -262,7 +262,7 @@ static void imxmci_setup_data(struct imxmci_host *host, struct mmc_data *data)
                 }
 
                 /* Convert back to virtual address */
-                host->data_ptr = (u16*)sg_virt(sg);
+                host->data_ptr = (u16*)sg_virt(data->sg);
                 host->data_cnt = 0;
 
                 clear_bit(IMXMCI_PEND_DMA_DATA_b, &host->pending_events);
diff --git a/drivers/s390/scsi/zfcp_def.h b/drivers/s390/scsi/zfcp_def.h
index 0754542978b6..e268f79bdbd2 100644
--- a/drivers/s390/scsi/zfcp_def.h
+++ b/drivers/s390/scsi/zfcp_def.h
@@ -70,11 +70,12 @@ zfcp_sg_to_address(struct scatterlist *list)
  * zfcp_address_to_sg - set up struct scatterlist from kernel address
  * @address: kernel address
  * @list: struct scatterlist
+ * @size: buffer size
  */
 static inline void
-zfcp_address_to_sg(void *address, struct scatterlist *list)
+zfcp_address_to_sg(void *address, struct scatterlist *list, unsigned int size)
 {
-        sg_set_buf(list, address, 0);
+        sg_set_buf(list, address, size);
 }
 
 #define REQUEST_LIST_SIZE 128
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index b5fa4f091387..f1871ea04045 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -1652,6 +1652,7 @@ sg_build_sgat(Sg_scatter_hold * schp, const Sg_fd * sfp, int tablesize)
         schp->buffer = kzalloc(sg_bufflen, gfp_flags);
         if (!schp->buffer)
                 return -ENOMEM;
+        sg_init_table(schp->buffer, tablesize);
         schp->sglist_len = sg_bufflen;
         return tablesize;       /* number of scat_gath elements allocated */
 }
diff --git a/include/linux/scatterlist.h b/include/linux/scatterlist.h
index 457123171389..32326c293d7b 100644
--- a/include/linux/scatterlist.h
+++ b/include/linux/scatterlist.h
@@ -150,7 +150,7 @@ static inline struct scatterlist *sg_last(struct scatterlist *sgl,
         struct scatterlist *ret = &sgl[nents - 1];
 #else
         struct scatterlist *sg, *ret = NULL;
-        int i;
+        unsigned int i;
 
         for_each_sg(sgl, sg, nents, i)
                 ret = sg;
@@ -179,7 +179,11 @@ static inline void sg_chain(struct scatterlist *prv, unsigned int prv_nents,
 #ifndef ARCH_HAS_SG_CHAIN
         BUG();
 #endif
-        prv[prv_nents - 1].page_link = (unsigned long) sgl | 0x01;
+        /*
+         * Set lowest bit to indicate a link pointer, and make sure to clear
+         * the termination bit if it happens to be set.
+         */
+        prv[prv_nents - 1].page_link = ((unsigned long) sgl | 0x01) & ~0x02;
 }
 
 /**
@@ -239,7 +243,7 @@ static inline void sg_init_table(struct scatterlist *sgl, unsigned int nents)
         sg_mark_end(sgl, nents);
 #ifdef CONFIG_DEBUG_SG
         {
-                int i;
+                unsigned int i;
                 for (i = 0; i < nents; i++)
                         sgl[i].sg_magic = SG_MAGIC;
         }