1 files changed, 13 insertions, 5 deletions

diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 4e607d3065bc..34f9343ed0af 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -18,8 +18,8 @@
  *
  */
 
-static int sg_version_num = 30533;      /* 2 digits for each component */
-#define SG_VERSION_STR "3.5.33"
+static int sg_version_num = 30534;      /* 2 digits for each component */
+#define SG_VERSION_STR "3.5.34"
 
 /*
  *  D. P. Gilbert (dgilbert@interlog.com, dougg@triode.net.au), notes:
@@ -60,7 +60,7 @@ static int sg_version_num = 30533;	/* 2 digits for each component */
 
 #ifdef CONFIG_SCSI_PROC_FS
 #include <linux/proc_fs.h>
-static char *sg_version_date = "20050908";
+static char *sg_version_date = "20060818";
 
 static int sg_proc_init(void);
 static void sg_proc_cleanup(void);
@@ -1164,7 +1164,7 @@ sg_vma_nopage(struct vm_area_struct *vma, unsigned long addr, int *type)
                 len = vma->vm_end - sa;
                 len = (len < sg->length) ? len : sg->length;
                 if (offset < len) {
-                        page = sg->page;
+                        page = virt_to_page(page_address(sg->page) + offset);
                         get_page(page); /* increment page count */
                         break;
                 }
@@ -1401,6 +1401,7 @@ sg_add(struct class_device *cl_dev, struct class_interface *cl_intf)
         Sg_device *sdp = NULL;
         struct cdev * cdev = NULL;
         int error, k;
+        unsigned long iflags;
 
         disk = alloc_disk(1);
         if (!disk) {
@@ -1428,7 +1429,7 @@ sg_add(struct class_device *cl_dev, struct class_interface *cl_intf)
 
         error = cdev_add(cdev, MKDEV(SCSI_GENERIC_MAJOR, k), 1);
         if (error)
-                goto out;
+                goto cdev_add_err;
 
         sdp->cdev = cdev;
         if (sg_sysfs_valid) {
@@ -1455,6 +1456,13 @@ sg_add(struct class_device *cl_dev, struct class_interface *cl_intf)
 
         return 0;
 
+cdev_add_err:
+        write_lock_irqsave(&sg_dev_arr_lock, iflags);
+        kfree(sg_dev_arr[k]);
+        sg_dev_arr[k] = NULL;
+        sg_nr_dev--;
+        write_unlock_irqrestore(&sg_dev_arr_lock, iflags);
+
 out:
         put_disk(disk);
         if (cdev)