--- linux/include/scsi/sg.h	2002-05-06 01:39:07.000000000 +1000
+++ linux/include/scsi/sg.h3125	2003-05-29 11:09:55.000000000 +1000
@@ -9,11 +9,13 @@
 Original driver (sg.h):
 *       Copyright (C) 1992 Lawrence Foard
 Version 2 and 3 extensions to driver:
-*       Copyright (C) 1998 - 2002 Douglas Gilbert
+*       Copyright (C) 1998 - 2003 Douglas Gilbert
 
-    Version: 3.1.24 (20020505)
+    Version: 3.1.25 (20030529)
     This version is for 2.4 series kernels.
 
+    Changes since 3.1.24 (20020505)
+	- fix side effect introduced by last "off by one" fix
     Changes since 3.1.23 (20020318)
 	- off by one fix for last scatter gather element
 	- zero buffer obtained for non-root users
--- linux/drivers/scsi/sg.c	2003-05-29 13:23:48.000000000 +1000
+++ linux/drivers/scsi/sg.c3125	2003-05-29 14:53:00.000000000 +1000
@@ -7,7 +7,7 @@
  * Original driver (sg.c):
  *        Copyright (C) 1992 Lawrence Foard
  * Version 2 and 3 extensions to driver:
- *        Copyright (C) 1998 - 2002 Douglas Gilbert
+ *        Copyright (C) 1998 - 2003 Douglas Gilbert
  *
  *  Modified  19-JAN-1998  Richard Gooch <rgooch@atnf.csiro.au>  Devfs support
  *
@@ -19,9 +19,9 @@
  */
 #include <linux/config.h>
 #ifdef CONFIG_PROC_FS
- static char * sg_version_str = "Version: 3.1.24 (20020505)";
+ static char * sg_version_str = "Version: 3.1.25 (20030529)";
 #endif
- static int sg_version_num = 30124; /* 2 digits for each component */
+ static int sg_version_num = 30125; /* 2 digits for each component */
 /*
  *  D. P. Gilbert (dgilbert@interlog.com, dougg@triode.net.au), notes:
  *      - scsi logging is available via SCSI_LOG_TIMEOUT macros. First
@@ -1884,11 +1884,7 @@
 	    res = sg_u_iovec(hp, iovec_count, j, 1, &usglen, &up);
 	    if (res) return res;
 
-	    for (; k < schp->k_use_sg; ++k, ++sclp) {
-		ksglen = (int)sclp->length;
-		p = sclp->address;
-		if (NULL == p)
-		    break;
+	    for ( ; p; ++sclp, ksglen = (int)sclp->length, p = sclp->address) {
 		ok = (SG_USER_MEM != mem_src_arr[k]);
 		if (usglen <= 0)
 		    break;
@@ -1911,6 +1907,9 @@
 		    up += ksglen;
 		    usglen -= ksglen;
 		}
+                ++k;
+                if (k >= schp->k_use_sg)
+                    return 0;
             }
         }
     }
@@ -2040,11 +2039,7 @@
 	    res = sg_u_iovec(hp, iovec_count, j, 0, &usglen, &up);
 	    if (res) return res;
 
-	    for (; k < schp->k_use_sg; ++k, ++sclp) {
-		ksglen = (int)sclp->length;
-		p = sclp->address;
-		if (NULL == p)
-		    break;
+	    for ( ; p; ++sclp, ksglen = (int)sclp->length, p = sclp->address) {
 		ok = (SG_USER_MEM != mem_src_arr[k]);
 		if (usglen <= 0)
 		    break;
@@ -2067,6 +2062,9 @@
 		    up += ksglen;
 		    usglen -= ksglen;
 		}
+                ++k;
+                if (k >= schp->k_use_sg)
+                    return 0;
 	    }
 	}
     }