--- /dev/null
+From stable-bounces@linux.kernel.org Wed Jun 7 21:15:48 2006
+Date: Thu, 8 Jun 2006 00:03:28 -0400
+From: Chuck Ebbert <76306.1226@compuserve.com>
+To: linux-stable <stable@kernel.org>
+Cc: James Bottomley <James.Bottomley@steeleye.com>, Brian Holty <lgeek@frontiernet.net>
+Subject: scsi_lib.c: properly count the number of pages in scsi_req_map_sg()
+
+From: James Bottomley <jejb@mulgrave.il.steeleye.com>
+
+The calculation of nr_pages in scsi_req_map_sg() doesn't account for
+the fact that the first page could have an offset that pushes the end
+of the buffer onto a new page.
+
+Signed-off-by: Bryan Holty <lgeek@frontiernet.net>
+Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+
+ drivers/scsi/scsi_lib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.16.20.orig/drivers/scsi/scsi_lib.c
++++ linux-2.6.16.20/drivers/scsi/scsi_lib.c
+@@ -368,7 +368,7 @@ static int scsi_req_map_sg(struct reques
+ int nsegs, unsigned bufflen, gfp_t gfp)
+ {
+ struct request_queue *q = rq->q;
+- int nr_pages = (bufflen + PAGE_SIZE - 1) >> PAGE_SHIFT;
++ int nr_pages = (bufflen + sgl[0].offset + PAGE_SIZE - 1) >> PAGE_SHIFT;
+ unsigned int data_len = 0, len, bytes, off;
+ struct page *page;
+ struct bio *bio = NULL;