Description of problem:
A system crash (backtrace below) consistently occurs on RHEL5 when using the 
scsi passthru/scatter gather driver. The same code works on RHEL4 (all updates).

THE PROBLEM WAS FIXED IN LINUX 2.6.19 IN THE sg_build_indirect ROUTINE IN THE 
FILE driver/scsi/sg.c. THE LINE 

              sg->length = ret_sz;
WAS CHANGED TO
              sg->length = (ret_sz > num) ? num : ret_sz;

We normally use kernels/drivers as provided by RedHat (not compiled from 
source). We built a kernel with the above change and the i/o completed rather 
than a system crash, essentially confirming the fix.


Version-Release number of selected component (if applicable):
# uname  -r
2.6.18-8.1.6.el5

# cat /proc/scsi/sg/version
30534   3.5.34 [20060920]


How reproducible:
Use the scsi passthru/scatter-gather driver to write data to tape when the last 
block is not a multiple of a page size.

Steps to Reproduce:
1. Write to tape using, for example, /dev/sg3
2. We wrote (op code 0A) 100,000,000 bytes (rather than 1024k, which works okay)
3. We used a block size of 512k. The data in the last block was 385280 bytes.
  
Actual results:
consistent crashes with the following backtrace:
PID: 12349  TASK: ffff81005398f080  CPU: 0   COMMAND: "fs_fmover"
 #0 [ffff810055921af0] die at ffffffff80069457
 #1 [ffff810055921b20] do_general_protection at ffffffff800632e5
 #2 [ffff810055921b60] error_exit at ffffffff8005be1d
    [exception RIP: kmem_cache_free+95]
    RIP: ffffffff800074ff  RSP: ffff810055921c18  RFLAGS: 00010286
    RAX: c3c031c3c031c3c0  RBX: ffff810057d42f40  RCX: 00000000000fe000
    RDX: c3c033804031c3c0  RSI: 000001bc80000000  RDI: 00000000000007f0
    RBP: ffff81007f5d6f40   R8: 0000000000000000   R9: 0000000000000400
    R10: 0000000000001000  R11: ffffffff80042baf  R12: ffff810037fa9100
    R13: 0000000000000000  R14: 0000000000001000  R15: ffff8100554cb5f8
    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
 #3 [ffff810055921c50] bio_free at ffffffff80040046
 #4 [ffff810055921c70] scsi_execute_async at ffffffff88079310
 #5 [ffff810055921d20] sg_common_write at ffffffff881c6f5a
 #6 [ffff810055921e00] sg_new_write at ffffffff881c7216
 #7 [ffff810055921e60] sg_ioctl at ffffffff881c8c07
 #8 [ffff810055921ee0] do_ioctl at ffffffff8003fc73
 #9 [ffff810055921f00] vfs_ioctl at ffffffff8002fa45
#10 [ffff810055921f40] sys_ioctl at ffffffff8004a24b
#11 [ffff810055921f80] tracesys at ffffffff8005b2c1 (via system_call)

Expected results:
Data written to tape

Additional info:
A fix/hotfix is needed for our customers to use our product on RHEL5.