diff --git a/arch/x86/kernel/pci-gart_64.c b/arch/x86/kernel/pci-gart_64.c
index ae7e0161ce46e9e1eacbca8c2cb24a5a599456b9..79b514b381b1476acd8559f18e6c0019b0c19910 100644
--- a/arch/x86/kernel/pci-gart_64.c
+++ b/arch/x86/kernel/pci-gart_64.c
@@ -435,7 +435,7 @@ static int gart_map_sg(struct device *dev, struct scatterlist *sg, int nents,
 
 error:
 	flush_gart();
-	gart_unmap_sg(dev, sg, nents, dir);
+	gart_unmap_sg(dev, sg, out, dir);
 	/* When it was forced or merged try again in a dumb way */
 	if (force_iommu || iommu_merge) {
 		out = dma_map_sg_nonforce(dev, sg, nents, dir);
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 081e3dfb64d485e9382d253add9ae07a03f4651e..7ef515b3382d5f662ff0267d48852622a1e48a08 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4689,6 +4689,7 @@ static int ata_sg_setup(struct ata_queued_cmd *qc)
 		 * data in this function or read data in ata_sg_clean.
 		 */
 		offset = lsg->offset + lsg->length - qc->pad_len;
+		sg_init_table(psg, 1);
 		sg_set_page(psg, nth_page(sg_page(lsg), offset >> PAGE_SHIFT),
 				qc->pad_len, offset_in_page(offset));
 
diff --git a/drivers/mmc/host/imxmmc.c b/drivers/mmc/host/imxmmc.c
index fc72e1fadb6adf291356e796d16cc3e036d764c5..f2070a19cfa77fe25ff57aad4d60d54a90864a27 100644
--- a/drivers/mmc/host/imxmmc.c
+++ b/drivers/mmc/host/imxmmc.c
@@ -262,7 +262,7 @@ static void imxmci_setup_data(struct imxmci_host *host, struct mmc_data *data)
 		}
 
 		/* Convert back to virtual address */
-		host->data_ptr = (u16*)sg_virt(sg);
+		host->data_ptr = (u16*)sg_virt(data->sg);
 		host->data_cnt = 0;
 
 		clear_bit(IMXMCI_PEND_DMA_DATA_b, &host->pending_events);
diff --git a/drivers/s390/scsi/zfcp_def.h b/drivers/s390/scsi/zfcp_def.h
index 0754542978b68b91f92b1dcbd91ad7a8cac9e4f6..e268f79bdbd232de9f81edb5b8d6e291998051d2 100644
--- a/drivers/s390/scsi/zfcp_def.h
+++ b/drivers/s390/scsi/zfcp_def.h
@@ -70,11 +70,12 @@ zfcp_sg_to_address(struct scatterlist *list)
  * zfcp_address_to_sg - set up struct scatterlist from kernel address
  * @address: kernel address
  * @list: struct scatterlist
+ * @size: buffer size
  */
 static inline void
-zfcp_address_to_sg(void *address, struct scatterlist *list)
+zfcp_address_to_sg(void *address, struct scatterlist *list, unsigned int size)
 {
-	sg_set_buf(list, address, 0);
+	sg_set_buf(list, address, size);
 }
 
 #define REQUEST_LIST_SIZE 128
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index b5fa4f091387eb83cdc9009e2050d0062fa9201f..f1871ea0404573e610ef439e8d377d0b4a7a1419 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -1652,6 +1652,7 @@ sg_build_sgat(Sg_scatter_hold * schp, const Sg_fd * sfp, int tablesize)
 	schp->buffer = kzalloc(sg_bufflen, gfp_flags);
 	if (!schp->buffer)
 		return -ENOMEM;
+	sg_init_table(schp->buffer, tablesize);
 	schp->sglist_len = sg_bufflen;
 	return tablesize;	/* number of scat_gath elements allocated */
 }
diff --git a/include/linux/scatterlist.h b/include/linux/scatterlist.h
index 45712317138973ad8147ed0567c30bb4d62da55a..32326c293d7bfbd0c9fe318ce4f5143258bed65a 100644
--- a/include/linux/scatterlist.h
+++ b/include/linux/scatterlist.h
@@ -150,7 +150,7 @@ static inline struct scatterlist *sg_last(struct scatterlist *sgl,
 	struct scatterlist *ret = &sgl[nents - 1];
 #else
 	struct scatterlist *sg, *ret = NULL;
-	int i;
+	unsigned int i;
 
 	for_each_sg(sgl, sg, nents, i)
 		ret = sg;
@@ -179,7 +179,11 @@ static inline void sg_chain(struct scatterlist *prv, unsigned int prv_nents,
 #ifndef ARCH_HAS_SG_CHAIN
 	BUG();
 #endif
-	prv[prv_nents - 1].page_link = (unsigned long) sgl | 0x01;
+	/*
+	 * Set lowest bit to indicate a link pointer, and make sure to clear
+	 * the termination bit if it happens to be set.
+	 */
+	prv[prv_nents - 1].page_link = ((unsigned long) sgl | 0x01) & ~0x02;
 }
 
 /**
@@ -239,7 +243,7 @@ static inline void sg_init_table(struct scatterlist *sgl, unsigned int nents)
 	sg_mark_end(sgl, nents);
 #ifdef CONFIG_DEBUG_SG
 	{
-		int i;
+		unsigned int i;
 		for (i = 0; i < nents; i++)
 			sgl[i].sg_magic = SG_MAGIC;
 	}