diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 90fbd5c300f0..c9c946bb7804 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -353,6 +353,9 @@ sg_read(struct file *filp, char __user *buf, size_t count, loff_t * ppos)
 	struct sg_header *old_hdr = NULL;
 	int retval = 0;
 
+	if (unlikely(segment_eq(get_fs(), KERNEL_DS)))
+		return -EINVAL;
+
 	if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
 		return -ENXIO;
 	SCSI_LOG_TIMEOUT(3, printk("sg_read: %s, count=%d\n",