[SCSI] fix write buffer length in scsi_req_map_sg()