[PATCH] scsi: handle zero-length requests

From: Jens Axboe <axboe@suse.de>

The command 'eject /dev/scd0' sends a START_STOP command to the device with
the data direction set to SCSI_DATA_WRITE but a transfer length of zero.
This causes a problem for some code paths.

diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
index 4bc7ceb3a20f915b98afd4d3dd0ebe6dda7941db..004ed053d621c91baf6390e5bc06b3ec03ee3537 100644 (file)
--- a/drivers/scsi/sr.c
+++ b/drivers/scsi/sr.c
@@ -289,12 +289,12 @@ static int sr_init_command(struct scsi_cmnd * SCpnt)
                        return 0;
 
                memcpy(SCpnt->cmnd, rq->cmd, sizeof(SCpnt->cmnd));
-               if (rq_data_dir(rq) == WRITE)
+               if (!rq->data_len)
+                       SCpnt->sc_data_direction = SCSI_DATA_NONE;
+               else if (rq_data_dir(rq) == WRITE)
                        SCpnt->sc_data_direction = SCSI_DATA_WRITE;
-               else if (rq->data_len)
-                       SCpnt->sc_data_direction = SCSI_DATA_READ;
                else
-                       SCpnt->sc_data_direction = SCSI_DATA_NONE;
+                       SCpnt->sc_data_direction = SCSI_DATA_READ;
 
                this_count = rq->data_len;
                if (rq->timeout)