target: Don't call TFO->write_pending if data_length == 0
authorRoland Dreier <roland@purestorage.com>
Tue, 14 Oct 2014 21:16:24 +0000 (14:16 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 6 Dec 2014 23:05:49 +0000 (15:05 -0800)
commitadbde413d06062edf380d4aad15caf32492e4872
treefcb0202c65522c0db56044991dabf88f8c1cd600
parent4b5ba6a22b7a4afe1f3e57d8f462c80c77cb8599
target: Don't call TFO->write_pending if data_length == 0

commit 885e7b0e181c14e4d0ddd26c688bad2b84c1ada9 upstream.

If an initiator sends a zero-length command (e.g. TEST UNIT READY) but
sets the transfer direction in the transport layer to indicate a
data-out phase, we still shouldn't try to transfer data.  At best it's
a NOP, and depending on the transport, we might crash on an
uninitialized sg list.

Reported-by: Craig Watson <craig.watson@vanguard-rugged.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/target/target_core_transport.c