target: Don't call TFO->write_pending if data_length == 0
authorRoland Dreier <roland@purestorage.com>
Tue, 14 Oct 2014 21:16:24 +0000 (14:16 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 6 Dec 2014 23:55:38 +0000 (15:55 -0800)
commit20a1d763e503d4b54dfebb0d6977d867dadb2103
treeb283cf90cbd45763fb9003950941677f846d2e02
parenta5d7c9df4beacdbca74adc8fe3e5b34c789d3b12
target: Don't call TFO->write_pending if data_length == 0

commit 885e7b0e181c14e4d0ddd26c688bad2b84c1ada9 upstream.

If an initiator sends a zero-length command (e.g. TEST UNIT READY) but
sets the transfer direction in the transport layer to indicate a
data-out phase, we still shouldn't try to transfer data.  At best it's
a NOP, and depending on the transport, we might crash on an
uninitialized sg list.

Reported-by: Craig Watson <craig.watson@vanguard-rugged.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/target/target_core_transport.c