target: Don't call TFO->write_pending if data_length == 0
authorRoland Dreier <roland@purestorage.com>
Tue, 14 Oct 2014 21:16:24 +0000 (14:16 -0700)
committerDanny Wood <danwood76@gmail.com>
Tue, 29 Jan 2019 13:05:19 +0000 (13:05 +0000)
commit5a6ca32c3dc134f20a9c99fd0ad5848ed3c0d718
treea39575ea97f9e0be889c09d032913c57ea8b86c1
parent27042e08388c0a24ed08de013e498a5e662b9c3c
target: Don't call TFO->write_pending if data_length == 0

commit 885e7b0e181c14e4d0ddd26c688bad2b84c1ada9 upstream.

If an initiator sends a zero-length command (e.g. TEST UNIT READY) but
sets the transfer direction in the transport layer to indicate a
data-out phase, we still shouldn't try to transfer data.  At best it's
a NOP, and depending on the transport, we might crash on an
uninitialized sg list.

Reported-by: Craig Watson <craig.watson@vanguard-rugged.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/target/target_core_transport.c