[libata scsi] fix read/write translation edge cases

Fix bugs for unlikely edge cases noticed by Douglas Gilbert:

- When READ(6)/WRITE(6) sector count == 0, treat it as 256 sectors

- For other READ(x)/WRITE(x), when sector count == 0, error.
  We don't support successfully completing zero-length transfers at
  this time.

diff --git a/drivers/scsi/libata-scsi.c b/drivers/scsi/libata-scsi.c
index f58311b8c050980e2e86456fc2d165b79fd5180c..4074e7877ba36fb45559d43cd8e7d9ecb624789e 100644 (file)
--- a/drivers/scsi/libata-scsi.c
+++ b/drivers/scsi/libata-scsi.c
@@ -630,11 +630,19 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc, u8 *scsicmd)
                tf->lbah = scsicmd[3];
 
                VPRINTK("ten-byte command\n");
+               if (qc->nsect == 0) /* we don't support length==0 cmds */
+                       return 1;
                return 0;
        }
 
        if (scsicmd[0] == READ_6 || scsicmd[0] == WRITE_6) {
                qc->nsect = tf->nsect = scsicmd[4];
+               if (!qc->nsect) {
+                       qc->nsect = 256;
+                       if (lba48)
+                               tf->hob_nsect = 1;
+               }
+
                tf->lbal = scsicmd[3];
                tf->lbam = scsicmd[2];
                tf->lbah = scsicmd[1] & 0x1f; /* mask out reserved bits */
@@ -674,6 +682,8 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc, u8 *scsicmd)
                tf->lbah = scsicmd[7];
 
                VPRINTK("sixteen-byte command\n");
+               if (qc->nsect == 0) /* we don't support length==0 cmds */
+                       return 1;
                return 0;
        }