[PATCH] scsi: handle zero-length requests

From: Jens Axboe <axboe@suse.de>

The command 'eject /dev/scd0' sends a START_STOP command to the device with
the data direction set to SCSI_DATA_WRITE but a transfer length of zero.
This causes a problem for some code paths.

drivers/scsi/sr.c

@@ -289,12 +289,12 @@ static int sr_init_command(struct scsi_cmnd * SCpnt)
 			return 0;
 
 		memcpy(SCpnt->cmnd, rq->cmd, sizeof(SCpnt->cmnd));
-		if (rq_data_dir(rq) == WRITE)
+		if (!rq->data_len)
+			SCpnt->sc_data_direction = SCSI_DATA_NONE;
+		else if (rq_data_dir(rq) == WRITE)
 			SCpnt->sc_data_direction = SCSI_DATA_WRITE;
-		else if (rq->data_len)
-			SCpnt->sc_data_direction = SCSI_DATA_READ;
 		else
-			SCpnt->sc_data_direction = SCSI_DATA_NONE;
+			SCpnt->sc_data_direction = SCSI_DATA_READ;
 
 		this_count = rq->data_len;
 		if (rq->timeout)