sg: set dxferp to NULL for READ with the older SG interface

With the older SG interface, we don't know a user-space address to
trasfer data when executing a SCSI command. So we can't pass a
user-space address to blk_rq_map_user.

This patch fixes sg to pass a NULL user-space address to
blk_rq_map_user so that it just sets up a request and bios with page
frames propely without data transfer.

Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

1 files changed, 4 insertions, 1 deletions

diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index ed69292babde..50c07bca727d 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -615,7 +615,10 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
         else
                 hp->dxfer_direction = (mxsize > 0) ? SG_DXFER_FROM_DEV : SG_DXFER_NONE;
         hp->dxfer_len = mxsize;
-        hp->dxferp = (char __user *)buf + cmd_size;
+        if (hp->dxfer_direction == SG_DXFER_TO_DEV)
+                hp->dxferp = (char __user *)buf + cmd_size;
+        else
+                hp->dxferp = NULL;
         hp->sbp = NULL;
         hp->timeout = old_hdr.reply_len;        /* structure abuse ... */
         hp->flags = input_size; /* structure abuse ... */