From: Jens Axboe <axboe@suse.de>

The command 'eject /dev/scd0' sends a START_STOP command to the device with
the data direction set to SCSI_DATA_WRITE but a transfer length of zero. 
This causes a problem for some code paths.



 drivers/scsi/sr.c |    8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

diff -puN drivers/scsi/sr.c~scsi-handle-zero-length-requests drivers/scsi/sr.c
--- 25/drivers/scsi/sr.c~scsi-handle-zero-length-requests	2003-09-29 01:13:10.000000000 -0700
+++ 25-akpm/drivers/scsi/sr.c	2003-09-29 01:13:10.000000000 -0700
@@ -289,12 +289,12 @@ static int sr_init_command(struct scsi_c
 			return 0;
 
 		memcpy(SCpnt->cmnd, rq->cmd, sizeof(SCpnt->cmnd));
-		if (rq_data_dir(rq) == WRITE)
+		if (!rq->data_len)
+			SCpnt->sc_data_direction = SCSI_DATA_NONE;
+		else if (rq_data_dir(rq) == WRITE)
 			SCpnt->sc_data_direction = SCSI_DATA_WRITE;
-		else if (rq->data_len)
-			SCpnt->sc_data_direction = SCSI_DATA_READ;
 		else
-			SCpnt->sc_data_direction = SCSI_DATA_NONE;
+			SCpnt->sc_data_direction = SCSI_DATA_READ;
 
 		this_count = rq->data_len;
 		if (rq->timeout)

_