scsi: sd: Protect against READ(6) or WRITE(6) with zero block transfer length

Since the READ(6) and WRITE(6) commands interpret a zero in the transfer
length field in the CDB as 256 logical blocks, avoid submitting such
commands.

Cc: Douglas Gilbert <[e-mail]>
Cc: Hannes Reinecke <[e-mail]>
Cc: Christoph Hellwig <[e-mail]>
Reported-by: Douglas Gilbert <[e-mail]>
Signed-off-by: Bart Van Assche <[e-mail]>
Reviewed-by: Douglas Gilbert <[e-mail]>
Reviewed-by: Hannes Reinecke <[e-mail]>
Signed-off-by: Martin K. Petersen <[e-mail]>

drivers/scsi/sd.c

···
 				      sector_t lba, unsigned int nr_blocks,
 				      unsigned char flags)
 {
+	/* Avoid that 0 blocks gets translated into 256 blocks. */
+	if (WARN_ON_ONCE(nr_blocks == 0))
+		return BLK_STS_IOERR;
+
 	if (unlikely(flags & 0x8)) {
 		/*
 		 * This happens only if this drive failed 10byte rw