dvb_ca_en50221_io_write() derives fraglen from sl->link_buf_size, a
value negotiated with the CAM in dvb_ca_en50221_link_init() and only
ever clamped on the high end against HOST_LINK_BUF_SIZE. The loop
guards against a negative fraglen (link_buf_size < 2) but not against
fraglen == 0 (link_buf_size == 2 exactly): "fragpos += fraglen" at the
bottom of the loop then adds zero, so fragpos never reaches count and
the write() never returns while a positive count remains to be sent.
Treat a non-positive fraglen the same as a negative one and stop
fragmenting, consistent with how the existing check already handles
link_buf_size < 2.
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
---
drivers/media/dvb-core/dvb_ca_en50221.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb-core/dvb_ca_en50221.c
index 1b91ebb8f667..9131f62c1258 100644
--- a/drivers/media/dvb-core/dvb_ca_en50221.c
+++ b/drivers/media/dvb-core/dvb_ca_en50221.c
@@ -1487,7 +1487,7 @@ static ssize_t dvb_ca_en50221_io_write(struct file *file,
/* fragment the packets & store in the buffer */
while (fragpos < count) {
fraglen = sl->link_buf_size - 2;
- if (fraglen < 0)
+ if (fraglen <= 0)
break;
if (fraglen > HOST_LINK_BUF_SIZE - 2)
fraglen = HOST_LINK_BUF_SIZE - 2;
--
2.55.0