[PATCH] media: dvb_ca_en50221: bail out of write loop on non-positive fraglen

[PATCH] media: dvb_ca_en50221: bail out of write loop on non-positive fraglen

[Muhammad Bilal]

dvb_ca_en50221_io_write() derives fraglen from sl->link_buf_size, a
value negotiated with the CAM in dvb_ca_en50221_link_init() and only
ever clamped on the high end against HOST_LINK_BUF_SIZE. The loop
guards against a negative fraglen (link_buf_size < 2) but not against
fraglen == 0 (link_buf_size == 2 exactly): "fragpos += fraglen" at the
bottom of the loop then adds zero, so fragpos never reaches count and
the write() never returns while a positive count remains to be sent.

Treat a non-positive fraglen the same as a negative one and stop
fragmenting, consistent with how the existing check already handles
link_buf_size < 2.

Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
---
 drivers/media/dvb-core/dvb_ca_en50221.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb-core/dvb_ca_en50221.c
index 1b91ebb8f667..9131f62c1258 100644
--- a/drivers/media/dvb-core/dvb_ca_en50221.c
+++ b/drivers/media/dvb-core/dvb_ca_en50221.c
@@ -1487,7 +1487,7 @@ static ssize_t dvb_ca_en50221_io_write(struct file *file,
 	/* fragment the packets & store in the buffer */
 	while (fragpos < count) {
 		fraglen = sl->link_buf_size - 2;
-		if (fraglen < 0)
+		if (fraglen <= 0)
 			break;
 		if (fraglen > HOST_LINK_BUF_SIZE - 2)
 			fraglen = HOST_LINK_BUF_SIZE - 2;
-- 
2.55.0