[PATCH] usb: gadget: fastboot: correctly cap rx_bytes_expected() result

[PATCH] usb: gadget: fastboot: correctly cap rx_bytes_expected() result

[Ahmad Fatoum]

The function only ever returns an unsigned value and
fastboot.download_{size,bytes} are both unsigned values too.

Storing their difference into an int may possibly lead to misbehavior,
so fix the types to ensure no overflow can happen.

Signed-off-by: Ahmad Fatoum <a.fatoum@barebox.org>
---
 drivers/usb/gadget/function/f_fastboot.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/gadget/function/f_fastboot.c b/drivers/usb/gadget/function/f_fastboot.c
index 85732802ff80..8f7390fd2403 100644
--- a/drivers/usb/gadget/function/f_fastboot.c
+++ b/drivers/usb/gadget/function/f_fastboot.c
@@ -445,10 +445,10 @@ static int fastboot_write_usb(struct fastboot *fb, const char *buffer, unsigned
 	return 0;
 }
 
-static int rx_bytes_expected(struct f_fastboot *f_fb)
+static unsigned rx_bytes_expected(struct f_fastboot *f_fb)
 {
-	int remaining = f_fb->fastboot.download_size
-		      - f_fb->fastboot.download_bytes;
+	size_t remaining = f_fb->fastboot.download_size
+			 - f_fb->fastboot.download_bytes;
 
 	if (remaining >= EP_BUFFER_SIZE)
 		return EP_BUFFER_SIZE;
-- 
2.47.3

Re: [PATCH] usb: gadget: fastboot: correctly cap rx_bytes_expected() result

[Sascha Hauer]

On Sun, 25 Oct 2026 17:01:37 +0100, Ahmad Fatoum wrote:
> The function only ever returns an unsigned value and
> fastboot.download_{size,bytes} are both unsigned values too.
> 
> Storing their difference into an int may possibly lead to misbehavior,
> so fix the types to ensure no overflow can happen.
> 
> 
> [...]

Applied, thanks!

[1/1] usb: gadget: fastboot: correctly cap rx_bytes_expected() result
      https://git.pengutronix.de/cgit/barebox/commit/?id=0d9d229fd497 (link may not be stable)

Best regards,
-- 
Sascha Hauer <s.hauer@pengutronix.de>