[PATCH] usb: gadget: fastboot: correctly cap rx_bytes_expected() result

Ahmad Fatoum a.fatoum at barebox.org
Sun Oct 25 09:01:37 PDT 2026


The function only ever returns an unsigned value and
fastboot.download_{size,bytes} are both unsigned values too.

Storing their difference into an int may possibly lead to misbehavior,
so fix the types to ensure no overflow can happen.

Signed-off-by: Ahmad Fatoum <a.fatoum at barebox.org>
---
 drivers/usb/gadget/function/f_fastboot.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/gadget/function/f_fastboot.c b/drivers/usb/gadget/function/f_fastboot.c
index 85732802ff80..8f7390fd2403 100644
--- a/drivers/usb/gadget/function/f_fastboot.c
+++ b/drivers/usb/gadget/function/f_fastboot.c
@@ -445,10 +445,10 @@ static int fastboot_write_usb(struct fastboot *fb, const char *buffer, unsigned
 	return 0;
 }
 
-static int rx_bytes_expected(struct f_fastboot *f_fb)
+static unsigned rx_bytes_expected(struct f_fastboot *f_fb)
 {
-	int remaining = f_fb->fastboot.download_size
-		      - f_fb->fastboot.download_bytes;
+	size_t remaining = f_fb->fastboot.download_size
+			 - f_fb->fastboot.download_bytes;
 
 	if (remaining >= EP_BUFFER_SIZE)
 		return EP_BUFFER_SIZE;
-- 
2.47.3




More information about the barebox mailing list