[PATCH] usb: Fix timeout detection in usb_control_msg

[Marek Vasut]

On 7/2/26 3:59 PM, Francois Berder wrote:
> The loop exits once timeout variable reaches 0.
> However, due to the post-decrement operator, timeout
> is decremented and set to -1 upon exiting the loop
> if a timeout occurs. This means that:
>    - a break in the last loop iteration was considered
>    a timeout
>    - actual timeouts did not return -ETIMEDOUT
> 
> Fix comparing timeout variable to -1 instead of 0 to
> detect timeouts.
> 
> Found with smatch.
> 
> Fixes: 2fc8638403c7 ("usb: Assimilate usb_get_descriptor() to linux")
> Signed-off-by: Francois Berder <fberder at outlook.fr>
> ---
>   common/usb.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/common/usb.c b/common/usb.c
> index 6a4ad346f4b..5905b2b5d7b 100644
> --- a/common/usb.c
> +++ b/common/usb.c
> @@ -259,7 +259,7 @@ int usb_control_msg(struct usb_device *dev, unsigned int pipe,
>   		mdelay(1);
>   	}
>   
> -	if (timeout == 0)
> +	if (timeout == -1)
>   		return -ETIMEDOUT;
Please rewrite this to use read*_poll_timeout() instead of this fragile 
obsolete ad-hoc polling.

Thank you !