scarlett2_hwdep_write() rejects writes when offset + count is greater than
or equal to the selected flash segment size. That incorrectly treats a
write ending exactly at the end of the segment as out of space, although
the last byte written is still within the segment.

Split invalid argument checks from the segment-space check, keep
zero-length writes as no-ops, and compare count against the remaining
segment size. This permits exact-end writes and avoids relying on
offset + count before deciding whether the request is in bounds.

Fixes: 1abfbd3c9527 ("ALSA: scarlett2: Add support for uploading new firmware")
Cc: stable@vger.kernel.org
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
---
 sound/usb/mixer_scarlett2.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/sound/usb/mixer_scarlett2.c b/sound/usb/mixer_scarlett2.c
index 7c43ca51938e..78fb72e626ca 100644
--- a/sound/usb/mixer_scarlett2.c
+++ b/sound/usb/mixer_scarlett2.c
@@ -9634,12 +9634,15 @@ static long scarlett2_hwdep_write(struct snd_hwdep *hw,
 	flash_size = private->flash_segment_blocks[segment_id] *
 		     SCARLETT2_FLASH_BLOCK_SIZE;
 
-	if (count < 0 || *offset < 0 || *offset + count >= flash_size)
-		return -ENOSPC;
+	if (count < 0 || *offset < 0)
+		return -EINVAL;
 
 	if (!count)
 		return 0;
 
+	if (*offset >= flash_size || count > flash_size - *offset)
+		return -ENOSPC;
+
 	/* Limit the *req size to SCARLETT2_FLASH_RW_MAX */
 	if (count > max_data_size)
 		count = max_data_size;

---
base-commit: 9b14f636834630e5473ee5020c8289823a481a7c
change-id: 20260429-alsa-scarlett2-flash-write-boundary-af4579904965

Best regards,
--  
Cássio Gabriel <cassiogabrielcontato@gmail.com>

On Tue, 19 May 2026 16:46:19 +0200,
Cássio Gabriel wrote:
> 
> scarlett2_hwdep_write() rejects writes when offset + count is greater than
> or equal to the selected flash segment size. That incorrectly treats a
> write ending exactly at the end of the segment as out of space, although
> the last byte written is still within the segment.
> 
> Split invalid argument checks from the segment-space check, keep
> zero-length writes as no-ops, and compare count against the remaining
> segment size. This permits exact-end writes and avoids relying on
> offset + count before deciding whether the request is in bounds.
> 
> Fixes: 1abfbd3c9527 ("ALSA: scarlett2: Add support for uploading new firmware")
> Cc: stable@vger.kernel.org
> Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>

Applied now.  Thanks.


Takashi