kernel.git/drivers/usb/gadget/function/f_midi.c, branch linux-4.9.y

USB: gadget: f_midi: setup SuperSpeed Plus descriptors

2020-12-29T12:44:51Z

commit 457a902ba1a73b7720666b21ca038cd19764db18 upstream. Needed for SuperSpeed Plus support for f_midi. This allows the gadget to work properly without crashing at SuperSpeed rates. Cc: Felipe Balbi Cc: stable Signed-off-by: Will McVicker Reviewed-by: Peter Chen Link: https://lore.kernel.org/r/20201127140559.381351-4-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman

usb: gadget: f_midi: Fix memleak in f_midi_alloc

2020-12-02T07:31:28Z

commit e7694cb6998379341fd9bf3bd62b48c4e6a79385 upstream. In the error path, if midi is not null, we should free the midi->id if necessary to prevent memleak. Fixes: b85e9de9e818d ("usb: gadget: f_midi: convert to new function interface with backward compatibility") Reported-by: Hulk Robot Signed-off-by: Zhang Qilong Link: https://lore.kernel.org/r/20201117021629.1470544-2-zhangqilong3@huawei.com Cc: stable Signed-off-by: Greg Kroah-Hartman

USB: gadget: f_midi: fixing a possible double-free in f_midi

2018-04-24T07:34:10Z

commit 7fafcfdf6377b18b2a726ea554d6e593ba44349f upstream. It looks like there is a possibility of a double-free vulnerability on an error path of the f_midi_set_alt function in the f_midi driver. If the path is feasible then free_ep_req gets called twice: req->complete = f_midi_complete; err = usb_ep_queue(midi->out_ep, req, GFP_ATOMIC); => ... usb_gadget_giveback_request => f_midi_complete (CALLBACK) (inside f_midi_complete, for various cases of status) free_ep_req(ep, req); // first kfree if (err) { ERROR(midi, "%s: couldn't enqueue request: %d\n", midi->out_ep->name, err); free_ep_req(midi->out_ep, req); // second kfree return err; } The double-free possibility was introduced with commit ad0d1a058eac ("usb: gadget: f_midi: fix leak on failed to enqueue out requests"). Found by MOXCAFE tool. Signed-off-by: Tuba Yavuz Fixes: ad0d1a058eac ("usb: gadget: f_midi: fix leak on failed to enqueue out requests") Acked-by: Felipe Balbi Cc: stable Signed-off-by: Greg Kroah-Hartman

usb: gadget: remove useless parameter in alloc_ep_req()

2016-08-25T09:13:19Z

The default_length parameter of alloc_ep_req was not really necessary and gadget drivers would almost always create an inline function to pass the same value to len and default_len. This patch removes that parameter and updates all calls to alloc_ep_req() to use the new API. Signed-off-by: Felipe F. Tonello Signed-off-by: Felipe Balbi

usb: gadget: f_midi: drop substreams when disabling endpoint

2016-08-25T09:13:15Z

This change makes sure that the ALSA buffers are cleaned if an endpoint becomes disabled. Before this change, if the internal ALSA buffer did overflow, the MIDI function would stop sending MIDI to the host. Signed-off-by: Felipe F. Tonello Signed-off-by: Felipe Balbi

usb: gadget: f_midi: refactor state machine

2016-08-25T09:13:15Z

This refactor results in a cleaner state machine code and promotes consistency, readability, and maintanability of this driver. This refactor state machine was well tested and it is currently running in production code and devices. Signed-off-by: Felipe F. Tonello Signed-off-by: Felipe Balbi

usb: gadget: f_midi: defaults buflen sizes to 512

2016-08-25T09:13:15Z

512 is the value used by wMaxPacketSize, as specified by the USB Spec. This makes sure this driver uses, by default, the most optimal value for IN and OUT endpoint requests. Signed-off-by: Felipe F. Tonello Signed-off-by: Felipe Balbi

usb: gadget: f_midi: remove alignment code for OUT endpoint

2016-08-25T09:13:14Z

The new version of alloc_ep_req() already aligns the buffer size to wMaxPacketSize on OUT endpoints. Signed-off-by: Felipe F. Tonello Signed-off-by: Felipe Balbi

usb: gadget: f_midi: unlock on error

2016-04-04T12:18:37Z

We added some new locking here, but missed an error path where we need to unlock. Fixes: 9acdf4df2fc4 ('usb: gadget: f_midi: added spinlock on transmit function') Acked-by: Michal Nazarewicz Acked-by: Felipe F. Tonello Signed-off-by: Dan Carpenter Signed-off-by: Felipe Balbi

usb: gadget: f_midi: Fixed a bug when buflen was smaller than wMaxPacketSize

2016-03-30T10:49:56Z

buflen by default (256) is smaller than wMaxPacketSize (512) in high-speed devices. That caused the OUT endpoint to freeze if the host send any data packet of length greater than 256 bytes. This is an example dump of what happended on that enpoint: HOST: [DATA][Length=260][...] DEVICE: [NAK] HOST: [PING] DEVICE: [NAK] HOST: [PING] DEVICE: [NAK] ... HOST: [PING] DEVICE: [NAK] This patch fixes this problem by setting the minimum usb_request's buffer size for the OUT endpoint as its wMaxPacketSize. Acked-by: Michal Nazarewicz Signed-off-by: Felipe F. Tonello Signed-off-by: Felipe Balbi