Currently, the midi function is not freed until it is
both removed from the config and released by the user.
Since the user could take a long time to release the
card, it's possible that the function could be unlinked
and thus f_midi_opts would be null when freeing f_midi.

Thus, refcount f_midi_opts and only free it when it is
unlinked and all f_midis have been freed.
Signed-off-by: NJerry Zhang <zhangjerry@google.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

It looks like there is a possibility of a double-free vulnerability on an
error path of the f_midi_set_alt function in the f_midi driver. If the
path is feasible then free_ep_req gets called twice:

         req->complete = f_midi_complete;
         err = usb_ep_queue(midi->out_ep, req, GFP_ATOMIC);
            => ...
             usb_gadget_giveback_request
               =>
                 f_midi_complete (CALLBACK)
                   (inside f_midi_complete, for various cases of status)
                   free_ep_req(ep, req); // first kfree
         if (err) {
                 ERROR(midi, "%s: couldn't enqueue request: %d\n",
                             midi->out_ep->name, err);
                 free_ep_req(midi->out_ep, req); // second kfree
                 return err;
         }

The double-free possibility was introduced with commit ad0d1a05
("usb: gadget: f_midi: fix leak on failed to enqueue out requests").

Found by MOXCAFE tool.
Signed-off-by: NTuba Yavuz <tuba@ece.ufl.edu>
Fixes: ad0d1a05 ("usb: gadget: f_midi: fix leak on failed to enqueue out requests")
Acked-by: NFelipe Balbi <felipe.balbi@linux.intel.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Now that the SPDX tag is in all USB files, that identifies the license
in a specific and legally-defined manner.  So the extra GPL text wording
can be removed as it is no longer needed at all.

This is done on a quest to remove the 700+ different ways that files in
the kernel describe the GPL license text.  And there's unneeded stuff
like the address (sometimes incorrect) for the FSF which is never
needed.

No copyright headers or other non-license-description text was removed.

Cc: Oliver Neukum <oneukum@suse.com>
Cc: Johan Hovold <johan@kernel.org>
Cc: Jerry Zhang <zhangjerry@google.com>
Cc: John Keeping <john@metanate.com>
Cc: Krzysztof Opasiak <k.opasiak@samsung.com>
Cc: Abdulhadi Mohamed <abdulahhadi2@gmail.com>
Cc: Matthew Wilcox <willy@linux.intel.com>
Cc: Janusz Dziedzic <januszx.dziedzic@linux.intel.com>
Acked-by: NFelipe Balbi <felipe.balbi@linux.intel.com>
Acked-by: NMichal Nazarewicz <mina86@mina86.com>
Acked-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: NVincent Pelletier <plr.vincent@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

It's good to have SPDX identifiers in all files to make it easier to
audit the kernel tree for correct licenses.

Update the drivers/usb/ and include/linux/usb* files with the correct
SPDX license identifier based on the license text in the file itself.
The SPDX identifier is a legally binding shorthand, which can be used
instead of the full boiler plate text.

This work is based on a script and data from Thomas Gleixner, Philippe
Ombredanne, and Kate Stewart.

Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Kate Stewart <kstewart@linuxfoundation.org>
Cc: Philippe Ombredanne <pombredanne@nexb.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: NFelipe Balbi <felipe.balbi@linux.intel.com>
Acked-by: NJohan Hovold <johan@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Make these structures const as they are only passed to the const
argument of the functions config_{group/item}_init_type_name.
Signed-off-by: NBhumika Goyal <bhumirks@gmail.com>
Acked-by: NFelipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: NChristoph Hellwig <hch@lst.de>

Currenly, f_midi_free uses snd_card_free, which will wait
until the user has released the sound card before
returning. However, if the user doesn't release the sound
card, then f_midi_free can block for an arbitrary amount
of time, which also blocks any gadget operations on that
thread.

Instead, we can use snd_card_free_when_closed which returns
before all handles are released. Since f_midi can be
accessed through rmidi if usb_put_function is called before
release_card_device, add refcounting to f_midi_free and
have rawmidi's private free call it. The f_midi memory
is only kfreed when usb_put_function and release_card_device
have both been called.
Signed-off-by: NJerry Zhang <zhangjerry@google.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Add super speed descriptors for f_midi.
Signed-off-by: NBadhri Jagan Sridharan <Badhri@google.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

These snd_rawmidi_ops structures are only passed as the third
argument of snd_rawmidi_set_ops.  This argument is const, so the
snd_rawmidi_ops structures can be const too.

Done with the help of Coccinelle.
Signed-off-by: NJulia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

The default_length parameter of alloc_ep_req was not really necessary
and gadget drivers would almost always create an inline function to pass
the same value to len and default_len.

This patch removes that parameter and updates all calls to alloc_ep_req() to
use the new API.
Signed-off-by: NFelipe F. Tonello <eu@felipetonello.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

This change makes sure that the ALSA buffers are cleaned if an endpoint
becomes disabled.

Before this change, if the internal ALSA buffer did overflow, the MIDI
function would stop sending MIDI to the host.
Signed-off-by: NFelipe F. Tonello <eu@felipetonello.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

This refactor results in a cleaner state machine code and promotes
consistency, readability, and maintanability of this driver.

This refactor state machine was well tested and it is currently running in
production code and devices.
Signed-off-by: NFelipe F. Tonello <eu@felipetonello.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

512 is the value used by wMaxPacketSize, as specified by the USB Spec. This
makes sure this driver uses, by default, the most optimal value for IN and OUT
endpoint requests.
Signed-off-by: NFelipe F. Tonello <eu@felipetonello.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

The new version of alloc_ep_req() already aligns the buffer size to
wMaxPacketSize on OUT endpoints.
Signed-off-by: NFelipe F. Tonello <eu@felipetonello.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

We added some new locking here, but missed an error path where we need
to unlock.

Fixes: 9acdf4df ('usb: gadget: f_midi: added spinlock on transmit function')
Acked-by: NMichal Nazarewicz <mina86@mina86.com>
Acked-by: NFelipe F. Tonello <eu@felipetonello.com>
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

buflen by default (256) is smaller than wMaxPacketSize (512) in high-speed
devices.

That caused the OUT endpoint to freeze if the host send any data packet of
length greater than 256 bytes.

This is an example dump of what happended on that enpoint:
HOST:   [DATA][Length=260][...]
DEVICE: [NAK]
HOST:   [PING]
DEVICE: [NAK]
HOST:   [PING]
DEVICE: [NAK]
...
HOST:   [PING]
DEVICE: [NAK]

This patch fixes this problem by setting the minimum usb_request's buffer size
for the OUT endpoint as its wMaxPacketSize.
Acked-by: NMichal Nazarewicz <mina86@mina86.com>
Signed-off-by: NFelipe F. Tonello <eu@felipetonello.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Since f_midi_transmit is called by both ALSA and USB sub-systems, it can
potentially cause a race condition between both calls because f_midi_transmit
is not reentrant nor thread-safe. This is due to an implementation detail that
the transmit function looks for the next available usb request from the fifo
and only enqueues it if there is data to send, otherwise just re-uses it. So,
if both ALSA and USB frameworks calls this function at the same time,
kfifo_seek() will return the same usb_request, which will cause a race
condition.

To solve this problem a syncronization mechanism is necessary. In this case it
is used a spinlock since f_midi_transmit is also called by usb_request->complete
callback in interrupt context.

Cc: <stable@vger.kernel.org> # v4.5+
Fixes: e1e3d7ec ("usb: gadget: f_midi: pre-allocate IN requests")
Signed-off-by: NFelipe F. Tonello <eu@felipetonello.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

For every in_substream, there must be a corresponding gmidi_in_port
structure so it is perfectly viable and some might argue sensible to
stash pointer to the input substream in the gmidi_in_port structure.

This has an added benefit that if in_ports < MAX_PORTS, the whole
f_midi structure takes up less space because only in_ports number of
pointers for in_substream are allocated instead of MAX_PORTS lots of
them.
Signed-off-by: NMichal Nazarewicz <mina86@mina86.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

We added a new error path to this function and we forgot to drop the
lock.

Fixes: e1e3d7ec ('usb: gadget: f_midi: pre-allocate IN requests')
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
[mina86@mina86.com: rebased on top of refactoring commit]
Signed-off-by: NMichal Nazarewicz <mina86@mina86.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

Reduce number of allocations, simplify memory management and reduce
memory usage by stacking the gmidi_in_port elements at the end of the
f_midi structure using a flexible array.
Signed-off-by: NMichal Nazarewicz <mina86@mina86.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

In general case, all of midi->in_port pointers may be non-NULL which
implies that the ‘if (\!port)’ condition will never execute thus never
zeroing midi->in_last_port.  Fix by rewriting the loop such that the
field is set to zero if \!port or end of loop has been reached.
Signed-off-by: NMichal Nazarewicz <mina86@mina86.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

Move some of the f_midi_transmit to a separate f_midi_do_transmit
function so the massive indention levels are not so jarring.  This
introduces no changes in behaviour.
Signed-off-by: NMichal Nazarewicz <mina86@mina86.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

remove a field which is unnecessary. No functional changes.
Signed-off-by: NFelipe F. Tonello <eu@felipetonello.com>
Signed-off-by: NMichal Nazarewicz <mina86@mina86.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

This patch introduces pre-allocation of IN endpoint USB requests. This
improves on latency (requires no usb request allocation on transmit) and avoid
several potential probles on allocating too many usb requests (which involves
DMA pool allocation problems).

This implementation also handles better multiple MIDI Gadget ports, always
processing the last processed MIDI substream if the last USB request wasn't
enought to handle the whole stream.
Signed-off-by: NFelipe F. Tonello <eu@felipetonello.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This ensures that the midi function will only work if the proper number of
IN and OUT requrests are allocated. Otherwise the function will work with less
requests then what the user wants.
Signed-off-by: NFelipe F. Tonello <eu@felipetonello.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This avoids duplication of USB requests for OUT endpoint and
re-enabling endpoints.
Signed-off-by: NFelipe F. Tonello <eu@felipetonello.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This function is shared between gadget functions, so this avoid unnecessary
duplicated code and potentially avoid memory leaks.
Reviewed-by: NRobert Baldyga <r.baldyga@samsung.com>
Signed-off-by: NFelipe F. Tonello <eu@felipetonello.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This code is duplicated from f_midi_start_ep(midi, f, midi->out_ep).
Reviewed-by: NRobert Baldyga <r.baldyga@samsung.com>
Signed-off-by: NFelipe F. Tonello <eu@felipetonello.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This patch fixes a memory leak that occurs when an endpoint fails to enqueue
the request. If that happens the complete function will never be called, thus
never freeing the request.
Signed-off-by: NFelipe F. Tonello <eu@felipetonello.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This makes sure f_midi doesn't try to enqueue data when the IN endpoint is
disabled, ie, USB cable is disconnected.
Reviewed-by: NRobert Baldyga <r.baldyga@samsung.com>
Signed-off-by: NFelipe F. Tonello <eu@felipetonello.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

To simplify the configfs interface and remove boilerplate code that also
causes binary bloat.
Signed-off-by: NChristoph Hellwig <hch@lst.de>
Reviewed-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Acked-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

Since ep->driver_data is not used for endpoint claiming, neither for
enabled/disabled state storing, we can reduce number of places where
we read or modify it's value, as now it has no particular meaning for
function or framework logic.

In case of f_midi we only need to store in ep->driver_data pointer to
struct f_midi, as it's used in f_midi_complete() callback and related
functions. All other uses of ep->driver_data are now meaningless and
can be safely removed.
Signed-off-by: NRobert Baldyga <r.baldyga@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

f_midi is not checking whether there is an error on usb_ep_queue
request, ignoring potential problems, such as memory leaks.
Signed-off-by: NFelipe F. Tonello <eu@felipetonello.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Function midi registers two interfaces with single set_alt() function
which means that f_midi_set_alt() is called twice when configuration
is set. That means that endpoint initialization and ep request allocation
is done two times. To avoid this problem we do such things only once,
for interface number 1 (MIDI Streaming interface).
Signed-off-by: NRobert Baldyga <r.baldyga@samsung.com>
Acked-by: NMichal Nazarewicz <mina86@mina86.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

In case kstrdup() fails the resources to release are
midi->in_port[] and midi. No cards have been registered,
so no need to unregister any.
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

When midi function is created, 'id' attribute is initialized with
SNDRV_DEFAULT_STR1, which is NULL pointer. Trying to read this attribute
before filling it ends up with segmentation fault.

This commit fix this issue by preventing null pointer dereference. Now
f_midi_opts_id_show() returns empty string when id is a null pointer.

Reproduction path:

$ mkdir functions/midi.0
$ cat functions/midi.0/id

[   53.130132] Unable to handle kernel NULL pointer dereference at
virtual address 00000000
[   53.132630] pgd = ec6cc000
[   53.135308] [00000000] *pgd=6b759831, *pte=00000000, *ppte=00000000
[   53.141530] Internal error: Oops: 17 [#1] PREEMPT SMP ARM
[   53.146904] Modules linked in: usb_f_midi snd_rawmidi libcomposite
[   53.153071] CPU: 1 PID: 2936 Comm: cat Not tainted
3.19.0-00041-gcf4b216 #7
[   53.160010] Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
[   53.166088] task: ee234c80 ti: ec764000 task.ti: ec764000
[   53.171482] PC is at strlcpy+0x8/0x60
[   53.175128] LR is at f_midi_opts_id_show+0x28/0x3c [usb_f_midi]
[   53.181019] pc : [<c0222a9c>]    lr : [<bf01bed0>]    psr: 60000053
[   53.181019] sp : ec765ef8  ip : 00000141  fp : 00000000
[   53.192474] r10: 00019000  r9 : ed7546c0  r8 : 00010000
[   53.197682] r7 : ec765f80  r6 : eb46a000  r5 : eb46a000  r4 :
ed754734
[   53.204192] r3 : ee234c80  r2 : 00001000  r1 : 00000000  r0 :
eb46a000
[   53.210704] Flags: nZCv  IRQs on  FIQs off  Mode SVC_32  ISA ARM
Segment user
[   53.217907] Control: 10c5387d  Table: 6c6cc04a  DAC: 00000015
[   53.223636] Process cat (pid: 2936, stack limit = 0xec764238)
[   53.229364] Stack: (0xec765ef8 to 0xec766000)
[   53.233706] 5ee0:
ed754734 ed7546c0
[   53.241866] 5f00: eb46a000 bf01bed0 eb753b80 bf01cc44 eb753b98
bf01b0a4 bf01b08c c0125dd0
[   53.250025] 5f20: 00002f19 00000000 ec432e00 bf01cce8 c0530c00
00019000 00010000 ec765f80
[   53.258184] 5f40: 00010000 ec764000 00019000 c00cc4ac ec432e00
c00cc55c 00000017 000081a4
[   53.266343] 5f60: 00000001 00000000 00000000 ec432e00 ec432e00
00010000 00019000 c00cc620
[   53.274502] 5f80: 00000000 00000000 00000000 00010000 ffff1000
00019000 00000003 c000e9a8
[   53.282662] 5fa0: 00000000 c000e7e0 00010000 ffff1000 00000003
00019000 00010000 00019000
[   53.290821] 5fc0: 00010000 ffff1000 00019000 00000003 7fffe000
00000001 00000000 00000000
[   53.298980] 5fe0: 00000000 be8c68d4 0000b995 b6f0e3e6 40000070
00000003 00000000 00000000
[   53.307157] [<c0222a9c>] (strlcpy) from [<bf01bed0>]
(f_midi_opts_id_show+0x28/0x3c [usb_f_midi])
[   53.316006] [<bf01bed0>] (f_midi_opts_id_show [usb_f_midi]) from
[<bf01b0a4>] (f_midi_opts_attr_show+0x18/0x24 )
[   53.327209] [<bf01b0a4>] (f_midi_opts_attr_show [usb_f_midi]) from
[<c0125dd0>] (configfs_read_file+0x9c/0xec)
[   53.337180] [<c0125dd0>] (configfs_read_file) from [<c00cc4ac>]
(__vfs_read+0x18/0x4c)
[   53.345073] [<c00cc4ac>] (__vfs_read) from [<c00cc55c>]
(vfs_read+0x7c/0x100)
[   53.352190] [<c00cc55c>] (vfs_read) from [<c00cc620>]
(SyS_read+0x40/0x8c)
[   53.359056] [<c00cc620>] (SyS_read) from [<c000e7e0>]
(ret_fast_syscall+0x0/0x34)
[   53.366513] Code: ebffe3d3 e8bd8008 e92d4070 e1a05000 (e5d14000)
[   53.372641] ---[ end trace e4f53a4e233d98d0 ]---
Signed-off-by: NPawel Szewczyk <p.szewczyk@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Replace a misspelled function name by %s and then __func__.

This was done using Coccinelle, including the use of Levenshtein distance,
as proposed by Rasmus Villemoes.
Signed-off-by: NJulia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

drivers/usb/gadget/function/f_midi.c:1072:21: sparse: symbol 'f_midi_alloc' was not declared. Should it be static?
drivers/usb/gadget/legacy/gmidi.c:118:30: sparse: symbol 'fi_midi' was not declared. Should it be static?
drivers/usb/gadget/legacy/gmidi.c:119:21: sparse: symbol 'f_midi' was not declared. Should it be static?
Signed-off-by: NFengguang Wu <fengguang.wu@intel.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Make the midi function available for gadgets composed with configfs.
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

In order to add configfs support the usb_gstrings_attach must be used.
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

There are no old f_midi interface users left, so remove it.
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>