kernel/drivers/usb/gadget/function/f_midi.c, branch linux-4.16.y

USB: gadget: f_midi: fixing a possible double-free in f_midi

2018-04-24T07:42:52Z

commit 7fafcfdf6377b18b2a726ea554d6e593ba44349f upstream. It looks like there is a possibility of a double-free vulnerability on an error path of the f_midi_set_alt function in the f_midi driver. If the path is feasible then free_ep_req gets called twice: req->complete = f_midi_complete; err = usb_ep_queue(midi->out_ep, req, GFP_ATOMIC); => ... usb_gadget_giveback_request => f_midi_complete (CALLBACK) (inside f_midi_complete, for various cases of status) free_ep_req(ep, req); // first kfree if (err) { ERROR(midi, "%s: couldn't enqueue request: %d\n", midi->out_ep->name, err); free_ep_req(midi->out_ep, req); // second kfree return err; } The double-free possibility was introduced with commit ad0d1a058eac ("usb: gadget: f_midi: fix leak on failed to enqueue out requests"). Found by MOXCAFE tool. Signed-off-by: Tuba Yavuz Fixes: ad0d1a058eac ("usb: gadget: f_midi: fix leak on failed to enqueue out requests") Acked-by: Felipe Balbi Cc: stable Signed-off-by: Greg Kroah-Hartman

Merge tag 'configfs-for-4.15' of git://git.infradead.org/users/hch/configfs

2017-11-14T22:44:04Z

Pull configfs updates from Christoph Hellwig: "A couple of configfs cleanups: - proper use of the bool type (Thomas Meyer) - constification of struct config_item_type (Bhumika Goyal)" * tag 'configfs-for-4.15' of git://git.infradead.org/users/hch/configfs: RDMA/cma: make config_item_type const stm class: make config_item_type const ACPI: configfs: make config_item_type const nvmet: make config_item_type const usb: gadget: configfs: make config_item_type const PCI: endpoint: make config_item_type const iio: make function argument and some structures const usb: gadget: make config_item_type structures const dlm: make config_item_type const netconsole: make config_item_type const nullb: make config_item_type const ocfs2/cluster: make config_item_type const target: make config_item_type const configfs: make ci_type field, some pointers and function arguments const configfs: make config_item_type const configfs: Fix bool initialization/comparison

USB: gadget: function: Remove redundant license text

2017-11-07T14:45:02Z

Now that the SPDX tag is in all USB files, that identifies the license in a specific and legally-defined manner. So the extra GPL text wording can be removed as it is no longer needed at all. This is done on a quest to remove the 700+ different ways that files in the kernel describe the GPL license text. And there's unneeded stuff like the address (sometimes incorrect) for the FSF which is never needed. No copyright headers or other non-license-description text was removed. Cc: Oliver Neukum Cc: Johan Hovold Cc: Jerry Zhang Cc: John Keeping Cc: Krzysztof Opasiak Cc: Abdulhadi Mohamed Cc: Matthew Wilcox Cc: Janusz Dziedzic Acked-by: Felipe Balbi Acked-by: Michal Nazarewicz Acked-by: Laurent Pinchart Acked-by: Vincent Pelletier Signed-off-by: Greg Kroah-Hartman

USB: add SPDX identifiers to all remaining files in drivers/usb/

2017-11-04T10:48:02Z

It's good to have SPDX identifiers in all files to make it easier to audit the kernel tree for correct licenses. Update the drivers/usb/ and include/linux/usb* files with the correct SPDX license identifier based on the license text in the file itself. The SPDX identifier is a legally binding shorthand, which can be used instead of the full boiler plate text. This work is based on a script and data from Thomas Gleixner, Philippe Ombredanne, and Kate Stewart. Cc: Thomas Gleixner Cc: Kate Stewart Cc: Philippe Ombredanne Signed-off-by: Greg Kroah-Hartman Acked-by: Felipe Balbi Acked-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman

usb: gadget: make config_item_type structures const

2017-10-19T14:15:23Z

Make these structures const as they are only passed to the const argument of the functions config_{group/item}_init_type_name. Signed-off-by: Bhumika Goyal Acked-by: Felipe Balbi Signed-off-by: Christoph Hellwig

usb: gadget: f_midi: Use snd_card_free_when_closed with refcount

2017-08-15T11:18:47Z

Currenly, f_midi_free uses snd_card_free, which will wait until the user has released the sound card before returning. However, if the user doesn't release the sound card, then f_midi_free can block for an arbitrary amount of time, which also blocks any gadget operations on that thread. Instead, we can use snd_card_free_when_closed which returns before all handles are released. Since f_midi can be accessed through rmidi if usb_put_function is called before release_card_device, add refcounting to f_midi_free and have rawmidi's private free call it. The f_midi memory is only kfreed when usb_put_function and release_card_device have both been called. Signed-off-by: Jerry Zhang Signed-off-by: Felipe Balbi

usb: gadget: f_midi: add super speed support

2017-08-15T09:46:05Z

Add super speed descriptors for f_midi. Signed-off-by: Badhri Jagan Sridharan Signed-off-by: Felipe Balbi

usb: gadget: f_midi: constify snd_rawmidi_ops structures

2017-08-15T09:46:04Z

These snd_rawmidi_ops structures are only passed as the third argument of snd_rawmidi_set_ops. This argument is const, so the snd_rawmidi_ops structures can be const too. Done with the help of Coccinelle. Signed-off-by: Julia Lawall Signed-off-by: Felipe Balbi

usb: gadget: remove useless parameter in alloc_ep_req()

2016-08-25T09:13:19Z

The default_length parameter of alloc_ep_req was not really necessary and gadget drivers would almost always create an inline function to pass the same value to len and default_len. This patch removes that parameter and updates all calls to alloc_ep_req() to use the new API. Signed-off-by: Felipe F. Tonello Signed-off-by: Felipe Balbi

usb: gadget: f_midi: drop substreams when disabling endpoint

2016-08-25T09:13:15Z

This change makes sure that the ALSA buffers are cleaned if an endpoint becomes disabled. Before this change, if the internal ALSA buffer did overflow, the MIDI function would stop sending MIDI to the host. Signed-off-by: Felipe F. Tonello Signed-off-by: Felipe Balbi