From 840f3e0a628e69a2b7fb4136b2dca8ab5b350f83 Mon Sep 17 00:00:00 2001 From: Saulo Veríssimo Date: Sat, 16 May 2026 12:59:44 -0300 Subject: midi2: prevent UMP packet split across USB transfers The edpt_stream auto-flush is byte-oriented and could cut an UMP message in half when the FIFO reached wMaxPacketSize, corrupting the peer's RX context. Pre-flush whole packets before writing one that would cross the boundary on both device (tud_midi2_n_ump_write) and host (tuh_midi2_ump_write) paths. Host write also becomes packet-aware instead of word-by-word. Ref #3571 --- src/class/midi/midi2_device.c | 13 +++++++++++-- src/class/midi/midi2_host.c | 27 +++++++++++++++++++-------- 2 files changed, 30 insertions(+), 10 deletions(-) (limited to 'src/class') diff --git a/src/class/midi/midi2_device.c b/src/class/midi/midi2_device.c index f7d338ede..a005c8e51 100644 --- a/src/class/midi/midi2_device.c +++ b/src/class/midi/midi2_device.c @@ -347,11 +347,20 @@ uint32_t tud_midi2_n_ump_write(uint8_t itf, const uint32_t* words, uint32_t coun while (written < count) { uint8_t mt = (uint8_t)((words[written] >> 28) & 0x0F); uint8_t pkt_words = midi2_ump_word_count(mt); + uint32_t pkt_bytes = (uint32_t)pkt_words * 4; if (written + pkt_words > count) break; - if (tu_edpt_stream_write_available(ep_tx) < pkt_words * 4) break; + if (tu_edpt_stream_write_available(ep_tx) < pkt_bytes) break; + + // Flush whole packets already queued before adding one that would cross + // the wMaxPacketSize boundary. Prevents an UMP message from being split + // across two USB transfers, which would corrupt the host RX context. + uint16_t ff_count = tu_fifo_count(&ep_tx->ff); + if (ff_count > 0 && ff_count + pkt_bytes > ep_tx->mps) { + tu_edpt_stream_write_xfer(ep_tx); + } - tu_edpt_stream_write(ep_tx, &words[written], pkt_words * 4); + tu_edpt_stream_write(ep_tx, &words[written], pkt_bytes); written += pkt_words; } diff --git a/src/class/midi/midi2_host.c b/src/class/midi/midi2_host.c index 90d632a8e..2046fdb67 100644 --- a/src/class/midi/midi2_host.c +++ b/src/class/midi/midi2_host.c @@ -527,17 +527,28 @@ uint32_t tuh_midi2_ump_write(uint8_t idx, const uint32_t* words, uint32_t count) midih2_interface_t *p_midi = &_midi2_host[idx]; tu_edpt_stream_t *ep_tx = &p_midi->ep_stream.tx; - uint32_t n_words = 0; - for (uint32_t i = 0; i < count; i++) { - if (tu_edpt_stream_write_available(ep_tx) >= 4) { - tu_edpt_stream_write(ep_tx, (const uint8_t *) &words[i], 4); - n_words++; - } else { - break; + uint32_t written = 0; + while (written < count) { + uint8_t mt = (uint8_t)((words[written] >> 28) & 0x0F); + uint8_t pkt_words = midi2_ump_word_count(mt); + uint32_t pkt_bytes = (uint32_t)pkt_words * 4; + + if (written + pkt_words > count) break; + if (tu_edpt_stream_write_available(ep_tx) < pkt_bytes) break; + + // Flush whole packets already queued before adding one that would cross + // the wMaxPacketSize boundary. Prevents an UMP message from being split + // across two USB transfers, which would corrupt the peer RX context. + uint16_t ff_count = tu_fifo_count(&ep_tx->ff); + if (ff_count > 0 && ff_count + pkt_bytes > ep_tx->mps) { + tu_edpt_stream_write_xfer(ep_tx); } + + tu_edpt_stream_write(ep_tx, (const uint8_t *) &words[written], pkt_bytes); + written += pkt_words; } - return n_words; + return written; } uint32_t tuh_midi2_write_flush(uint8_t idx) { -- cgit v1.3.1