1 // SPDX-License-Identifier: GPL-2.0-or-later
3 // Validation of USB-audio class descriptors
7 #include <linux/usb.h>
8 #include <linux/usb/audio.h>
9 #include <linux/usb/audio-v2.h>
10 #include <linux/usb/audio-v3.h>
11 #include <linux/usb/midi.h>
22 #define UAC_VERSION_ALL		(unsigned char)(-1)
30 	return d->bLength >= sizeof(*d) &&  in validate_uac1_header()
31 		d->bLength >= sizeof(*d) + d->bInCollection;  in validate_uac1_header()
41 	if (d->bLength < sizeof(*d) || !d->bNrInPins)  in validate_mixer_unit()
43 	len = sizeof(*d) + d->bNrInPins;  in validate_mixer_unit()
48 	switch (v->protocol) {  in validate_mixer_unit()
65 	return d->bLength >= len;  in validate_mixer_unit()
76 	if (d->bLength < sizeof(*d))  in validate_processing_unit()
78 	len = sizeof(*d) + d->bNrInPins;  in validate_processing_unit()
79 	if (d->bLength < len)  in validate_processing_unit()
81 	switch (v->protocol) {  in validate_processing_unit()
86 		if (d->bLength < len + 1) /* bControlSize */  in validate_processing_unit()
94 		if (v->type == UAC2_PROCESSING_UNIT_V2)  in validate_processing_unit()
95 			len += 2; /* bmControls -- 2 bytes for PU */  in validate_processing_unit()
97 			len += 1; /* bmControls -- 1 byte for EU */  in validate_processing_unit()
105 	if (d->bLength < len)  in validate_processing_unit()
108 	switch (v->protocol) {  in validate_processing_unit()
111 		if (v->type == UAC1_EXTENSION_UNIT)  in validate_processing_unit()
113 		switch (le16_to_cpu(d->wProcessType)) {  in validate_processing_unit()
116 			if (d->bLength < len + 1) /* bNrModes */  in validate_processing_unit()
126 		if (v->type == UAC2_EXTENSION_UNIT_V2)  in validate_processing_unit()
128 		switch (le16_to_cpu(d->wProcessType)) {  in validate_processing_unit()
131 			if (d->bLength < len + 1) /* bNrModes */  in validate_processing_unit()
141 		if (v->type == UAC3_EXTENSION_UNIT) {  in validate_processing_unit()
145 		switch (le16_to_cpu(d->wProcessType)) {  in validate_processing_unit()
147 			if (d->bLength < len + 1) /* bNrModes */  in validate_processing_unit()
160 	if (d->bLength < len)  in validate_processing_unit()
173 	if (d->bLength < sizeof(*d))  in validate_selector_unit()
175 	len = sizeof(*d) + d->bNrInPins;  in validate_selector_unit()
176 	switch (v->protocol) {  in validate_selector_unit()
188 	return d->bLength >= len;  in validate_selector_unit()
196 	if (d->bLength < sizeof(*d) || !d->bControlSize)  in validate_uac1_feature_unit()
199 	return d->bLength >= sizeof(*d) + d->bControlSize + 1;  in validate_uac1_feature_unit()
207 	if (d->bLength < sizeof(*d))  in validate_uac2_feature_unit()
210 	return d->bLength >= sizeof(*d) + 4 + 1;  in validate_uac2_feature_unit()
218 	if (d->bLength < sizeof(*d))  in validate_uac3_feature_unit()
221 	return d->bLength >= sizeof(*d) + 4 + 2;  in validate_uac3_feature_unit()
229 	return d->bLength >= sizeof(*d) &&  in validate_midi_out_jack()
230 		d->bLength >= sizeof(*d) + d->bNrInputPins * 2;  in validate_midi_out_jack()
309 	for (; v->type; v++) {  in validate_desc()
310 		if (v->type == hdr[2] &&  in validate_desc()
311 		    (v->protocol == UAC_VERSION_ALL ||  in validate_desc()
312 		     v->protocol == protocol)) {  in validate_desc()
313 			if (v->func)  in validate_desc()
314 				return v->func(hdr, v);  in validate_desc()
316 			return hdr[0] >= v->size;  in validate_desc()
326 	bool valid;  in snd_usb_validate_audio_desc()  local
328 	valid = validate_desc(p, protocol, audio_validators);  in snd_usb_validate_audio_desc()
329 	if (!valid && snd_usb_skip_validation) {  in snd_usb_validate_audio_desc()
330 		print_hex_dump(KERN_ERR, "USB-audio: buggy audio desc: ",  in snd_usb_validate_audio_desc()
332 		valid = true;  in snd_usb_validate_audio_desc()
334 	return valid;  in snd_usb_validate_audio_desc()
340 	bool valid;  in snd_usb_validate_midi_desc()  local
342 	valid = validate_desc(p, UAC_VERSION_1, midi_validators);  in snd_usb_validate_midi_desc()
343 	if (!valid && snd_usb_skip_validation) {  in snd_usb_validate_midi_desc()
344 		print_hex_dump(KERN_ERR, "USB-audio: buggy midi desc: ",  in snd_usb_validate_midi_desc()
346 		valid = true;  in snd_usb_validate_midi_desc()
348 	return valid;  in snd_usb_validate_midi_desc()