1 // SPDX-License-Identifier: GPL-2.0-or-later
2 //
3 // Validation of USB-audio class descriptors
4 //
5
6 #include <linux/init.h>
7 #include <linux/usb.h>
8 #include <linux/usb/audio.h>
9 #include <linux/usb/audio-v2.h>
10 #include <linux/usb/audio-v3.h>
11 #include <linux/usb/midi.h>
12 #include "usbaudio.h"
13 #include "helper.h"
14
15 struct usb_desc_validator {
16 unsigned char protocol;
17 unsigned char type;
18 bool (*func)(const void *p, const struct usb_desc_validator *v);
19 size_t size;
20 };
21
22 #define UAC_VERSION_ALL (unsigned char)(-1)
23
24 /* UAC1 only */
validate_uac1_header(const void * p,const struct usb_desc_validator * v)25 static bool validate_uac1_header(const void *p,
26 const struct usb_desc_validator *v)
27 {
28 const struct uac1_ac_header_descriptor *d = p;
29
30 return d->bLength >= sizeof(*d) &&
31 d->bLength >= sizeof(*d) + d->bInCollection;
32 }
33
34 /* for mixer unit; covering all UACs */
validate_mixer_unit(const void * p,const struct usb_desc_validator * v)35 static bool validate_mixer_unit(const void *p,
36 const struct usb_desc_validator *v)
37 {
38 const struct uac_mixer_unit_descriptor *d = p;
39 size_t len;
40
41 if (d->bLength < sizeof(*d) || !d->bNrInPins)
42 return false;
43 len = sizeof(*d) + d->bNrInPins;
44 /* We can't determine the bitmap size only from this unit descriptor,
45 * so just check with the remaining length.
46 * The actual bitmap is checked at mixer unit parser.
47 */
48 switch (v->protocol) {
49 case UAC_VERSION_1:
50 default:
51 len += 2 + 1; /* wChannelConfig, iChannelNames */
52 /* bmControls[n*m] */
53 len += 1; /* iMixer */
54 break;
55 case UAC_VERSION_2:
56 len += 4 + 1; /* bmChannelConfig, iChannelNames */
57 /* bmMixerControls[n*m] */
58 len += 1 + 1; /* bmControls, iMixer */
59 break;
60 case UAC_VERSION_3:
61 len += 2; /* wClusterDescrID */
62 /* bmMixerControls[n*m] */
63 break;
64 }
65 return d->bLength >= len;
66 }
67
68 /* both for processing and extension units; covering all UACs */
validate_processing_unit(const void * p,const struct usb_desc_validator * v)69 static bool validate_processing_unit(const void *p,
70 const struct usb_desc_validator *v)
71 {
72 const struct uac_processing_unit_descriptor *d = p;
73 const unsigned char *hdr = p;
74 size_t len, m;
75
76 if (d->bLength < sizeof(*d))
77 return false;
78 len = sizeof(*d) + d->bNrInPins;
79 if (d->bLength < len)
80 return false;
81 switch (v->protocol) {
82 case UAC_VERSION_1:
83 default:
84 /* bNrChannels, wChannelConfig, iChannelNames */
85 len += 1 + 2 + 1;
86 if (d->bLength < len + 1) /* bControlSize */
87 return false;
88 m = hdr[len];
89 len += 1 + m + 1; /* bControlSize, bmControls, iProcessing */
90 break;
91 case UAC_VERSION_2:
92 /* bNrChannels, bmChannelConfig, iChannelNames */
93 len += 1 + 4 + 1;
94 if (v->type == UAC2_PROCESSING_UNIT_V2)
95 len += 2; /* bmControls -- 2 bytes for PU */
96 else
97 len += 1; /* bmControls -- 1 byte for EU */
98 len += 1; /* iProcessing */
99 break;
100 case UAC_VERSION_3:
101 /* wProcessingDescrStr, bmControls */
102 len += 2 + 4;
103 break;
104 }
105 if (d->bLength < len)
106 return false;
107
108 switch (v->protocol) {
109 case UAC_VERSION_1:
110 default:
111 if (v->type == UAC1_EXTENSION_UNIT)
112 return true; /* OK */
113 switch (le16_to_cpu(d->wProcessType)) {
114 case UAC_PROCESS_UP_DOWNMIX:
115 case UAC_PROCESS_DOLBY_PROLOGIC:
116 if (d->bLength < len + 1) /* bNrModes */
117 return false;
118 m = hdr[len];
119 len += 1 + m * 2; /* bNrModes, waModes(n) */
120 break;
121 default:
122 break;
123 }
124 break;
125 case UAC_VERSION_2:
126 if (v->type == UAC2_EXTENSION_UNIT_V2)
127 return true; /* OK */
128 switch (le16_to_cpu(d->wProcessType)) {
129 case UAC2_PROCESS_UP_DOWNMIX:
130 case UAC2_PROCESS_DOLBY_PROLOCIC: /* SiC! */
131 if (d->bLength < len + 1) /* bNrModes */
132 return false;
133 m = hdr[len];
134 len += 1 + m * 4; /* bNrModes, daModes(n) */
135 break;
136 default:
137 break;
138 }
139 break;
140 case UAC_VERSION_3:
141 if (v->type == UAC3_EXTENSION_UNIT) {
142 len += 2; /* wClusterDescrID */
143 break;
144 }
145 switch (le16_to_cpu(d->wProcessType)) {
146 case UAC3_PROCESS_UP_DOWNMIX:
147 if (d->bLength < len + 1) /* bNrModes */
148 return false;
149 m = hdr[len];
150 len += 1 + m * 2; /* bNrModes, waClusterDescrID(n) */
151 break;
152 case UAC3_PROCESS_MULTI_FUNCTION:
153 len += 2 + 4; /* wClusterDescrID, bmAlgorighms */
154 break;
155 default:
156 break;
157 }
158 break;
159 }
160 if (d->bLength < len)
161 return false;
162
163 return true;
164 }
165
166 /* both for selector and clock selector units; covering all UACs */
validate_selector_unit(const void * p,const struct usb_desc_validator * v)167 static bool validate_selector_unit(const void *p,
168 const struct usb_desc_validator *v)
169 {
170 const struct uac_selector_unit_descriptor *d = p;
171 size_t len;
172
173 if (d->bLength < sizeof(*d))
174 return false;
175 len = sizeof(*d) + d->bNrInPins;
176 switch (v->protocol) {
177 case UAC_VERSION_1:
178 default:
179 len += 1; /* iSelector */
180 break;
181 case UAC_VERSION_2:
182 len += 1 + 1; /* bmControls, iSelector */
183 break;
184 case UAC_VERSION_3:
185 len += 4 + 2; /* bmControls, wSelectorDescrStr */
186 break;
187 }
188 return d->bLength >= len;
189 }
190
validate_uac1_feature_unit(const void * p,const struct usb_desc_validator * v)191 static bool validate_uac1_feature_unit(const void *p,
192 const struct usb_desc_validator *v)
193 {
194 const struct uac_feature_unit_descriptor *d = p;
195
196 if (d->bLength < sizeof(*d) || !d->bControlSize)
197 return false;
198 /* at least bmaControls(0) for master channel + iFeature */
199 return d->bLength >= sizeof(*d) + d->bControlSize + 1;
200 }
201
validate_uac2_feature_unit(const void * p,const struct usb_desc_validator * v)202 static bool validate_uac2_feature_unit(const void *p,
203 const struct usb_desc_validator *v)
204 {
205 const struct uac2_feature_unit_descriptor *d = p;
206
207 if (d->bLength < sizeof(*d))
208 return false;
209 /* at least bmaControls(0) for master channel + iFeature */
210 return d->bLength >= sizeof(*d) + 4 + 1;
211 }
212
validate_uac3_feature_unit(const void * p,const struct usb_desc_validator * v)213 static bool validate_uac3_feature_unit(const void *p,
214 const struct usb_desc_validator *v)
215 {
216 const struct uac3_feature_unit_descriptor *d = p;
217
218 if (d->bLength < sizeof(*d))
219 return false;
220 /* at least bmaControls(0) for master channel + wFeatureDescrStr */
221 return d->bLength >= sizeof(*d) + 4 + 2;
222 }
223
validate_uac3_power_domain_unit(const void * p,const struct usb_desc_validator * v)224 static bool validate_uac3_power_domain_unit(const void *p,
225 const struct usb_desc_validator *v)
226 {
227 const struct uac3_power_domain_descriptor *d = p;
228
229 if (d->bLength < sizeof(*d))
230 return false;
231 /* baEntities[] + wPDomainDescrStr */
232 return d->bLength >= sizeof(*d) + d->bNrEntities + 2;
233 }
234
validate_midi_out_jack(const void * p,const struct usb_desc_validator * v)235 static bool validate_midi_out_jack(const void *p,
236 const struct usb_desc_validator *v)
237 {
238 const struct usb_midi_out_jack_descriptor *d = p;
239
240 return d->bLength >= sizeof(*d) &&
241 d->bLength >= sizeof(*d) + d->bNrInputPins * 2;
242 }
243
244 #define FIXED(p, t, s) { .protocol = (p), .type = (t), .size = sizeof(s) }
245 #define FUNC(p, t, f) { .protocol = (p), .type = (t), .func = (f) }
246
247 static const struct usb_desc_validator audio_validators[] = {
248 /* UAC1 */
249 FUNC(UAC_VERSION_1, UAC_HEADER, validate_uac1_header),
250 FIXED(UAC_VERSION_1, UAC_INPUT_TERMINAL,
251 struct uac_input_terminal_descriptor),
252 FIXED(UAC_VERSION_1, UAC_OUTPUT_TERMINAL,
253 struct uac1_output_terminal_descriptor),
254 FUNC(UAC_VERSION_1, UAC_MIXER_UNIT, validate_mixer_unit),
255 FUNC(UAC_VERSION_1, UAC_SELECTOR_UNIT, validate_selector_unit),
256 FUNC(UAC_VERSION_1, UAC_FEATURE_UNIT, validate_uac1_feature_unit),
257 FUNC(UAC_VERSION_1, UAC1_PROCESSING_UNIT, validate_processing_unit),
258 FUNC(UAC_VERSION_1, UAC1_EXTENSION_UNIT, validate_processing_unit),
259
260 /* UAC2 */
261 FIXED(UAC_VERSION_2, UAC_HEADER, struct uac2_ac_header_descriptor),
262 FIXED(UAC_VERSION_2, UAC_INPUT_TERMINAL,
263 struct uac2_input_terminal_descriptor),
264 FIXED(UAC_VERSION_2, UAC_OUTPUT_TERMINAL,
265 struct uac2_output_terminal_descriptor),
266 FUNC(UAC_VERSION_2, UAC_MIXER_UNIT, validate_mixer_unit),
267 FUNC(UAC_VERSION_2, UAC_SELECTOR_UNIT, validate_selector_unit),
268 FUNC(UAC_VERSION_2, UAC_FEATURE_UNIT, validate_uac2_feature_unit),
269 /* UAC_VERSION_2, UAC2_EFFECT_UNIT: not implemented yet */
270 FUNC(UAC_VERSION_2, UAC2_PROCESSING_UNIT_V2, validate_processing_unit),
271 FUNC(UAC_VERSION_2, UAC2_EXTENSION_UNIT_V2, validate_processing_unit),
272 FIXED(UAC_VERSION_2, UAC2_CLOCK_SOURCE,
273 struct uac_clock_source_descriptor),
274 FUNC(UAC_VERSION_2, UAC2_CLOCK_SELECTOR, validate_selector_unit),
275 FIXED(UAC_VERSION_2, UAC2_CLOCK_MULTIPLIER,
276 struct uac_clock_multiplier_descriptor),
277 /* UAC_VERSION_2, UAC2_SAMPLE_RATE_CONVERTER: not implemented yet */
278
279 /* UAC3 */
280 FIXED(UAC_VERSION_2, UAC_HEADER, struct uac3_ac_header_descriptor),
281 FIXED(UAC_VERSION_3, UAC_INPUT_TERMINAL,
282 struct uac3_input_terminal_descriptor),
283 FIXED(UAC_VERSION_3, UAC_OUTPUT_TERMINAL,
284 struct uac3_output_terminal_descriptor),
285 /* UAC_VERSION_3, UAC3_EXTENDED_TERMINAL: not implemented yet */
286 FUNC(UAC_VERSION_3, UAC3_MIXER_UNIT, validate_mixer_unit),
287 FUNC(UAC_VERSION_3, UAC3_SELECTOR_UNIT, validate_selector_unit),
288 FUNC(UAC_VERSION_3, UAC3_FEATURE_UNIT, validate_uac3_feature_unit),
289 /* UAC_VERSION_3, UAC3_EFFECT_UNIT: not implemented yet */
290 FUNC(UAC_VERSION_3, UAC3_PROCESSING_UNIT, validate_processing_unit),
291 FUNC(UAC_VERSION_3, UAC3_EXTENSION_UNIT, validate_processing_unit),
292 FIXED(UAC_VERSION_3, UAC3_CLOCK_SOURCE,
293 struct uac3_clock_source_descriptor),
294 FUNC(UAC_VERSION_3, UAC3_CLOCK_SELECTOR, validate_selector_unit),
295 FIXED(UAC_VERSION_3, UAC3_CLOCK_MULTIPLIER,
296 struct uac3_clock_multiplier_descriptor),
297 /* UAC_VERSION_3, UAC3_SAMPLE_RATE_CONVERTER: not implemented yet */
298 /* UAC_VERSION_3, UAC3_CONNECTORS: not implemented yet */
299 FUNC(UAC_VERSION_3, UAC3_POWER_DOMAIN, validate_uac3_power_domain_unit),
300 { } /* terminator */
301 };
302
303 static const struct usb_desc_validator midi_validators[] = {
304 FIXED(UAC_VERSION_ALL, USB_MS_HEADER,
305 struct usb_ms_header_descriptor),
306 FIXED(UAC_VERSION_ALL, USB_MS_MIDI_IN_JACK,
307 struct usb_midi_in_jack_descriptor),
308 FUNC(UAC_VERSION_ALL, USB_MS_MIDI_OUT_JACK,
309 validate_midi_out_jack),
310 { } /* terminator */
311 };
312
313
314 /* Validate the given unit descriptor, return true if it's OK */
validate_desc(unsigned char * hdr,int protocol,const struct usb_desc_validator * v)315 static bool validate_desc(unsigned char *hdr, int protocol,
316 const struct usb_desc_validator *v)
317 {
318 if (hdr[1] != USB_DT_CS_INTERFACE)
319 return true; /* don't care */
320
321 for (; v->type; v++) {
322 if (v->type == hdr[2] &&
323 (v->protocol == UAC_VERSION_ALL ||
324 v->protocol == protocol)) {
325 if (v->func)
326 return v->func(hdr, v);
327 /* check for the fixed size */
328 return hdr[0] >= v->size;
329 }
330 }
331
332 return true; /* not matching, skip validation */
333 }
334
snd_usb_validate_audio_desc(void * p,int protocol)335 bool snd_usb_validate_audio_desc(void *p, int protocol)
336 {
337 unsigned char *c = p;
338 bool valid;
339
340 valid = validate_desc(p, protocol, audio_validators);
341 if (!valid && snd_usb_skip_validation) {
342 print_hex_dump(KERN_ERR, "USB-audio: buggy audio desc: ",
343 DUMP_PREFIX_NONE, 16, 1, c, c[0], true);
344 valid = true;
345 }
346 return valid;
347 }
348
snd_usb_validate_midi_desc(void * p)349 bool snd_usb_validate_midi_desc(void *p)
350 {
351 unsigned char *c = p;
352 bool valid;
353
354 valid = validate_desc(p, UAC_VERSION_1, midi_validators);
355 if (!valid && snd_usb_skip_validation) {
356 print_hex_dump(KERN_ERR, "USB-audio: buggy midi desc: ",
357 DUMP_PREFIX_NONE, 16, 1, c, c[0], true);
358 valid = true;
359 }
360 return valid;
361 }
362