LXR linux/sound/usb/validate.c

   1// SPDX-License-Identifier: GPL-2.0-or-later
   2//
   3// Validation of USB-audio class descriptors
   4//
   5
   6#include <linux/init.h>
   7#include <linux/usb.h>
   8#include <linux/usb/audio.h>
   9#include <linux/usb/audio-v2.h>
  10#include <linux/usb/audio-v3.h>
  11#include <linux/usb/midi.h>
  12#include "usbaudio.h"
  13#include "helper.h"
  14
  15struct usb_desc_validator {
  16        unsigned char protocol;
  17        unsigned char type;
  18        bool (*func)(const void *p, const struct usb_desc_validator *v);
  19        size_t size;
  20};
  21
  22#define UAC_VERSION_ALL         (unsigned char)(-1)
  23
  24/* UAC1 only */
  25static bool validate_uac1_header(const void *p,
  26                                 const struct usb_desc_validator *v)
  27{
  28        const struct uac1_ac_header_descriptor *d = p;
  29
  30        return d->bLength >= sizeof(*d) &&
  31                d->bLength >= sizeof(*d) + d->bInCollection;
  32}
  33
  34/* for mixer unit; covering all UACs */
  35static bool validate_mixer_unit(const void *p,
  36                                const struct usb_desc_validator *v)
  37{
  38        const struct uac_mixer_unit_descriptor *d = p;
  39        size_t len;
  40
  41        if (d->bLength < sizeof(*d) || !d->bNrInPins)
  42                return false;
  43        len = sizeof(*d) + d->bNrInPins;
  44        /* We can't determine the bitmap size only from this unit descriptor,
  45         * so just check with the remaining length.
  46         * The actual bitmap is checked at mixer unit parser.
  47         */
  48        switch (v->protocol) {
  49        case UAC_VERSION_1:
  50        default:
  51                len += 2 + 1; /* wChannelConfig, iChannelNames */
  52                /* bmControls[n*m] */
  53                len += 1; /* iMixer */
  54                break;
  55        case UAC_VERSION_2:
  56                len += 4 + 1; /* bmChannelConfig, iChannelNames */
  57                /* bmMixerControls[n*m] */
  58                len += 1 + 1; /* bmControls, iMixer */
  59                break;
  60        case UAC_VERSION_3:
  61                len += 2; /* wClusterDescrID */
  62                /* bmMixerControls[n*m] */
  63                break;
  64        }
  65        return d->bLength >= len;
  66}
  67
  68/* both for processing and extension units; covering all UACs */
  69static bool validate_processing_unit(const void *p,
  70                                     const struct usb_desc_validator *v)
  71{
  72        const struct uac_processing_unit_descriptor *d = p;
  73        const unsigned char *hdr = p;
  74        size_t len, m;
  75
  76        if (d->bLength < sizeof(*d))
  77                return false;
  78        len = sizeof(*d) + d->bNrInPins;
  79        if (d->bLength < len)
  80                return false;
  81        switch (v->protocol) {
  82        case UAC_VERSION_1:
  83        default:
  84                /* bNrChannels, wChannelConfig, iChannelNames */
  85                len += 1 + 2 + 1;
  86                if (d->bLength < len + 1) /* bControlSize */
  87                        return false;
  88                m = hdr[len];
  89                len += 1 + m + 1; /* bControlSize, bmControls, iProcessing */
  90                break;
  91        case UAC_VERSION_2:
  92                /* bNrChannels, bmChannelConfig, iChannelNames */
  93                len += 1 + 4 + 1;
  94                if (v->type == UAC2_PROCESSING_UNIT_V2)
  95                        len += 2; /* bmControls -- 2 bytes for PU */
  96                else
  97                        len += 1; /* bmControls -- 1 byte for EU */
  98                len += 1; /* iProcessing */
  99                break;
 100        case UAC_VERSION_3:
 101                /* wProcessingDescrStr, bmControls */
 102                len += 2 + 4;
 103                break;
 104        }
 105        if (d->bLength < len)
 106                return false;
 107
 108        switch (v->protocol) {
 109        case UAC_VERSION_1:
 110        default:
 111                if (v->type == UAC1_EXTENSION_UNIT)
 112                        return true; /* OK */
 113                switch (le16_to_cpu(d->wProcessType)) {
 114                case UAC_PROCESS_UP_DOWNMIX:
 115                case UAC_PROCESS_DOLBY_PROLOGIC:
 116                        if (d->bLength < len + 1) /* bNrModes */
 117                                return false;
 118                        m = hdr[len];
 119                        len += 1 + m * 2; /* bNrModes, waModes(n) */
 120                        break;
 121                default:
 122                        break;
 123                }
 124                break;
 125        case UAC_VERSION_2:
 126                if (v->type == UAC2_EXTENSION_UNIT_V2)
 127                        return true; /* OK */
 128                switch (le16_to_cpu(d->wProcessType)) {
 129                case UAC2_PROCESS_UP_DOWNMIX:
 130                case UAC2_PROCESS_DOLBY_PROLOCIC: /* SiC! */
 131                        if (d->bLength < len + 1) /* bNrModes */
 132                                return false;
 133                        m = hdr[len];
 134                        len += 1 + m * 4; /* bNrModes, daModes(n) */
 135                        break;
 136                default:
 137                        break;
 138                }
 139                break;
 140        case UAC_VERSION_3:
 141                if (v->type == UAC3_EXTENSION_UNIT) {
 142                        len += 2; /* wClusterDescrID */
 143                        break;
 144                }
 145                switch (le16_to_cpu(d->wProcessType)) {
 146                case UAC3_PROCESS_UP_DOWNMIX:
 147                        if (d->bLength < len + 1) /* bNrModes */
 148                                return false;
 149                        m = hdr[len];
 150                        len += 1 + m * 2; /* bNrModes, waClusterDescrID(n) */
 151                        break;
 152                case UAC3_PROCESS_MULTI_FUNCTION:
 153                        len += 2 + 4; /* wClusterDescrID, bmAlgorighms */
 154                        break;
 155                default:
 156                        break;
 157                }
 158                break;
 159        }
 160        if (d->bLength < len)
 161                return false;
 162
 163        return true;
 164}
 165
 166/* both for selector and clock selector units; covering all UACs */
 167static bool validate_selector_unit(const void *p,
 168                                   const struct usb_desc_validator *v)
 169{
 170        const struct uac_selector_unit_descriptor *d = p;
 171        size_t len;
 172
 173        if (d->bLength < sizeof(*d))
 174                return false;
 175        len = sizeof(*d) + d->bNrInPins;
 176        switch (v->protocol) {
 177        case UAC_VERSION_1:
 178        default:
 179                len += 1; /* iSelector */
 180                break;
 181        case UAC_VERSION_2:
 182                len += 1 + 1; /* bmControls, iSelector */
 183                break;
 184        case UAC_VERSION_3:
 185                len += 4 + 2; /* bmControls, wSelectorDescrStr */
 186                break;
 187        }
 188        return d->bLength >= len;
 189}
 190
 191static bool validate_uac1_feature_unit(const void *p,
 192                                       const struct usb_desc_validator *v)
 193{
 194        const struct uac_feature_unit_descriptor *d = p;
 195
 196        if (d->bLength < sizeof(*d) || !d->bControlSize)
 197                return false;
 198        /* at least bmaControls(0) for master channel + iFeature */
 199        return d->bLength >= sizeof(*d) + d->bControlSize + 1;
 200}
 201
 202static bool validate_uac2_feature_unit(const void *p,
 203                                       const struct usb_desc_validator *v)
 204{
 205        const struct uac2_feature_unit_descriptor *d = p;
 206
 207        if (d->bLength < sizeof(*d))
 208                return false;
 209        /* at least bmaControls(0) for master channel + iFeature */
 210        return d->bLength >= sizeof(*d) + 4 + 1;
 211}
 212
 213static bool validate_uac3_feature_unit(const void *p,
 214                                       const struct usb_desc_validator *v)
 215{
 216        const struct uac3_feature_unit_descriptor *d = p;
 217
 218        if (d->bLength < sizeof(*d))
 219                return false;
 220        /* at least bmaControls(0) for master channel + wFeatureDescrStr */
 221        return d->bLength >= sizeof(*d) + 4 + 2;
 222}
 223
 224static bool validate_midi_out_jack(const void *p,
 225                                   const struct usb_desc_validator *v)
 226{
 227        const struct usb_midi_out_jack_descriptor *d = p;
 228
 229        return d->bLength >= sizeof(*d) &&
 230                d->bLength >= sizeof(*d) + d->bNrInputPins * 2;
 231}
 232
 233#define FIXED(p, t, s) { .protocol = (p), .type = (t), .size = sizeof(s) }
 234#define FUNC(p, t, f) { .protocol = (p), .type = (t), .func = (f) }
 235
 236static const struct usb_desc_validator audio_validators[] = {
 237        /* UAC1 */
 238        FUNC(UAC_VERSION_1, UAC_HEADER, validate_uac1_header),
 239        FIXED(UAC_VERSION_1, UAC_INPUT_TERMINAL,
 240              struct uac_input_terminal_descriptor),
 241        FIXED(UAC_VERSION_1, UAC_OUTPUT_TERMINAL,
 242              struct uac1_output_terminal_descriptor),
 243        FUNC(UAC_VERSION_1, UAC_MIXER_UNIT, validate_mixer_unit),
 244        FUNC(UAC_VERSION_1, UAC_SELECTOR_UNIT, validate_selector_unit),
 245        FUNC(UAC_VERSION_1, UAC_FEATURE_UNIT, validate_uac1_feature_unit),
 246        FUNC(UAC_VERSION_1, UAC1_PROCESSING_UNIT, validate_processing_unit),
 247        FUNC(UAC_VERSION_1, UAC1_EXTENSION_UNIT, validate_processing_unit),
 248
 249        /* UAC2 */
 250        FIXED(UAC_VERSION_2, UAC_HEADER, struct uac2_ac_header_descriptor),
 251        FIXED(UAC_VERSION_2, UAC_INPUT_TERMINAL,
 252              struct uac2_input_terminal_descriptor),
 253        FIXED(UAC_VERSION_2, UAC_OUTPUT_TERMINAL,
 254              struct uac2_output_terminal_descriptor),
 255        FUNC(UAC_VERSION_2, UAC_MIXER_UNIT, validate_mixer_unit),
 256        FUNC(UAC_VERSION_2, UAC_SELECTOR_UNIT, validate_selector_unit),
 257        FUNC(UAC_VERSION_2, UAC_FEATURE_UNIT, validate_uac2_feature_unit),
 258        /* UAC_VERSION_2, UAC2_EFFECT_UNIT: not implemented yet */
 259        FUNC(UAC_VERSION_2, UAC2_PROCESSING_UNIT_V2, validate_processing_unit),
 260        FUNC(UAC_VERSION_2, UAC2_EXTENSION_UNIT_V2, validate_processing_unit),
 261        FIXED(UAC_VERSION_2, UAC2_CLOCK_SOURCE,
 262              struct uac_clock_source_descriptor),
 263        FUNC(UAC_VERSION_2, UAC2_CLOCK_SELECTOR, validate_selector_unit),
 264        FIXED(UAC_VERSION_2, UAC2_CLOCK_MULTIPLIER,
 265              struct uac_clock_multiplier_descriptor),
 266        /* UAC_VERSION_2, UAC2_SAMPLE_RATE_CONVERTER: not implemented yet */
 267
 268        /* UAC3 */
 269        FIXED(UAC_VERSION_2, UAC_HEADER, struct uac3_ac_header_descriptor),
 270        FIXED(UAC_VERSION_3, UAC_INPUT_TERMINAL,
 271              struct uac3_input_terminal_descriptor),
 272        FIXED(UAC_VERSION_3, UAC_OUTPUT_TERMINAL,
 273              struct uac3_output_terminal_descriptor),
 274        /* UAC_VERSION_3, UAC3_EXTENDED_TERMINAL: not implemented yet */
 275        FUNC(UAC_VERSION_3, UAC3_MIXER_UNIT, validate_mixer_unit),
 276        FUNC(UAC_VERSION_3, UAC3_SELECTOR_UNIT, validate_selector_unit),
 277        FUNC(UAC_VERSION_3, UAC_FEATURE_UNIT, validate_uac3_feature_unit),
 278        /*  UAC_VERSION_3, UAC3_EFFECT_UNIT: not implemented yet */
 279        FUNC(UAC_VERSION_3, UAC3_PROCESSING_UNIT, validate_processing_unit),
 280        FUNC(UAC_VERSION_3, UAC3_EXTENSION_UNIT, validate_processing_unit),
 281        FIXED(UAC_VERSION_3, UAC3_CLOCK_SOURCE,
 282              struct uac3_clock_source_descriptor),
 283        FUNC(UAC_VERSION_3, UAC3_CLOCK_SELECTOR, validate_selector_unit),
 284        FIXED(UAC_VERSION_3, UAC3_CLOCK_MULTIPLIER,
 285              struct uac3_clock_multiplier_descriptor),
 286        /* UAC_VERSION_3, UAC3_SAMPLE_RATE_CONVERTER: not implemented yet */
 287        /* UAC_VERSION_3, UAC3_CONNECTORS: not implemented yet */
 288        { } /* terminator */
 289};
 290
 291static const struct usb_desc_validator midi_validators[] = {
 292        FIXED(UAC_VERSION_ALL, USB_MS_HEADER,
 293              struct usb_ms_header_descriptor),
 294        FIXED(UAC_VERSION_ALL, USB_MS_MIDI_IN_JACK,
 295              struct usb_midi_in_jack_descriptor),
 296        FUNC(UAC_VERSION_ALL, USB_MS_MIDI_OUT_JACK,
 297             validate_midi_out_jack),
 298        { } /* terminator */
 299};
 300
 301
 302/* Validate the given unit descriptor, return true if it's OK */
 303static bool validate_desc(unsigned char *hdr, int protocol,
 304                          const struct usb_desc_validator *v)
 305{
 306        if (hdr[1] != USB_DT_CS_INTERFACE)
 307                return true; /* don't care */
 308
 309        for (; v->type; v++) {
 310                if (v->type == hdr[2] &&
 311                    (v->protocol == UAC_VERSION_ALL ||
 312                     v->protocol == protocol)) {
 313                        if (v->func)
 314                                return v->func(hdr, v);
 315                        /* check for the fixed size */
 316                        return hdr[0] >= v->size;
 317                }
 318        }
 319
 320        return true; /* not matching, skip validation */
 321}
 322
 323bool snd_usb_validate_audio_desc(void *p, int protocol)
 324{
 325        unsigned char *c = p;
 326        bool valid;
 327
 328        valid = validate_desc(p, protocol, audio_validators);
 329        if (!valid && snd_usb_skip_validation) {
 330                print_hex_dump(KERN_ERR, "USB-audio: buggy audio desc: ",
 331                               DUMP_PREFIX_NONE, 16, 1, c, c[0], true);
 332                valid = true;
 333        }
 334        return valid;
 335}
 336
 337bool snd_usb_validate_midi_desc(void *p)
 338{
 339        unsigned char *c = p;
 340        bool valid;
 341
 342        valid = validate_desc(p, UAC_VERSION_1, midi_validators);
 343        if (!valid && snd_usb_skip_validation) {
 344                print_hex_dump(KERN_ERR, "USB-audio: buggy midi desc: ",
 345                               DUMP_PREFIX_NONE, 16, 1, c, c[0], true);
 346                valid = true;
 347        }
 348        return valid;
 349}
 350