1 // SPDX-License-Identifier: GPL-2.0-or-later 2 // 3 // Validation of USB-audio class descriptors 4 // 5 6 #include <linux/init.h> 7 #include <linux/usb.h> 8 #include <linux/usb/audio.h> 9 #include <linux/usb/audio-v2.h> 10 #include <linux/usb/audio-v3.h> 11 #include <linux/usb/midi.h> 12 #include "usbaudio.h" 13 #include "helper.h" 14 15 struct usb_desc_validator { 16 unsigned char protocol; 17 unsigned char type; 18 bool (*func)(const void *p, const struct usb_desc_validator *v); 19 size_t size; 20 }; 21 22 #define UAC_VERSION_ALL (unsigned char)(-1) 23 24 /* UAC1 only */ 25 static bool validate_uac1_header(const void *p, 26 const struct usb_desc_validator *v) 27 { 28 const struct uac1_ac_header_descriptor *d = p; 29 30 return d->bLength >= sizeof(*d) && 31 d->bLength >= sizeof(*d) + d->bInCollection; 32 } 33 34 /* for mixer unit; covering all UACs */ 35 static bool validate_mixer_unit(const void *p, 36 const struct usb_desc_validator *v) 37 { 38 const struct uac_mixer_unit_descriptor *d = p; 39 size_t len; 40 41 if (d->bLength < sizeof(*d) || !d->bNrInPins) 42 return false; 43 len = sizeof(*d) + d->bNrInPins; 44 /* We can't determine the bitmap size only from this unit descriptor, 45 * so just check with the remaining length. 46 * The actual bitmap is checked at mixer unit parser. 47 */ 48 switch (v->protocol) { 49 case UAC_VERSION_1: 50 default: 51 len += 2 + 1; /* wChannelConfig, iChannelNames */ 52 /* bmControls[n*m] */ 53 len += 1; /* iMixer */ 54 break; 55 case UAC_VERSION_2: 56 len += 4 + 1; /* bmChannelConfig, iChannelNames */ 57 /* bmMixerControls[n*m] */ 58 len += 1 + 1; /* bmControls, iMixer */ 59 break; 60 case UAC_VERSION_3: 61 len += 2; /* wClusterDescrID */ 62 /* bmMixerControls[n*m] */ 63 break; 64 } 65 return d->bLength >= len; 66 } 67 68 /* both for processing and extension units; covering all UACs */ 69 static bool validate_processing_unit(const void *p, 70 const struct usb_desc_validator *v) 71 { 72 const struct uac_processing_unit_descriptor *d = p; 73 const unsigned char *hdr = p; 74 size_t len, m; 75 76 if (d->bLength < sizeof(*d)) 77 return false; 78 len = sizeof(*d) + d->bNrInPins; 79 if (d->bLength < len) 80 return false; 81 switch (v->protocol) { 82 case UAC_VERSION_1: 83 default: 84 /* bNrChannels, wChannelConfig, iChannelNames */ 85 len += 1 + 2 + 1; 86 if (d->bLength < len + 1) /* bControlSize */ 87 return false; 88 m = hdr[len]; 89 len += 1 + m + 1; /* bControlSize, bmControls, iProcessing */ 90 break; 91 case UAC_VERSION_2: 92 /* bNrChannels, bmChannelConfig, iChannelNames */ 93 len += 1 + 4 + 1; 94 if (v->type == UAC2_PROCESSING_UNIT_V2) 95 len += 2; /* bmControls -- 2 bytes for PU */ 96 else 97 len += 1; /* bmControls -- 1 byte for EU */ 98 len += 1; /* iProcessing */ 99 break; 100 case UAC_VERSION_3: 101 /* wProcessingDescrStr, bmControls */ 102 len += 2 + 4; 103 break; 104 } 105 if (d->bLength < len) 106 return false; 107 108 switch (v->protocol) { 109 case UAC_VERSION_1: 110 default: 111 if (v->type == UAC1_EXTENSION_UNIT) 112 return true; /* OK */ 113 switch (le16_to_cpu(d->wProcessType)) { 114 case UAC_PROCESS_UP_DOWNMIX: 115 case UAC_PROCESS_DOLBY_PROLOGIC: 116 if (d->bLength < len + 1) /* bNrModes */ 117 return false; 118 m = hdr[len]; 119 len += 1 + m * 2; /* bNrModes, waModes(n) */ 120 break; 121 default: 122 break; 123 } 124 break; 125 case UAC_VERSION_2: 126 if (v->type == UAC2_EXTENSION_UNIT_V2) 127 return true; /* OK */ 128 switch (le16_to_cpu(d->wProcessType)) { 129 case UAC2_PROCESS_UP_DOWNMIX: 130 case UAC2_PROCESS_DOLBY_PROLOCIC: /* SiC! */ 131 if (d->bLength < len + 1) /* bNrModes */ 132 return false; 133 m = hdr[len]; 134 len += 1 + m * 4; /* bNrModes, daModes(n) */ 135 break; 136 default: 137 break; 138 } 139 break; 140 case UAC_VERSION_3: 141 if (v->type == UAC3_EXTENSION_UNIT) { 142 len += 2; /* wClusterDescrID */ 143 break; 144 } 145 switch (le16_to_cpu(d->wProcessType)) { 146 case UAC3_PROCESS_UP_DOWNMIX: 147 if (d->bLength < len + 1) /* bNrModes */ 148 return false; 149 m = hdr[len]; 150 len += 1 + m * 2; /* bNrModes, waClusterDescrID(n) */ 151 break; 152 case UAC3_PROCESS_MULTI_FUNCTION: 153 len += 2 + 4; /* wClusterDescrID, bmAlgorighms */ 154 break; 155 default: 156 break; 157 } 158 break; 159 } 160 if (d->bLength < len) 161 return false; 162 163 return true; 164 } 165 166 /* both for selector and clock selector units; covering all UACs */ 167 static bool validate_selector_unit(const void *p, 168 const struct usb_desc_validator *v) 169 { 170 const struct uac_selector_unit_descriptor *d = p; 171 size_t len; 172 173 if (d->bLength < sizeof(*d)) 174 return false; 175 len = sizeof(*d) + d->bNrInPins; 176 switch (v->protocol) { 177 case UAC_VERSION_1: 178 default: 179 len += 1; /* iSelector */ 180 break; 181 case UAC_VERSION_2: 182 len += 1 + 1; /* bmControls, iSelector */ 183 break; 184 case UAC_VERSION_3: 185 len += 4 + 2; /* bmControls, wSelectorDescrStr */ 186 break; 187 } 188 return d->bLength >= len; 189 } 190 191 static bool validate_uac1_feature_unit(const void *p, 192 const struct usb_desc_validator *v) 193 { 194 const struct uac_feature_unit_descriptor *d = p; 195 196 if (d->bLength < sizeof(*d) || !d->bControlSize) 197 return false; 198 /* at least bmaControls(0) for master channel + iFeature */ 199 return d->bLength >= sizeof(*d) + d->bControlSize + 1; 200 } 201 202 static bool validate_uac2_feature_unit(const void *p, 203 const struct usb_desc_validator *v) 204 { 205 const struct uac2_feature_unit_descriptor *d = p; 206 207 if (d->bLength < sizeof(*d)) 208 return false; 209 /* at least bmaControls(0) for master channel + iFeature */ 210 return d->bLength >= sizeof(*d) + 4 + 1; 211 } 212 213 static bool validate_uac3_feature_unit(const void *p, 214 const struct usb_desc_validator *v) 215 { 216 const struct uac3_feature_unit_descriptor *d = p; 217 218 if (d->bLength < sizeof(*d)) 219 return false; 220 /* at least bmaControls(0) for master channel + wFeatureDescrStr */ 221 return d->bLength >= sizeof(*d) + 4 + 2; 222 } 223 224 static bool validate_uac3_power_domain_unit(const void *p, 225 const struct usb_desc_validator *v) 226 { 227 const struct uac3_power_domain_descriptor *d = p; 228 229 if (d->bLength < sizeof(*d)) 230 return false; 231 /* baEntities[] + wPDomainDescrStr */ 232 return d->bLength >= sizeof(*d) + d->bNrEntities + 2; 233 } 234 235 static bool validate_midi_out_jack(const void *p, 236 const struct usb_desc_validator *v) 237 { 238 const struct usb_midi_out_jack_descriptor *d = p; 239 240 return d->bLength >= sizeof(*d) && 241 d->bLength >= sizeof(*d) + d->bNrInputPins * 2; 242 } 243 244 #define FIXED(p, t, s) { .protocol = (p), .type = (t), .size = sizeof(s) } 245 #define FUNC(p, t, f) { .protocol = (p), .type = (t), .func = (f) } 246 247 static const struct usb_desc_validator audio_validators[] = { 248 /* UAC1 */ 249 FUNC(UAC_VERSION_1, UAC_HEADER, validate_uac1_header), 250 FIXED(UAC_VERSION_1, UAC_INPUT_TERMINAL, 251 struct uac_input_terminal_descriptor), 252 FIXED(UAC_VERSION_1, UAC_OUTPUT_TERMINAL, 253 struct uac1_output_terminal_descriptor), 254 FUNC(UAC_VERSION_1, UAC_MIXER_UNIT, validate_mixer_unit), 255 FUNC(UAC_VERSION_1, UAC_SELECTOR_UNIT, validate_selector_unit), 256 FUNC(UAC_VERSION_1, UAC_FEATURE_UNIT, validate_uac1_feature_unit), 257 FUNC(UAC_VERSION_1, UAC1_PROCESSING_UNIT, validate_processing_unit), 258 FUNC(UAC_VERSION_1, UAC1_EXTENSION_UNIT, validate_processing_unit), 259 260 /* UAC2 */ 261 FIXED(UAC_VERSION_2, UAC_HEADER, struct uac2_ac_header_descriptor), 262 FIXED(UAC_VERSION_2, UAC_INPUT_TERMINAL, 263 struct uac2_input_terminal_descriptor), 264 FIXED(UAC_VERSION_2, UAC_OUTPUT_TERMINAL, 265 struct uac2_output_terminal_descriptor), 266 FUNC(UAC_VERSION_2, UAC_MIXER_UNIT, validate_mixer_unit), 267 FUNC(UAC_VERSION_2, UAC_SELECTOR_UNIT, validate_selector_unit), 268 FUNC(UAC_VERSION_2, UAC_FEATURE_UNIT, validate_uac2_feature_unit), 269 /* UAC_VERSION_2, UAC2_EFFECT_UNIT: not implemented yet */ 270 FUNC(UAC_VERSION_2, UAC2_PROCESSING_UNIT_V2, validate_processing_unit), 271 FUNC(UAC_VERSION_2, UAC2_EXTENSION_UNIT_V2, validate_processing_unit), 272 FIXED(UAC_VERSION_2, UAC2_CLOCK_SOURCE, 273 struct uac_clock_source_descriptor), 274 FUNC(UAC_VERSION_2, UAC2_CLOCK_SELECTOR, validate_selector_unit), 275 FIXED(UAC_VERSION_2, UAC2_CLOCK_MULTIPLIER, 276 struct uac_clock_multiplier_descriptor), 277 /* UAC_VERSION_2, UAC2_SAMPLE_RATE_CONVERTER: not implemented yet */ 278 279 /* UAC3 */ 280 FIXED(UAC_VERSION_2, UAC_HEADER, struct uac3_ac_header_descriptor), 281 FIXED(UAC_VERSION_3, UAC_INPUT_TERMINAL, 282 struct uac3_input_terminal_descriptor), 283 FIXED(UAC_VERSION_3, UAC_OUTPUT_TERMINAL, 284 struct uac3_output_terminal_descriptor), 285 /* UAC_VERSION_3, UAC3_EXTENDED_TERMINAL: not implemented yet */ 286 FUNC(UAC_VERSION_3, UAC3_MIXER_UNIT, validate_mixer_unit), 287 FUNC(UAC_VERSION_3, UAC3_SELECTOR_UNIT, validate_selector_unit), 288 FUNC(UAC_VERSION_3, UAC_FEATURE_UNIT, validate_uac3_feature_unit), 289 /* UAC_VERSION_3, UAC3_EFFECT_UNIT: not implemented yet */ 290 FUNC(UAC_VERSION_3, UAC3_PROCESSING_UNIT, validate_processing_unit), 291 FUNC(UAC_VERSION_3, UAC3_EXTENSION_UNIT, validate_processing_unit), 292 FIXED(UAC_VERSION_3, UAC3_CLOCK_SOURCE, 293 struct uac3_clock_source_descriptor), 294 FUNC(UAC_VERSION_3, UAC3_CLOCK_SELECTOR, validate_selector_unit), 295 FIXED(UAC_VERSION_3, UAC3_CLOCK_MULTIPLIER, 296 struct uac3_clock_multiplier_descriptor), 297 /* UAC_VERSION_3, UAC3_SAMPLE_RATE_CONVERTER: not implemented yet */ 298 /* UAC_VERSION_3, UAC3_CONNECTORS: not implemented yet */ 299 FUNC(UAC_VERSION_3, UAC3_POWER_DOMAIN, validate_uac3_power_domain_unit), 300 { } /* terminator */ 301 }; 302 303 static const struct usb_desc_validator midi_validators[] = { 304 FIXED(UAC_VERSION_ALL, USB_MS_HEADER, 305 struct usb_ms_header_descriptor), 306 FIXED(UAC_VERSION_ALL, USB_MS_MIDI_IN_JACK, 307 struct usb_midi_in_jack_descriptor), 308 FUNC(UAC_VERSION_ALL, USB_MS_MIDI_OUT_JACK, 309 validate_midi_out_jack), 310 { } /* terminator */ 311 }; 312 313 314 /* Validate the given unit descriptor, return true if it's OK */ 315 static bool validate_desc(unsigned char *hdr, int protocol, 316 const struct usb_desc_validator *v) 317 { 318 if (hdr[1] != USB_DT_CS_INTERFACE) 319 return true; /* don't care */ 320 321 for (; v->type; v++) { 322 if (v->type == hdr[2] && 323 (v->protocol == UAC_VERSION_ALL || 324 v->protocol == protocol)) { 325 if (v->func) 326 return v->func(hdr, v); 327 /* check for the fixed size */ 328 return hdr[0] >= v->size; 329 } 330 } 331 332 return true; /* not matching, skip validation */ 333 } 334 335 bool snd_usb_validate_audio_desc(void *p, int protocol) 336 { 337 unsigned char *c = p; 338 bool valid; 339 340 valid = validate_desc(p, protocol, audio_validators); 341 if (!valid && snd_usb_skip_validation) { 342 print_hex_dump(KERN_ERR, "USB-audio: buggy audio desc: ", 343 DUMP_PREFIX_NONE, 16, 1, c, c[0], true); 344 valid = true; 345 } 346 return valid; 347 } 348 349 bool snd_usb_validate_midi_desc(void *p) 350 { 351 unsigned char *c = p; 352 bool valid; 353 354 valid = validate_desc(p, UAC_VERSION_1, midi_validators); 355 if (!valid && snd_usb_skip_validation) { 356 print_hex_dump(KERN_ERR, "USB-audio: buggy midi desc: ", 357 DUMP_PREFIX_NONE, 16, 1, c, c[0], true); 358 valid = true; 359 } 360 return valid; 361 } 362