xref: /openbmc/linux/sound/usb/validate.c (revision e65e175b)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 //
3 // Validation of USB-audio class descriptors
4 //
5 
6 #include <linux/init.h>
7 #include <linux/usb.h>
8 #include <linux/usb/audio.h>
9 #include <linux/usb/audio-v2.h>
10 #include <linux/usb/audio-v3.h>
11 #include <linux/usb/midi.h>
12 #include "usbaudio.h"
13 #include "helper.h"
14 
15 struct usb_desc_validator {
16 	unsigned char protocol;
17 	unsigned char type;
18 	bool (*func)(const void *p, const struct usb_desc_validator *v);
19 	size_t size;
20 };
21 
22 #define UAC_VERSION_ALL		(unsigned char)(-1)
23 
24 /* UAC1 only */
25 static bool validate_uac1_header(const void *p,
26 				 const struct usb_desc_validator *v)
27 {
28 	const struct uac1_ac_header_descriptor *d = p;
29 
30 	return d->bLength >= sizeof(*d) &&
31 		d->bLength >= sizeof(*d) + d->bInCollection;
32 }
33 
34 /* for mixer unit; covering all UACs */
35 static bool validate_mixer_unit(const void *p,
36 				const struct usb_desc_validator *v)
37 {
38 	const struct uac_mixer_unit_descriptor *d = p;
39 	size_t len;
40 
41 	if (d->bLength < sizeof(*d) || !d->bNrInPins)
42 		return false;
43 	len = sizeof(*d) + d->bNrInPins;
44 	/* We can't determine the bitmap size only from this unit descriptor,
45 	 * so just check with the remaining length.
46 	 * The actual bitmap is checked at mixer unit parser.
47 	 */
48 	switch (v->protocol) {
49 	case UAC_VERSION_1:
50 	default:
51 		len += 2 + 1; /* wChannelConfig, iChannelNames */
52 		/* bmControls[n*m] */
53 		len += 1; /* iMixer */
54 		break;
55 	case UAC_VERSION_2:
56 		len += 4 + 1; /* bmChannelConfig, iChannelNames */
57 		/* bmMixerControls[n*m] */
58 		len += 1 + 1; /* bmControls, iMixer */
59 		break;
60 	case UAC_VERSION_3:
61 		len += 2; /* wClusterDescrID */
62 		/* bmMixerControls[n*m] */
63 		break;
64 	}
65 	return d->bLength >= len;
66 }
67 
68 /* both for processing and extension units; covering all UACs */
69 static bool validate_processing_unit(const void *p,
70 				     const struct usb_desc_validator *v)
71 {
72 	const struct uac_processing_unit_descriptor *d = p;
73 	const unsigned char *hdr = p;
74 	size_t len, m;
75 
76 	if (d->bLength < sizeof(*d))
77 		return false;
78 	len = sizeof(*d) + d->bNrInPins;
79 	if (d->bLength < len)
80 		return false;
81 	switch (v->protocol) {
82 	case UAC_VERSION_1:
83 	default:
84 		/* bNrChannels, wChannelConfig, iChannelNames */
85 		len += 1 + 2 + 1;
86 		if (d->bLength < len + 1) /* bControlSize */
87 			return false;
88 		m = hdr[len];
89 		len += 1 + m + 1; /* bControlSize, bmControls, iProcessing */
90 		break;
91 	case UAC_VERSION_2:
92 		/* bNrChannels, bmChannelConfig, iChannelNames */
93 		len += 1 + 4 + 1;
94 		if (v->type == UAC2_PROCESSING_UNIT_V2)
95 			len += 2; /* bmControls -- 2 bytes for PU */
96 		else
97 			len += 1; /* bmControls -- 1 byte for EU */
98 		len += 1; /* iProcessing */
99 		break;
100 	case UAC_VERSION_3:
101 		/* wProcessingDescrStr, bmControls */
102 		len += 2 + 4;
103 		break;
104 	}
105 	if (d->bLength < len)
106 		return false;
107 
108 	switch (v->protocol) {
109 	case UAC_VERSION_1:
110 	default:
111 		if (v->type == UAC1_EXTENSION_UNIT)
112 			return true; /* OK */
113 		switch (le16_to_cpu(d->wProcessType)) {
114 		case UAC_PROCESS_UP_DOWNMIX:
115 		case UAC_PROCESS_DOLBY_PROLOGIC:
116 			if (d->bLength < len + 1) /* bNrModes */
117 				return false;
118 			m = hdr[len];
119 			len += 1 + m * 2; /* bNrModes, waModes(n) */
120 			break;
121 		default:
122 			break;
123 		}
124 		break;
125 	case UAC_VERSION_2:
126 		if (v->type == UAC2_EXTENSION_UNIT_V2)
127 			return true; /* OK */
128 		switch (le16_to_cpu(d->wProcessType)) {
129 		case UAC2_PROCESS_UP_DOWNMIX:
130 		case UAC2_PROCESS_DOLBY_PROLOCIC: /* SiC! */
131 			if (d->bLength < len + 1) /* bNrModes */
132 				return false;
133 			m = hdr[len];
134 			len += 1 + m * 4; /* bNrModes, daModes(n) */
135 			break;
136 		default:
137 			break;
138 		}
139 		break;
140 	case UAC_VERSION_3:
141 		if (v->type == UAC3_EXTENSION_UNIT) {
142 			len += 2; /* wClusterDescrID */
143 			break;
144 		}
145 		switch (le16_to_cpu(d->wProcessType)) {
146 		case UAC3_PROCESS_UP_DOWNMIX:
147 			if (d->bLength < len + 1) /* bNrModes */
148 				return false;
149 			m = hdr[len];
150 			len += 1 + m * 2; /* bNrModes, waClusterDescrID(n) */
151 			break;
152 		case UAC3_PROCESS_MULTI_FUNCTION:
153 			len += 2 + 4; /* wClusterDescrID, bmAlgorighms */
154 			break;
155 		default:
156 			break;
157 		}
158 		break;
159 	}
160 	if (d->bLength < len)
161 		return false;
162 
163 	return true;
164 }
165 
166 /* both for selector and clock selector units; covering all UACs */
167 static bool validate_selector_unit(const void *p,
168 				   const struct usb_desc_validator *v)
169 {
170 	const struct uac_selector_unit_descriptor *d = p;
171 	size_t len;
172 
173 	if (d->bLength < sizeof(*d))
174 		return false;
175 	len = sizeof(*d) + d->bNrInPins;
176 	switch (v->protocol) {
177 	case UAC_VERSION_1:
178 	default:
179 		len += 1; /* iSelector */
180 		break;
181 	case UAC_VERSION_2:
182 		len += 1 + 1; /* bmControls, iSelector */
183 		break;
184 	case UAC_VERSION_3:
185 		len += 4 + 2; /* bmControls, wSelectorDescrStr */
186 		break;
187 	}
188 	return d->bLength >= len;
189 }
190 
191 static bool validate_uac1_feature_unit(const void *p,
192 				       const struct usb_desc_validator *v)
193 {
194 	const struct uac_feature_unit_descriptor *d = p;
195 
196 	if (d->bLength < sizeof(*d) || !d->bControlSize)
197 		return false;
198 	/* at least bmaControls(0) for master channel + iFeature */
199 	return d->bLength >= sizeof(*d) + d->bControlSize + 1;
200 }
201 
202 static bool validate_uac2_feature_unit(const void *p,
203 				       const struct usb_desc_validator *v)
204 {
205 	const struct uac2_feature_unit_descriptor *d = p;
206 
207 	if (d->bLength < sizeof(*d))
208 		return false;
209 	/* at least bmaControls(0) for master channel + iFeature */
210 	return d->bLength >= sizeof(*d) + 4 + 1;
211 }
212 
213 static bool validate_uac3_feature_unit(const void *p,
214 				       const struct usb_desc_validator *v)
215 {
216 	const struct uac3_feature_unit_descriptor *d = p;
217 
218 	if (d->bLength < sizeof(*d))
219 		return false;
220 	/* at least bmaControls(0) for master channel + wFeatureDescrStr */
221 	return d->bLength >= sizeof(*d) + 4 + 2;
222 }
223 
224 static bool validate_midi_out_jack(const void *p,
225 				   const struct usb_desc_validator *v)
226 {
227 	const struct usb_midi_out_jack_descriptor *d = p;
228 
229 	return d->bLength >= sizeof(*d) &&
230 		d->bLength >= sizeof(*d) + d->bNrInputPins * 2;
231 }
232 
233 #define FIXED(p, t, s) { .protocol = (p), .type = (t), .size = sizeof(s) }
234 #define FUNC(p, t, f) { .protocol = (p), .type = (t), .func = (f) }
235 
236 static const struct usb_desc_validator audio_validators[] = {
237 	/* UAC1 */
238 	FUNC(UAC_VERSION_1, UAC_HEADER, validate_uac1_header),
239 	FIXED(UAC_VERSION_1, UAC_INPUT_TERMINAL,
240 	      struct uac_input_terminal_descriptor),
241 	FIXED(UAC_VERSION_1, UAC_OUTPUT_TERMINAL,
242 	      struct uac1_output_terminal_descriptor),
243 	FUNC(UAC_VERSION_1, UAC_MIXER_UNIT, validate_mixer_unit),
244 	FUNC(UAC_VERSION_1, UAC_SELECTOR_UNIT, validate_selector_unit),
245 	FUNC(UAC_VERSION_1, UAC_FEATURE_UNIT, validate_uac1_feature_unit),
246 	FUNC(UAC_VERSION_1, UAC1_PROCESSING_UNIT, validate_processing_unit),
247 	FUNC(UAC_VERSION_1, UAC1_EXTENSION_UNIT, validate_processing_unit),
248 
249 	/* UAC2 */
250 	FIXED(UAC_VERSION_2, UAC_HEADER, struct uac2_ac_header_descriptor),
251 	FIXED(UAC_VERSION_2, UAC_INPUT_TERMINAL,
252 	      struct uac2_input_terminal_descriptor),
253 	FIXED(UAC_VERSION_2, UAC_OUTPUT_TERMINAL,
254 	      struct uac2_output_terminal_descriptor),
255 	FUNC(UAC_VERSION_2, UAC_MIXER_UNIT, validate_mixer_unit),
256 	FUNC(UAC_VERSION_2, UAC_SELECTOR_UNIT, validate_selector_unit),
257 	FUNC(UAC_VERSION_2, UAC_FEATURE_UNIT, validate_uac2_feature_unit),
258 	/* UAC_VERSION_2, UAC2_EFFECT_UNIT: not implemented yet */
259 	FUNC(UAC_VERSION_2, UAC2_PROCESSING_UNIT_V2, validate_processing_unit),
260 	FUNC(UAC_VERSION_2, UAC2_EXTENSION_UNIT_V2, validate_processing_unit),
261 	FIXED(UAC_VERSION_2, UAC2_CLOCK_SOURCE,
262 	      struct uac_clock_source_descriptor),
263 	FUNC(UAC_VERSION_2, UAC2_CLOCK_SELECTOR, validate_selector_unit),
264 	FIXED(UAC_VERSION_2, UAC2_CLOCK_MULTIPLIER,
265 	      struct uac_clock_multiplier_descriptor),
266 	/* UAC_VERSION_2, UAC2_SAMPLE_RATE_CONVERTER: not implemented yet */
267 
268 	/* UAC3 */
269 	FIXED(UAC_VERSION_2, UAC_HEADER, struct uac3_ac_header_descriptor),
270 	FIXED(UAC_VERSION_3, UAC_INPUT_TERMINAL,
271 	      struct uac3_input_terminal_descriptor),
272 	FIXED(UAC_VERSION_3, UAC_OUTPUT_TERMINAL,
273 	      struct uac3_output_terminal_descriptor),
274 	/* UAC_VERSION_3, UAC3_EXTENDED_TERMINAL: not implemented yet */
275 	FUNC(UAC_VERSION_3, UAC3_MIXER_UNIT, validate_mixer_unit),
276 	FUNC(UAC_VERSION_3, UAC3_SELECTOR_UNIT, validate_selector_unit),
277 	FUNC(UAC_VERSION_3, UAC_FEATURE_UNIT, validate_uac3_feature_unit),
278 	/*  UAC_VERSION_3, UAC3_EFFECT_UNIT: not implemented yet */
279 	FUNC(UAC_VERSION_3, UAC3_PROCESSING_UNIT, validate_processing_unit),
280 	FUNC(UAC_VERSION_3, UAC3_EXTENSION_UNIT, validate_processing_unit),
281 	FIXED(UAC_VERSION_3, UAC3_CLOCK_SOURCE,
282 	      struct uac3_clock_source_descriptor),
283 	FUNC(UAC_VERSION_3, UAC3_CLOCK_SELECTOR, validate_selector_unit),
284 	FIXED(UAC_VERSION_3, UAC3_CLOCK_MULTIPLIER,
285 	      struct uac3_clock_multiplier_descriptor),
286 	/* UAC_VERSION_3, UAC3_SAMPLE_RATE_CONVERTER: not implemented yet */
287 	/* UAC_VERSION_3, UAC3_CONNECTORS: not implemented yet */
288 	{ } /* terminator */
289 };
290 
291 static const struct usb_desc_validator midi_validators[] = {
292 	FIXED(UAC_VERSION_ALL, USB_MS_HEADER,
293 	      struct usb_ms_header_descriptor),
294 	FIXED(UAC_VERSION_ALL, USB_MS_MIDI_IN_JACK,
295 	      struct usb_midi_in_jack_descriptor),
296 	FUNC(UAC_VERSION_ALL, USB_MS_MIDI_OUT_JACK,
297 	     validate_midi_out_jack),
298 	{ } /* terminator */
299 };
300 
301 
302 /* Validate the given unit descriptor, return true if it's OK */
303 static bool validate_desc(unsigned char *hdr, int protocol,
304 			  const struct usb_desc_validator *v)
305 {
306 	if (hdr[1] != USB_DT_CS_INTERFACE)
307 		return true; /* don't care */
308 
309 	for (; v->type; v++) {
310 		if (v->type == hdr[2] &&
311 		    (v->protocol == UAC_VERSION_ALL ||
312 		     v->protocol == protocol)) {
313 			if (v->func)
314 				return v->func(hdr, v);
315 			/* check for the fixed size */
316 			return hdr[0] >= v->size;
317 		}
318 	}
319 
320 	return true; /* not matching, skip validation */
321 }
322 
323 bool snd_usb_validate_audio_desc(void *p, int protocol)
324 {
325 	unsigned char *c = p;
326 	bool valid;
327 
328 	valid = validate_desc(p, protocol, audio_validators);
329 	if (!valid && snd_usb_skip_validation) {
330 		print_hex_dump(KERN_ERR, "USB-audio: buggy audio desc: ",
331 			       DUMP_PREFIX_NONE, 16, 1, c, c[0], true);
332 		valid = true;
333 	}
334 	return valid;
335 }
336 
337 bool snd_usb_validate_midi_desc(void *p)
338 {
339 	unsigned char *c = p;
340 	bool valid;
341 
342 	valid = validate_desc(p, UAC_VERSION_1, midi_validators);
343 	if (!valid && snd_usb_skip_validation) {
344 		print_hex_dump(KERN_ERR, "USB-audio: buggy midi desc: ",
345 			       DUMP_PREFIX_NONE, 16, 1, c, c[0], true);
346 		valid = true;
347 	}
348 	return valid;
349 }
350