1 // SPDX-License-Identifier: GPL-2.0-or-later
3 // Validation of USB-audio class descriptors
9 #include <linux/usb/audio-v2.h>
10 #include <linux/usb/audio-v3.h>
22 #define UAC_VERSION_ALL		(unsigned char)(-1)
28 	const struct uac1_ac_header_descriptor *d = p;  in validate_uac1_header()  local
30 	return d->bLength >= sizeof(*d) &&  in validate_uac1_header()
31 		d->bLength >= sizeof(*d) + d->bInCollection;  in validate_uac1_header()
38 	const struct uac_mixer_unit_descriptor *d = p;  in validate_mixer_unit()  local
41 	if (d->bLength < sizeof(*d) || !d->bNrInPins)  in validate_mixer_unit()
43 	len = sizeof(*d) + d->bNrInPins;  in validate_mixer_unit()
48 	switch (v->protocol) {  in validate_mixer_unit()
51 		len += 2 + 1; /* wChannelConfig, iChannelNames */  in validate_mixer_unit()
53 		len += 1; /* iMixer */  in validate_mixer_unit()
56 		len += 4 + 1; /* bmChannelConfig, iChannelNames */  in validate_mixer_unit()
58 		len += 1 + 1; /* bmControls, iMixer */  in validate_mixer_unit()
65 	return d->bLength >= len;  in validate_mixer_unit()
72 	const struct uac_processing_unit_descriptor *d = p;  in validate_processing_unit()  local
76 	if (d->bLength < sizeof(*d))  in validate_processing_unit()
78 	len = sizeof(*d) + d->bNrInPins;  in validate_processing_unit()
79 	if (d->bLength < len)  in validate_processing_unit()
81 	switch (v->protocol) {  in validate_processing_unit()
85 		len += 1 + 2 + 1;  in validate_processing_unit()
86 		if (d->bLength < len + 1) /* bControlSize */  in validate_processing_unit()
89 		len += 1 + m + 1; /* bControlSize, bmControls, iProcessing */  in validate_processing_unit()
93 		len += 1 + 4 + 1;  in validate_processing_unit()
94 		if (v->type == UAC2_PROCESSING_UNIT_V2)  in validate_processing_unit()
95 			len += 2; /* bmControls -- 2 bytes for PU */  in validate_processing_unit()
97 			len += 1; /* bmControls -- 1 byte for EU */  in validate_processing_unit()
98 		len += 1; /* iProcessing */  in validate_processing_unit()
105 	if (d->bLength < len)  in validate_processing_unit()
108 	switch (v->protocol) {  in validate_processing_unit()
111 		if (v->type == UAC1_EXTENSION_UNIT)  in validate_processing_unit()
113 		switch (le16_to_cpu(d->wProcessType)) {  in validate_processing_unit()
116 			if (d->bLength < len + 1) /* bNrModes */  in validate_processing_unit()
119 			len += 1 + m * 2; /* bNrModes, waModes(n) */  in validate_processing_unit()
126 		if (v->type == UAC2_EXTENSION_UNIT_V2)  in validate_processing_unit()
128 		switch (le16_to_cpu(d->wProcessType)) {  in validate_processing_unit()
131 			if (d->bLength < len + 1) /* bNrModes */  in validate_processing_unit()
134 			len += 1 + m * 4; /* bNrModes, daModes(n) */  in validate_processing_unit()
141 		if (v->type == UAC3_EXTENSION_UNIT) {  in validate_processing_unit()
145 		switch (le16_to_cpu(d->wProcessType)) {  in validate_processing_unit()
147 			if (d->bLength < len + 1) /* bNrModes */  in validate_processing_unit()
150 			len += 1 + m * 2; /* bNrModes, waClusterDescrID(n) */  in validate_processing_unit()
160 	if (d->bLength < len)  in validate_processing_unit()
170 	const struct uac_selector_unit_descriptor *d = p;  in validate_selector_unit()  local
173 	if (d->bLength < sizeof(*d))  in validate_selector_unit()
175 	len = sizeof(*d) + d->bNrInPins;  in validate_selector_unit()
176 	switch (v->protocol) {  in validate_selector_unit()
179 		len += 1; /* iSelector */  in validate_selector_unit()
182 		len += 1 + 1; /* bmControls, iSelector */  in validate_selector_unit()
188 	return d->bLength >= len;  in validate_selector_unit()
194 	const struct uac_feature_unit_descriptor *d = p;  in validate_uac1_feature_unit()  local
196 	if (d->bLength < sizeof(*d) || !d->bControlSize)  in validate_uac1_feature_unit()
199 	return d->bLength >= sizeof(*d) + d->bControlSize + 1;  in validate_uac1_feature_unit()
205 	const struct uac2_feature_unit_descriptor *d = p;  in validate_uac2_feature_unit()  local
207 	if (d->bLength < sizeof(*d))  in validate_uac2_feature_unit()
210 	return d->bLength >= sizeof(*d) + 4 + 1;  in validate_uac2_feature_unit()
216 	const struct uac3_feature_unit_descriptor *d = p;  in validate_uac3_feature_unit()  local
218 	if (d->bLength < sizeof(*d))  in validate_uac3_feature_unit()
221 	return d->bLength >= sizeof(*d) + 4 + 2;  in validate_uac3_feature_unit()
227 	const struct usb_midi_out_jack_descriptor *d = p;  in validate_midi_out_jack()  local
229 	return d->bLength >= sizeof(*d) &&  in validate_midi_out_jack()
230 		d->bLength >= sizeof(*d) + d->bNrInputPins * 2;  in validate_midi_out_jack()
306 	if (hdr[1] != USB_DT_CS_INTERFACE)  in validate_desc()
309 	for (; v->type; v++) {  in validate_desc()
310 		if (v->type == hdr[2] &&  in validate_desc()
311 		    (v->protocol == UAC_VERSION_ALL ||  in validate_desc()
312 		     v->protocol == protocol)) {  in validate_desc()
313 			if (v->func)  in validate_desc()
314 				return v->func(hdr, v);  in validate_desc()
316 			return hdr[0] >= v->size;  in validate_desc()
330 		print_hex_dump(KERN_ERR, "USB-audio: buggy audio desc: ",  in snd_usb_validate_audio_desc()
331 			       DUMP_PREFIX_NONE, 16, 1, c, c[0], true);  in snd_usb_validate_audio_desc()
344 		print_hex_dump(KERN_ERR, "USB-audio: buggy midi desc: ",  in snd_usb_validate_midi_desc()
345 			       DUMP_PREFIX_NONE, 16, 1, c, c[0], true);  in snd_usb_validate_midi_desc()