1 // SPDX-License-Identifier: GPL-2.0-or-later
3 // Validation of USB-audio class descriptors
9 #include <linux/usb/audio-v2.h>
10 #include <linux/usb/audio-v3.h>
19 	size_t size;  member
22 #define UAC_VERSION_ALL		(unsigned char)(-1)
30 	return d->bLength >= sizeof(*d) &&  in validate_uac1_header()
31 		d->bLength >= sizeof(*d) + d->bInCollection;  in validate_uac1_header()
41 	if (d->bLength < sizeof(*d) || !d->bNrInPins)  in validate_mixer_unit()
43 	len = sizeof(*d) + d->bNrInPins;  in validate_mixer_unit()
44 	/* We can't determine the bitmap size only from this unit descriptor,  in validate_mixer_unit()
48 	switch (v->protocol) {  in validate_mixer_unit()
65 	return d->bLength >= len;  in validate_mixer_unit()
76 	if (d->bLength < sizeof(*d))  in validate_processing_unit()
78 	len = sizeof(*d) + d->bNrInPins;  in validate_processing_unit()
79 	if (d->bLength < len)  in validate_processing_unit()
81 	switch (v->protocol) {  in validate_processing_unit()
86 		if (d->bLength < len + 1) /* bControlSize */  in validate_processing_unit()
94 		if (v->type == UAC2_PROCESSING_UNIT_V2)  in validate_processing_unit()
95 			len += 2; /* bmControls -- 2 bytes for PU */  in validate_processing_unit()
97 			len += 1; /* bmControls -- 1 byte for EU */  in validate_processing_unit()
105 	if (d->bLength < len)  in validate_processing_unit()
108 	switch (v->protocol) {  in validate_processing_unit()
111 		if (v->type == UAC1_EXTENSION_UNIT)  in validate_processing_unit()
113 		switch (le16_to_cpu(d->wProcessType)) {  in validate_processing_unit()
116 			if (d->bLength < len + 1) /* bNrModes */  in validate_processing_unit()
126 		if (v->type == UAC2_EXTENSION_UNIT_V2)  in validate_processing_unit()
128 		switch (le16_to_cpu(d->wProcessType)) {  in validate_processing_unit()
131 			if (d->bLength < len + 1) /* bNrModes */  in validate_processing_unit()
141 		if (v->type == UAC3_EXTENSION_UNIT) {  in validate_processing_unit()
145 		switch (le16_to_cpu(d->wProcessType)) {  in validate_processing_unit()
147 			if (d->bLength < len + 1) /* bNrModes */  in validate_processing_unit()
160 	if (d->bLength < len)  in validate_processing_unit()
173 	if (d->bLength < sizeof(*d))  in validate_selector_unit()
175 	len = sizeof(*d) + d->bNrInPins;  in validate_selector_unit()
176 	switch (v->protocol) {  in validate_selector_unit()
188 	return d->bLength >= len;  in validate_selector_unit()
196 	if (d->bLength < sizeof(*d) || !d->bControlSize)  in validate_uac1_feature_unit()
199 	return d->bLength >= sizeof(*d) + d->bControlSize + 1;  in validate_uac1_feature_unit()
207 	if (d->bLength < sizeof(*d))  in validate_uac2_feature_unit()
210 	return d->bLength >= sizeof(*d) + 4 + 1;  in validate_uac2_feature_unit()
218 	if (d->bLength < sizeof(*d))  in validate_uac3_feature_unit()
221 	return d->bLength >= sizeof(*d) + 4 + 2;  in validate_uac3_feature_unit()
229 	return d->bLength >= sizeof(*d) &&  in validate_midi_out_jack()
230 		d->bLength >= sizeof(*d) + d->bNrInputPins * 2;  in validate_midi_out_jack()
233 #define FIXED(p, t, s) { .protocol = (p), .type = (t), .size = sizeof(s) }  macro
239 	FIXED(UAC_VERSION_1, UAC_INPUT_TERMINAL,
241 	FIXED(UAC_VERSION_1, UAC_OUTPUT_TERMINAL,
250 	FIXED(UAC_VERSION_2, UAC_HEADER, struct uac2_ac_header_descriptor),
251 	FIXED(UAC_VERSION_2, UAC_INPUT_TERMINAL,
253 	FIXED(UAC_VERSION_2, UAC_OUTPUT_TERMINAL,
261 	FIXED(UAC_VERSION_2, UAC2_CLOCK_SOURCE,
264 	FIXED(UAC_VERSION_2, UAC2_CLOCK_MULTIPLIER,
269 	FIXED(UAC_VERSION_2, UAC_HEADER, struct uac3_ac_header_descriptor),
270 	FIXED(UAC_VERSION_3, UAC_INPUT_TERMINAL,
272 	FIXED(UAC_VERSION_3, UAC_OUTPUT_TERMINAL,
281 	FIXED(UAC_VERSION_3, UAC3_CLOCK_SOURCE,
284 	FIXED(UAC_VERSION_3, UAC3_CLOCK_MULTIPLIER,
292 	FIXED(UAC_VERSION_ALL, USB_MS_HEADER,
294 	FIXED(UAC_VERSION_ALL, USB_MS_MIDI_IN_JACK,
309 	for (; v->type; v++) {  in validate_desc()
310 		if (v->type == hdr[2] &&  in validate_desc()
311 		    (v->protocol == UAC_VERSION_ALL ||  in validate_desc()
312 		     v->protocol == protocol)) {  in validate_desc()
313 			if (v->func)  in validate_desc()
314 				return v->func(hdr, v);  in validate_desc()
315 			/* check for the fixed size */  in validate_desc()
316 			return hdr[0] >= v->size;  in validate_desc()
330 		print_hex_dump(KERN_ERR, "USB-audio: buggy audio desc: ",  in snd_usb_validate_audio_desc()
344 		print_hex_dump(KERN_ERR, "USB-audio: buggy midi desc: ",  in snd_usb_validate_midi_desc()