cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

validate.c (10230B)


      1// SPDX-License-Identifier: GPL-2.0-or-later
      2//
      3// Validation of USB-audio class descriptors
      4//
      5
      6#include <linux/init.h>
      7#include <linux/usb.h>
      8#include <linux/usb/audio.h>
      9#include <linux/usb/audio-v2.h>
     10#include <linux/usb/audio-v3.h>
     11#include <linux/usb/midi.h>
     12#include "usbaudio.h"
     13#include "helper.h"
     14
     15struct usb_desc_validator {
     16	unsigned char protocol;
     17	unsigned char type;
     18	bool (*func)(const void *p, const struct usb_desc_validator *v);
     19	size_t size;
     20};
     21
     22#define UAC_VERSION_ALL		(unsigned char)(-1)
     23
     24/* UAC1 only */
     25static bool validate_uac1_header(const void *p,
     26				 const struct usb_desc_validator *v)
     27{
     28	const struct uac1_ac_header_descriptor *d = p;
     29
     30	return d->bLength >= sizeof(*d) &&
     31		d->bLength >= sizeof(*d) + d->bInCollection;
     32}
     33
     34/* for mixer unit; covering all UACs */
     35static bool validate_mixer_unit(const void *p,
     36				const struct usb_desc_validator *v)
     37{
     38	const struct uac_mixer_unit_descriptor *d = p;
     39	size_t len;
     40
     41	if (d->bLength < sizeof(*d) || !d->bNrInPins)
     42		return false;
     43	len = sizeof(*d) + d->bNrInPins;
     44	/* We can't determine the bitmap size only from this unit descriptor,
     45	 * so just check with the remaining length.
     46	 * The actual bitmap is checked at mixer unit parser.
     47	 */
     48	switch (v->protocol) {
     49	case UAC_VERSION_1:
     50	default:
     51		len += 2 + 1; /* wChannelConfig, iChannelNames */
     52		/* bmControls[n*m] */
     53		len += 1; /* iMixer */
     54		break;
     55	case UAC_VERSION_2:
     56		len += 4 + 1; /* bmChannelConfig, iChannelNames */
     57		/* bmMixerControls[n*m] */
     58		len += 1 + 1; /* bmControls, iMixer */
     59		break;
     60	case UAC_VERSION_3:
     61		len += 2; /* wClusterDescrID */
     62		/* bmMixerControls[n*m] */
     63		break;
     64	}
     65	return d->bLength >= len;
     66}
     67
     68/* both for processing and extension units; covering all UACs */
     69static bool validate_processing_unit(const void *p,
     70				     const struct usb_desc_validator *v)
     71{
     72	const struct uac_processing_unit_descriptor *d = p;
     73	const unsigned char *hdr = p;
     74	size_t len, m;
     75
     76	if (d->bLength < sizeof(*d))
     77		return false;
     78	len = sizeof(*d) + d->bNrInPins;
     79	if (d->bLength < len)
     80		return false;
     81	switch (v->protocol) {
     82	case UAC_VERSION_1:
     83	default:
     84		/* bNrChannels, wChannelConfig, iChannelNames */
     85		len += 1 + 2 + 1;
     86		if (d->bLength < len + 1) /* bControlSize */
     87			return false;
     88		m = hdr[len];
     89		len += 1 + m + 1; /* bControlSize, bmControls, iProcessing */
     90		break;
     91	case UAC_VERSION_2:
     92		/* bNrChannels, bmChannelConfig, iChannelNames */
     93		len += 1 + 4 + 1;
     94		if (v->type == UAC2_PROCESSING_UNIT_V2)
     95			len += 2; /* bmControls -- 2 bytes for PU */
     96		else
     97			len += 1; /* bmControls -- 1 byte for EU */
     98		len += 1; /* iProcessing */
     99		break;
    100	case UAC_VERSION_3:
    101		/* wProcessingDescrStr, bmControls */
    102		len += 2 + 4;
    103		break;
    104	}
    105	if (d->bLength < len)
    106		return false;
    107
    108	switch (v->protocol) {
    109	case UAC_VERSION_1:
    110	default:
    111		if (v->type == UAC1_EXTENSION_UNIT)
    112			return true; /* OK */
    113		switch (le16_to_cpu(d->wProcessType)) {
    114		case UAC_PROCESS_UP_DOWNMIX:
    115		case UAC_PROCESS_DOLBY_PROLOGIC:
    116			if (d->bLength < len + 1) /* bNrModes */
    117				return false;
    118			m = hdr[len];
    119			len += 1 + m * 2; /* bNrModes, waModes(n) */
    120			break;
    121		default:
    122			break;
    123		}
    124		break;
    125	case UAC_VERSION_2:
    126		if (v->type == UAC2_EXTENSION_UNIT_V2)
    127			return true; /* OK */
    128		switch (le16_to_cpu(d->wProcessType)) {
    129		case UAC2_PROCESS_UP_DOWNMIX:
    130		case UAC2_PROCESS_DOLBY_PROLOCIC: /* SiC! */
    131			if (d->bLength < len + 1) /* bNrModes */
    132				return false;
    133			m = hdr[len];
    134			len += 1 + m * 4; /* bNrModes, daModes(n) */
    135			break;
    136		default:
    137			break;
    138		}
    139		break;
    140	case UAC_VERSION_3:
    141		if (v->type == UAC3_EXTENSION_UNIT) {
    142			len += 2; /* wClusterDescrID */
    143			break;
    144		}
    145		switch (le16_to_cpu(d->wProcessType)) {
    146		case UAC3_PROCESS_UP_DOWNMIX:
    147			if (d->bLength < len + 1) /* bNrModes */
    148				return false;
    149			m = hdr[len];
    150			len += 1 + m * 2; /* bNrModes, waClusterDescrID(n) */
    151			break;
    152		case UAC3_PROCESS_MULTI_FUNCTION:
    153			len += 2 + 4; /* wClusterDescrID, bmAlgorighms */
    154			break;
    155		default:
    156			break;
    157		}
    158		break;
    159	}
    160	if (d->bLength < len)
    161		return false;
    162
    163	return true;
    164}
    165
    166/* both for selector and clock selector units; covering all UACs */
    167static bool validate_selector_unit(const void *p,
    168				   const struct usb_desc_validator *v)
    169{
    170	const struct uac_selector_unit_descriptor *d = p;
    171	size_t len;
    172
    173	if (d->bLength < sizeof(*d))
    174		return false;
    175	len = sizeof(*d) + d->bNrInPins;
    176	switch (v->protocol) {
    177	case UAC_VERSION_1:
    178	default:
    179		len += 1; /* iSelector */
    180		break;
    181	case UAC_VERSION_2:
    182		len += 1 + 1; /* bmControls, iSelector */
    183		break;
    184	case UAC_VERSION_3:
    185		len += 4 + 2; /* bmControls, wSelectorDescrStr */
    186		break;
    187	}
    188	return d->bLength >= len;
    189}
    190
    191static bool validate_uac1_feature_unit(const void *p,
    192				       const struct usb_desc_validator *v)
    193{
    194	const struct uac_feature_unit_descriptor *d = p;
    195
    196	if (d->bLength < sizeof(*d) || !d->bControlSize)
    197		return false;
    198	/* at least bmaControls(0) for master channel + iFeature */
    199	return d->bLength >= sizeof(*d) + d->bControlSize + 1;
    200}
    201
    202static bool validate_uac2_feature_unit(const void *p,
    203				       const struct usb_desc_validator *v)
    204{
    205	const struct uac2_feature_unit_descriptor *d = p;
    206
    207	if (d->bLength < sizeof(*d))
    208		return false;
    209	/* at least bmaControls(0) for master channel + iFeature */
    210	return d->bLength >= sizeof(*d) + 4 + 1;
    211}
    212
    213static bool validate_uac3_feature_unit(const void *p,
    214				       const struct usb_desc_validator *v)
    215{
    216	const struct uac3_feature_unit_descriptor *d = p;
    217
    218	if (d->bLength < sizeof(*d))
    219		return false;
    220	/* at least bmaControls(0) for master channel + wFeatureDescrStr */
    221	return d->bLength >= sizeof(*d) + 4 + 2;
    222}
    223
    224static bool validate_midi_out_jack(const void *p,
    225				   const struct usb_desc_validator *v)
    226{
    227	const struct usb_midi_out_jack_descriptor *d = p;
    228
    229	return d->bLength >= sizeof(*d) &&
    230		d->bLength >= sizeof(*d) + d->bNrInputPins * 2;
    231}
    232
    233#define FIXED(p, t, s) { .protocol = (p), .type = (t), .size = sizeof(s) }
    234#define FUNC(p, t, f) { .protocol = (p), .type = (t), .func = (f) }
    235
    236static const struct usb_desc_validator audio_validators[] = {
    237	/* UAC1 */
    238	FUNC(UAC_VERSION_1, UAC_HEADER, validate_uac1_header),
    239	FIXED(UAC_VERSION_1, UAC_INPUT_TERMINAL,
    240	      struct uac_input_terminal_descriptor),
    241	FIXED(UAC_VERSION_1, UAC_OUTPUT_TERMINAL,
    242	      struct uac1_output_terminal_descriptor),
    243	FUNC(UAC_VERSION_1, UAC_MIXER_UNIT, validate_mixer_unit),
    244	FUNC(UAC_VERSION_1, UAC_SELECTOR_UNIT, validate_selector_unit),
    245	FUNC(UAC_VERSION_1, UAC_FEATURE_UNIT, validate_uac1_feature_unit),
    246	FUNC(UAC_VERSION_1, UAC1_PROCESSING_UNIT, validate_processing_unit),
    247	FUNC(UAC_VERSION_1, UAC1_EXTENSION_UNIT, validate_processing_unit),
    248
    249	/* UAC2 */
    250	FIXED(UAC_VERSION_2, UAC_HEADER, struct uac2_ac_header_descriptor),
    251	FIXED(UAC_VERSION_2, UAC_INPUT_TERMINAL,
    252	      struct uac2_input_terminal_descriptor),
    253	FIXED(UAC_VERSION_2, UAC_OUTPUT_TERMINAL,
    254	      struct uac2_output_terminal_descriptor),
    255	FUNC(UAC_VERSION_2, UAC_MIXER_UNIT, validate_mixer_unit),
    256	FUNC(UAC_VERSION_2, UAC_SELECTOR_UNIT, validate_selector_unit),
    257	FUNC(UAC_VERSION_2, UAC_FEATURE_UNIT, validate_uac2_feature_unit),
    258	/* UAC_VERSION_2, UAC2_EFFECT_UNIT: not implemented yet */
    259	FUNC(UAC_VERSION_2, UAC2_PROCESSING_UNIT_V2, validate_processing_unit),
    260	FUNC(UAC_VERSION_2, UAC2_EXTENSION_UNIT_V2, validate_processing_unit),
    261	FIXED(UAC_VERSION_2, UAC2_CLOCK_SOURCE,
    262	      struct uac_clock_source_descriptor),
    263	FUNC(UAC_VERSION_2, UAC2_CLOCK_SELECTOR, validate_selector_unit),
    264	FIXED(UAC_VERSION_2, UAC2_CLOCK_MULTIPLIER,
    265	      struct uac_clock_multiplier_descriptor),
    266	/* UAC_VERSION_2, UAC2_SAMPLE_RATE_CONVERTER: not implemented yet */
    267
    268	/* UAC3 */
    269	FIXED(UAC_VERSION_2, UAC_HEADER, struct uac3_ac_header_descriptor),
    270	FIXED(UAC_VERSION_3, UAC_INPUT_TERMINAL,
    271	      struct uac3_input_terminal_descriptor),
    272	FIXED(UAC_VERSION_3, UAC_OUTPUT_TERMINAL,
    273	      struct uac3_output_terminal_descriptor),
    274	/* UAC_VERSION_3, UAC3_EXTENDED_TERMINAL: not implemented yet */
    275	FUNC(UAC_VERSION_3, UAC3_MIXER_UNIT, validate_mixer_unit),
    276	FUNC(UAC_VERSION_3, UAC3_SELECTOR_UNIT, validate_selector_unit),
    277	FUNC(UAC_VERSION_3, UAC_FEATURE_UNIT, validate_uac3_feature_unit),
    278	/*  UAC_VERSION_3, UAC3_EFFECT_UNIT: not implemented yet */
    279	FUNC(UAC_VERSION_3, UAC3_PROCESSING_UNIT, validate_processing_unit),
    280	FUNC(UAC_VERSION_3, UAC3_EXTENSION_UNIT, validate_processing_unit),
    281	FIXED(UAC_VERSION_3, UAC3_CLOCK_SOURCE,
    282	      struct uac3_clock_source_descriptor),
    283	FUNC(UAC_VERSION_3, UAC3_CLOCK_SELECTOR, validate_selector_unit),
    284	FIXED(UAC_VERSION_3, UAC3_CLOCK_MULTIPLIER,
    285	      struct uac3_clock_multiplier_descriptor),
    286	/* UAC_VERSION_3, UAC3_SAMPLE_RATE_CONVERTER: not implemented yet */
    287	/* UAC_VERSION_3, UAC3_CONNECTORS: not implemented yet */
    288	{ } /* terminator */
    289};
    290
    291static const struct usb_desc_validator midi_validators[] = {
    292	FIXED(UAC_VERSION_ALL, USB_MS_HEADER,
    293	      struct usb_ms_header_descriptor),
    294	FIXED(UAC_VERSION_ALL, USB_MS_MIDI_IN_JACK,
    295	      struct usb_midi_in_jack_descriptor),
    296	FUNC(UAC_VERSION_ALL, USB_MS_MIDI_OUT_JACK,
    297	     validate_midi_out_jack),
    298	{ } /* terminator */
    299};
    300
    301
    302/* Validate the given unit descriptor, return true if it's OK */
    303static bool validate_desc(unsigned char *hdr, int protocol,
    304			  const struct usb_desc_validator *v)
    305{
    306	if (hdr[1] != USB_DT_CS_INTERFACE)
    307		return true; /* don't care */
    308
    309	for (; v->type; v++) {
    310		if (v->type == hdr[2] &&
    311		    (v->protocol == UAC_VERSION_ALL ||
    312		     v->protocol == protocol)) {
    313			if (v->func)
    314				return v->func(hdr, v);
    315			/* check for the fixed size */
    316			return hdr[0] >= v->size;
    317		}
    318	}
    319
    320	return true; /* not matching, skip validation */
    321}
    322
    323bool snd_usb_validate_audio_desc(void *p, int protocol)
    324{
    325	unsigned char *c = p;
    326	bool valid;
    327
    328	valid = validate_desc(p, protocol, audio_validators);
    329	if (!valid && snd_usb_skip_validation) {
    330		print_hex_dump(KERN_ERR, "USB-audio: buggy audio desc: ",
    331			       DUMP_PREFIX_NONE, 16, 1, c, c[0], true);
    332		valid = true;
    333	}
    334	return valid;
    335}
    336
    337bool snd_usb_validate_midi_desc(void *p)
    338{
    339	unsigned char *c = p;
    340	bool valid;
    341
    342	valid = validate_desc(p, UAC_VERSION_1, midi_validators);
    343	if (!valid && snd_usb_skip_validation) {
    344		print_hex_dump(KERN_ERR, "USB-audio: buggy midi desc: ",
    345			       DUMP_PREFIX_NONE, 16, 1, c, c[0], true);
    346		valid = true;
    347	}
    348	return valid;
    349}