Skip to content

Commit b6ecb8f

Browse files
tmlemanlgirdwood
authored andcommitted
copier: fix queue ID extraction using correct IPC4 macro
Fix NULL pointer dereference crash in copier module by using the correct IPC4 macro to extract queue IDs from buffer IDs. The issue occurred in do_conversion_copy() and copier_module_copy() when accessing cd->converter[i] where i was extracted using IPC4_SINK_QUEUE_ID(). This was incorrect because buffer IDs are constructed as: IPC4_COMP_ID(src_queue, dst_queue) From the buffer's perspective, the copier's sink is actually the source, so IPC4_SRC_QUEUE_ID() should be used to get the correct copier sink index. Using IPC4_SINK_QUEUE_ID() extracted the dst_queue (upper 16 bits) instead of src_queue (lower 16 bits), leading to wrong array indices and NULL pointer crashes when the converter array wasn't initialized for those indices. This resolves crashes in RTC AEC topologies where internal module copiers have buffer IDs that map to non-zero queue IDs. Signed-off-by: Tomasz Leman <tomasz.m.leman@intel.com>
1 parent cea0631 commit b6ecb8f

File tree

1 file changed

+12
-2
lines changed

1 file changed

+12
-2
lines changed

src/audio/copier/copier.c

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -540,7 +540,12 @@ static int do_conversion_copy(struct comp_dev *dev,
540540

541541
comp_get_copy_limits(src, sink, processed_data);
542542

543-
i = IPC4_SINK_QUEUE_ID(buf_get_id(sink));
543+
/*
544+
* Buffer ID is constructed as IPC4_COMP_ID(src_queue, dst_queue).
545+
* From the buffer's perspective, copier's sink is the source,
546+
* so we use IPC4_SRC_QUEUE_ID() to get the correct copier sink index.
547+
*/
548+
i = IPC4_SRC_QUEUE_ID(buf_get_id(sink));
544549
if (i >= IPC4_COPIER_MODULE_OUTPUT_PINS_COUNT)
545550
return -EINVAL;
546551
buffer_stream_invalidate(src, processed_data->source_bytes);
@@ -617,7 +622,12 @@ static int copier_module_copy(struct processing_module *mod,
617622
uint32_t source_samples;
618623
int sink_queue_id;
619624

620-
sink_queue_id = IPC4_SINK_QUEUE_ID(buf_get_id(sink_c));
625+
/*
626+
* Buffer ID is constructed as IPC4_COMP_ID(src_queue, dst_queue).
627+
* From the buffer's perspective, copier's sink is the source,
628+
* so we use IPC4_SRC_QUEUE_ID() to get the correct copier sink index.
629+
*/
630+
sink_queue_id = IPC4_SRC_QUEUE_ID(buf_get_id(sink_c));
621631
if (sink_queue_id >= IPC4_COPIER_MODULE_OUTPUT_PINS_COUNT)
622632
return -EINVAL;
623633

0 commit comments

Comments
 (0)