Skip to content

Conversation

@lyakh
Copy link
Collaborator

@lyakh lyakh commented May 2, 2025

An invalid IPC flow can trigger a NULL pointer dereference when handling a TRIGGER operation. Add the missing checks.

lyakh added 2 commits May 2, 2025 16:53
If .trigger() is wrongly called on a pipeline, that isn't connected
to a DAI, its edge component will hit a NULL buffer, which then has
to be checked.

Signed-off-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
It is possible that both the source and the sink component are
inactive in ipc_buffer_free(), Add an explicit check for this. The
present code behaves correctly now as well, because it checks for
active_comp->state > COMP_STATE_READY, but active component
misidentification is confusing.

Signed-off-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
@ranj063
Copy link
Collaborator

ranj063 commented May 2, 2025

@lyakh this is awesome. I have hit this several times if the order in which the widgets are set up and connected doesnt confirm to the source->sink ordering. How did you discover this?

@lyakh
Copy link
Collaborator Author

lyakh commented May 2, 2025

@lyakh this is awesome. I have hit this several times if the order in which the widgets are set up and connected doesnt confirm to the source->sink ordering. How did you discover this?

@ranj063 by reading the code, while working on #9563

@lgirdwood
Copy link
Member

@wszypelt @lrudyX not expecting this fix to fail tests. Good to merge ?

@wszypelt
Copy link

wszypelt commented May 5, 2025

@lgirdwood Internal Intel CI build and tests passed :)

@kv2019i kv2019i merged commit a36b63f into thesofproject:main May 5, 2025
42 of 51 checks passed
@lyakh lyakh deleted the nullbuff branch May 5, 2025 12:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants