Skip to content

audio: fix NULL buffer-peer dereferences on IPC3 half-connected pipelines #11060

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tmleman wants to merge 2 commits into
base: main
Choose a base branch
from
+14 −5
Open

audio: fix NULL buffer-peer dereferences on IPC3 half-connected pipelines #11060

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8d59dd2
audio: selector: guard against missing source component in trigger
tmleman Jul 21, 2026
94776bf
audio: pipeline: guard NULL buffer peer in pipeline_get_dai_comp
tmleman Aug 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions src/audio/pipeline/pipeline-graph.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -506,8 +506,10 @@ struct comp_dev *pipeline_get_dai_comp(uint32_t pipeline_id, int dir)
buffer = buffer_from_list(blist->next, dir);
comp = buffer_get_comp(buffer, dir);

/* buffer_comp is in another pipeline and it is not complete */
if (!comp->pipeline)
/* A half-connected buffer has no peer component on this side, or
* buffer_comp is in another pipeline and it is not complete.
*/
Comment thread
tmleman marked this conversation as resolved.
if (!comp || !comp->pipeline)
return NULL;

crt = ipc_get_ppl_comp(ipc, comp->pipeline->pipeline_id, dir);
Expand Down
13 changes: 10 additions & 3 deletions src/audio/selector/selector.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -411,7 +411,7 @@ static int selector_cmd(struct comp_dev *dev, int cmd, void *data,
static int selector_trigger(struct comp_dev *dev, int cmd)
{
struct comp_buffer *sourceb;
enum sof_comp_type type;
struct comp_dev *source_comp;
int ret;

comp_dbg(dev, "entry");
Expand All @@ -423,16 +423,23 @@ static int selector_trigger(struct comp_dev *dev, int cmd)
}

ret = comp_set_state(dev, cmd);
if (ret < 0)
return ret;
if (ret == COMP_STATUS_STATE_ALREADY_SET)
ret = 0;

/* TODO: remove in the future after adding support for case when
* kpb_init_draining() and kpb_draining_task() are interrupted by
* new pipeline_task()
*/
type = dev_comp_type(comp_buffer_get_source_component(sourceb));
/* The source buffer may be present without an attached producer
* component (e.g. a partially connected pipeline), so guard against a
* NULL source component before dereferencing it.
*/
source_comp = comp_buffer_get_source_component(sourceb);

return type == SOF_COMP_KPB ? PPL_STATUS_PATH_TERMINATE : ret;
return source_comp && dev_comp_type(source_comp) == SOF_COMP_KPB ?
PPL_STATUS_PATH_TERMINATE : ret;
}

/**
Expand Down
Loading