audio: don't rely on correct IPC order

lyakh · ranj063 · commit 960976a1626c · 2025-05-12T13:52:58.000-07:00
If the host sends IPCs to the DSP in wrong order, .prepare() can be
called without correctly initialised buffers. Add checks everywhere
where this can cause NULL dereference.

Signed-off-by: Guennadi Liakhovetski &lt;guennadi.liakhovetski@linux.intel.com&gt;
diff --git a/src/audio/aria/aria.c b/src/audio/aria/aria.c
@@ -190,9 +190,13 @@ static int aria_prepare(struct processing_module *mod,
 	comp_info(dev, "aria_prepare()");
 
 	source = comp_dev_get_first_data_producer(dev);
-	aria_set_stream_params(source, mod);
-
 	sink = comp_dev_get_first_data_consumer(dev);
+	if (!source || !sink) {
+		comp_err(dev, "no source or sink buffer");
+		return -ENOTCONN;
+	}
+
+	aria_set_stream_params(source, mod);
 	aria_set_stream_params(sink, mod);
 
 	if (audio_stream_get_valid_fmt(&source->stream) != SOF_IPC_FRAME_S24_4LE ||
diff --git a/src/audio/asrc/asrc.c b/src/audio/asrc/asrc.c
@@ -399,6 +399,10 @@ static int asrc_params(struct processing_module *mod)
 
 	sourceb = comp_dev_get_first_data_producer(dev);
 	sinkb = comp_dev_get_first_data_consumer(dev);
+	if (!sourceb || !sinkb) {
+		comp_err(dev, "no source or sink buffer");
+		return -ENOTCONN;
+	}
 
 	/* update the source/sink buffer formats. Sink rate will be modified below */
 	asrc_update_buffer_format(sourceb, cd);
@@ -549,7 +553,10 @@ static int asrc_prepare(struct processing_module *mod,
 	if (ret < 0)
 		return ret;
 
-	/* SRC component will only ever have 1 source and 1 sink buffer */
+	/*
+	 * SRC component will only ever have 1 source and 1 sink buffer,
+	 * asrc_params() has checked their validity already
+	 */
 	sourceb = comp_dev_get_first_data_producer(dev);
 	sinkb = comp_dev_get_first_data_consumer(dev);
 
diff --git a/src/audio/crossover/crossover.c b/src/audio/crossover/crossover.c
@@ -534,11 +534,16 @@ static int crossover_prepare(struct processing_module *mod,
 
 	comp_info(dev, "crossover_prepare()");
 
+	source = comp_dev_get_first_data_producer(dev);
+	if (!source) {
+		comp_err(dev, "no source buffer");
+		return -ENOTCONN;
+	}
+
 	crossover_params(mod);
 
 	/* Crossover has a variable number of sinks */
 	mod->max_sinks = SOF_CROSSOVER_MAX_STREAMS;
-	source = comp_dev_get_first_data_producer(dev);
 
 	/* Get source data format */
 	cd->source_format = audio_stream_get_frm_fmt(&source->stream);
diff --git a/src/audio/crossover/crossover_ipc4.c b/src/audio/crossover/crossover_ipc4.c
@@ -118,6 +118,7 @@ void crossover_params(struct processing_module *mod)
 	ipc4_base_module_cfg_to_stream_params(&mod->priv.cfg.base_cfg, params);
 	component_set_nearest_period_frames(dev, params->rate);
 
+	/* First producer verified by the caller */
 	sourceb = comp_dev_get_first_data_producer(dev);
 	ipc4_update_buffer_format(sourceb, &mod->priv.cfg.base_cfg.audio_fmt);
 
diff --git a/src/audio/dcblock/dcblock.c b/src/audio/dcblock/dcblock.c
@@ -195,11 +195,15 @@ static int dcblock_prepare(struct processing_module *mod,
 
 	comp_info(dev, "dcblock_prepare()");
 
-	dcblock_params(mod);
-
 	/* DC Filter component will only ever have one source and sink buffer */
 	sourceb = comp_dev_get_first_data_producer(dev);
 	sinkb = comp_dev_get_first_data_consumer(dev);
+	if (!sourceb || !sinkb) {
+		comp_err(dev, "no source or sink buffer");
+		return -ENOTCONN;
+	}
+
+	dcblock_params(mod);
 
 	/* get source data format */
 	cd->source_format = audio_stream_get_frm_fmt(&sourceb->stream);
diff --git a/src/audio/dcblock/dcblock_ipc4.c b/src/audio/dcblock/dcblock_ipc4.c
@@ -61,6 +61,8 @@ void dcblock_params(struct processing_module *mod)
 	ipc4_base_module_cfg_to_stream_params(&mod->priv.cfg.base_cfg, params);
 	component_set_nearest_period_frames(dev, params->rate);
 
+	/* The caller has verified, that sink and source buffers are connected */
+
 	sinkb = comp_dev_get_first_data_consumer(dev);
 	ipc4_update_buffer_format(sinkb, &mod->priv.cfg.base_cfg.audio_fmt);
 
diff --git a/src/audio/drc/drc.c b/src/audio/drc/drc.c
@@ -326,6 +326,8 @@ static void drc_params(struct processing_module *mod)
 	ipc4_base_module_cfg_to_stream_params(&mod->priv.cfg.base_cfg, params);
 	component_set_nearest_period_frames(dev, params->rate);
 
+	/* The caller has verified, that sink and source buffers are connected */
+
 	sinkb = comp_dev_get_first_data_consumer(dev);
 	ipc4_update_buffer_format(sinkb, &mod->priv.cfg.base_cfg.audio_fmt);
 
@@ -347,13 +349,17 @@ static int drc_prepare(struct processing_module *mod,
 
 	comp_info(dev, "drc_prepare()");
 
-#if CONFIG_IPC_MAJOR_4
-	drc_params(mod);
-#endif
-
 	/* DRC component will only ever have 1 source and 1 sink buffer */
 	sourceb = comp_dev_get_first_data_producer(dev);
 	sinkb = comp_dev_get_first_data_consumer(dev);
+	if (!sourceb || !sinkb) {
+		comp_err(dev, "no source or sink buffer");
+		return -ENOTCONN;
+	}
+
+#if CONFIG_IPC_MAJOR_4
+	drc_params(mod);
+#endif
 
 	/* get source data format */
 	cd->source_format = audio_stream_get_frm_fmt(&sourceb->stream);
diff --git a/src/audio/eq_fir/eq_fir.c b/src/audio/eq_fir/eq_fir.c
@@ -416,15 +416,20 @@ static int eq_fir_prepare(struct processing_module *mod,
 
 	comp_dbg(dev, "eq_fir_prepare()");
 
+	/* EQ component will only ever have 1 source and 1 sink buffer. */
+	sourceb = comp_dev_get_first_data_producer(dev);
+	sinkb = comp_dev_get_first_data_consumer(dev);
+	if (!sourceb || !sinkb) {
+		comp_err(dev, "no source or sink buffer");
+		return -ENOTCONN;
+	}
+
 	ret = eq_fir_params(mod);
 	if (ret < 0) {
 		comp_set_state(dev, COMP_TRIGGER_RESET);
 		return ret;
 	}
 
-	/* EQ component will only ever have 1 source and 1 sink buffer. */
-	sourceb = comp_dev_get_first_data_producer(dev);
-	sinkb = comp_dev_get_first_data_consumer(dev);
 	eq_fir_set_alignment(&sourceb->stream, &sinkb->stream);
 	channels = audio_stream_get_channels(&sinkb->stream);
 	frame_fmt = audio_stream_get_frm_fmt(&sourceb->stream);
diff --git a/src/audio/eq_fir/eq_fir_ipc4.c b/src/audio/eq_fir/eq_fir_ipc4.c
@@ -59,6 +59,8 @@ int eq_fir_params(struct processing_module *mod)
 	ipc4_base_module_cfg_to_stream_params(&mod->priv.cfg.base_cfg, params);
 	component_set_nearest_period_frames(dev, params->rate);
 
+	/* The caller has verified, that sink and source buffers are connected */
+
 	sourceb = comp_dev_get_first_data_producer(dev);
 	ipc4_update_buffer_format(sourceb, &mod->priv.cfg.base_cfg.audio_fmt);
 
diff --git a/src/audio/eq_iir/eq_iir.c b/src/audio/eq_iir/eq_iir.c
@@ -187,13 +187,18 @@ static int eq_iir_prepare(struct processing_module *mod,
 
 	comp_dbg(dev, "eq_iir_prepare()");
 
+	/* EQ component will only ever have 1 source and 1 sink buffer */
+	sourceb = comp_dev_get_first_data_producer(dev);
+	sinkb = comp_dev_get_first_data_consumer(dev);
+	if (!sourceb || !sinkb) {
+		comp_err(dev, "no source or sink buffer");
+		return -ENOTCONN;
+	}
+
 	ret = eq_iir_prepare_sub(mod);
 	if (ret < 0)
 		return ret;
 
-	/* EQ component will only ever have 1 source and 1 sink buffer */
-	sourceb = comp_dev_get_first_data_producer(dev);
-	sinkb = comp_dev_get_first_data_consumer(dev);
 	eq_iir_set_alignment(&sourceb->stream, &sinkb->stream);
 
 	/* get source and sink data format */
diff --git a/src/audio/eq_iir/eq_iir_ipc3.c b/src/audio/eq_iir/eq_iir_ipc3.c
@@ -272,6 +272,8 @@ static int eq_iir_verify_params(struct comp_dev *dev,
 
 	comp_dbg(dev, "eq_iir_verify_params()");
 
+	/* The caller has verified, that sink and source buffers are connected */
+
 	/* EQ component will only ever have 1 source and 1 sink buffer */
 	sourceb = comp_dev_get_first_data_producer(dev);
 	sinkb = comp_dev_get_first_data_consumer(dev);
diff --git a/src/audio/eq_iir/eq_iir_ipc4.c b/src/audio/eq_iir/eq_iir_ipc4.c
@@ -124,6 +124,8 @@ static int eq_iir_params(struct processing_module *mod)
 		comp_params.chmap[i] = (mod->priv.cfg.base_cfg.audio_fmt.ch_map >> i * 4) & 0xf;
 
 	component_set_nearest_period_frames(dev, comp_params.rate);
+
+	/* The caller has verified, that sink and source buffers are connected */
 	sinkb = comp_dev_get_first_data_consumer(dev);
 	return buffer_set_params(sinkb, &comp_params, true);
 }
diff --git a/src/audio/google/google_ctc_audio_processing.c b/src/audio/google/google_ctc_audio_processing.c
@@ -355,6 +355,11 @@ static int ctc_prepare(struct processing_module *mod,
 	comp_info(mod->dev, "ctc_prepare()");
 
 	source = comp_dev_get_first_data_producer(dev);
+	if (!source) {
+		comp_err(dev, "no source buffer");
+		return -ENOTCONN;
+	}
+
 	switch (audio_stream_get_frm_fmt(&source->stream)) {
 #if CONFIG_FORMAT_S16LE
 	case SOF_IPC_FRAME_S16_LE:
diff --git a/src/audio/igo_nr/igo_nr.c b/src/audio/igo_nr/igo_nr.c
@@ -818,6 +818,11 @@ static int32_t igo_nr_prepare(struct processing_module *mod,
 
 	comp_dbg(dev, "igo_nr_prepare()");
 
+	if (!source || !sink) {
+		comp_err(dev, "no source or sink");
+		return -ENOTCONN;
+	}
+
 #if CONFIG_IPC_MAJOR_4
 	ret = igo_nr_ipc4_params(mod, source, sink);
 	if (ret) {
diff --git a/src/audio/mfcc/mfcc.c b/src/audio/mfcc/mfcc.c
@@ -193,6 +193,10 @@ static int mfcc_prepare(struct processing_module *mod,
 	/* MFCC component will only ever have 1 source and 1 sink buffer */
 	sourceb = comp_dev_get_first_data_producer(dev);
 	sinkb = comp_dev_get_first_data_consumer(dev);
+	if (!sourceb || !sinkb) {
+		comp_err(dev, "no source or sink");
+		return -ENOTCONN;
+	}
 
 	/* get source data format */
 	source_format = audio_stream_get_frm_fmt(&sourceb->stream);
diff --git a/src/audio/mixer/mixer.c b/src/audio/mixer/mixer.c
@@ -214,6 +214,11 @@ static int mixer_prepare(struct processing_module *mod,
 	struct comp_buffer *sink;
 
 	sink = comp_dev_get_first_data_consumer(dev);
+	if (!sink) {
+		comp_err(dev, "no sink");
+		return -ENOTCONN;
+	}
+
 	md->mix_func = mixer_get_processing_function(dev, sink);
 	mixer_set_frame_alignment(&sink->stream);
 
diff --git a/src/audio/module_adapter/module/waves/waves.c b/src/audio/module_adapter/module/waves/waves.c
@@ -226,6 +226,11 @@ static int waves_effect_check(struct comp_dev *dev)
 	/* Init sink & source buffers */
 	comp_dbg(dev, "waves_effect_check() start");
 
+	if (!source || !sink) {
+		comp_err(dev, "no source or sink buffer");
+		return -ENOTCONN;
+	}
+
 	/* todo use fallback to comp_verify_params when ready */
 
 	/* resampling not supported */
diff --git a/src/audio/multiband_drc/multiband_drc.c b/src/audio/multiband_drc/multiband_drc.c
@@ -378,6 +378,10 @@ static int multiband_drc_prepare(struct processing_module *mod,
 
 	/* DRC component will only ever have 1 source and 1 sink buffer */
 	sourceb = comp_dev_get_first_data_producer(dev);
+	if (!sourceb) {
+		comp_err(dev, "no source buffer");
+		return -ENOTCONN;
+	}
 
 	/* get source data format */
 	cd->source_format = audio_stream_get_frm_fmt(&sourceb->stream);
diff --git a/src/audio/multiband_drc/multiband_drc_ipc4.c b/src/audio/multiband_drc/multiband_drc_ipc4.c
@@ -101,6 +101,10 @@ int multiband_drc_params(struct processing_module *mod)
 
 	component_set_nearest_period_frames(dev, comp_params.rate);
 	sinkb = comp_dev_get_first_data_consumer(dev);
+	if (!sinkb) {
+		comp_err(dev, "no sink buffer");
+		return -ENOTCONN;
+	}
 
 	return buffer_set_params(sinkb, &comp_params, true);
 }
diff --git a/src/audio/rtnr/rtnr.c b/src/audio/rtnr/rtnr.c
@@ -780,6 +780,8 @@ static void rtnr_params(struct processing_module *mod)
 	ipc4_base_module_cfg_to_stream_params(&mod->priv.cfg.base_cfg, params);
 	component_set_nearest_period_frames(dev, params->rate);
 
+	/* The caller has checked validity of source and sink buffers */
+
 	sourceb = comp_dev_get_first_data_producer(dev);
 	ipc4_update_buffer_format(sourceb, &mod->priv.cfg.base_cfg.audio_fmt);
 
@@ -799,6 +801,13 @@ static int rtnr_prepare(struct processing_module *mod,
 
 	comp_dbg(dev, "rtnr_prepare()");
 
+	sinkb = comp_dev_get_first_data_consumer(dev);
+	sourceb = comp_dev_get_first_data_producer(dev);
+	if (!sourceb || !sinkb) {
+		comp_err(dev, "no source or sink buffer");
+		return -ENOTCONN;
+	}
+
 #if CONFIG_IPC_MAJOR_4
 	rtnr_params(mod);
 #endif
@@ -813,10 +822,8 @@ static int rtnr_prepare(struct processing_module *mod,
 	/* Initialize RTNR */
 
 	/* Get sink data format */
-	sinkb = comp_dev_get_first_data_consumer(dev);
 	cd->sink_format = audio_stream_get_frm_fmt(&sinkb->stream);
 	cd->sink_stream.frame_fmt = audio_stream_get_frm_fmt(&sinkb->stream);
-	sourceb = comp_dev_get_first_data_producer(dev);
 	ret = rtnr_check_params(mod, &sourceb->stream, &sinkb->stream);
 	if (ret)
 		goto err;
diff --git a/src/audio/selector/selector.c b/src/audio/selector/selector.c
@@ -427,6 +427,10 @@ static int selector_prepare(struct comp_dev *dev)
 	/* selector component will have 1 source and 1 sink buffer */
 	sourceb = comp_dev_get_first_data_producer(dev);
 	sinkb = comp_dev_get_first_data_consumer(dev);
+	if (!sourceb || !sinkb) {
+		comp_err(dev, "no source or sink buffer");
+		return -ENOTCONN;
+	}
 
 	/* get source data format and period bytes */
 	cd->source_format = audio_stream_get_frm_fmt(&sourceb->stream);
diff --git a/src/audio/smart_amp/smart_amp.c b/src/audio/smart_amp/smart_amp.c
@@ -755,6 +755,10 @@ static int smart_amp_prepare(struct comp_dev *dev)
 
 	/* sink buffer */
 	sad->sink_buf = comp_dev_get_first_data_consumer(dev);
+	if (!sad->sink_buf) {
+		comp_err(dev, "no sink buffer");
+		return -ENOTCONN;
+	}
 
 	/* get frame format and channels param of stream and feedback source */
 	ff_src_fmt = audio_stream_get_frm_fmt(&sad->source_buf->stream);
diff --git a/src/audio/tdfb/tdfb.c b/src/audio/tdfb/tdfb.c
@@ -731,15 +731,20 @@ static int tdfb_prepare(struct processing_module *mod,
 
 	comp_info(dev, "tdfb_prepare()");
 
+	/* Find source and sink buffers */
+	sourceb = comp_dev_get_first_data_producer(dev);
+	sinkb = comp_dev_get_first_data_consumer(dev);
+	if (!sourceb || !sinkb) {
+		comp_err(dev, "no source or sink buffer");
+		return -ENOTCONN;
+	}
+
 	ret = tdfb_params(mod);
 	if (ret) {
 		comp_err(dev, "Failed tdfb_params()");
 		return ret;
 	}
 
-	/* Find source and sink buffers */
-	sourceb = comp_dev_get_first_data_producer(dev);
-	sinkb = comp_dev_get_first_data_consumer(dev);
 	tdfb_set_alignment(&sourceb->stream, &sinkb->stream);
 
 	frame_fmt = audio_stream_get_frm_fmt(&sourceb->stream);
diff --git a/src/audio/tdfb/tdfb_ipc4.c b/src/audio/tdfb/tdfb_ipc4.c
@@ -199,6 +199,8 @@ int tdfb_params(struct processing_module *mod)
 
 	ipc4_base_module_cfg_to_stream_params(&mod->priv.cfg.base_cfg, params);
 	component_set_nearest_period_frames(dev, params->rate);
+
+	/* The caller has verified source and sink buffer validity */
 	sourceb = comp_dev_get_first_data_producer(dev);
 	ipc4_update_buffer_format(sourceb, &mod->priv.cfg.input_pins[0].audio_fmt);
 
diff --git a/src/audio/tone.c b/src/audio/tone.c
@@ -429,8 +429,11 @@ static int tone_params(struct comp_dev *dev,
 	struct comp_buffer *sourceb, *sinkb;
 
 	sourceb = comp_dev_get_first_data_producer(dev);
-
 	sinkb = comp_dev_get_first_data_consumer(dev);
+	if (!sourceb || !sinkb) {
+		comp_err(dev, "no source or sink buffer");
+		return -ENOTCONN;
+	}
 
 	comp_info(dev, "tone_params(), config->frame_fmt = %u",
 		  dev->ipc_config.frame_fmt);
@@ -671,6 +674,10 @@ static int tone_prepare(struct comp_dev *dev)
 		return PPL_STATUS_PATH_STOP;
 
 	sourceb = comp_dev_get_first_data_producer(dev);
+	if (!sourceb) {
+		comp_err(dev, "no source buffer");
+		return -ENOTCONN;
+	}
 
 	cd->channels = audio_stream_get_channels(&sourceb->stream);
 	comp_info(dev, "tone_prepare(), cd->channels = %u, cd->rate = %u",
diff --git a/src/audio/volume/volume.c b/src/audio/volume/volume.c
diff --git a/src/audio/volume/volume_ipc4.c b/src/audio/volume/volume_ipc4.c
diff --git a/src/ipc/ipc-helper.c b/src/ipc/ipc-helper.c
diff --git a/src/samples/audio/smart_amp_test_ipc3.c b/src/samples/audio/smart_amp_test_ipc3.c
