Skip to content

Commit 8ed9be4

Browse files
committed
audio: copier: add NULL converter validation to prevent DSP crashes
Multi-sink copier configurations can have uninitialized converter function pointers. This causes EXCCAUSE 20 (NULL function pointer dereference) crashes during audio processing. This patch adds validation checks in do_conversion_copy() and copier_module_copy() to detect NULL converter functions and return proper error codes instead of crashing the DSP. Signed-off-by: Tomasz Leman <tomasz.m.leman@intel.com>
1 parent 24dea7f commit 8ed9be4

File tree

1 file changed

+13
-0
lines changed

1 file changed

+13
-0
lines changed

src/audio/copier/copier.c

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -545,6 +545,12 @@ static int do_conversion_copy(struct comp_dev *dev,
545545
return -EINVAL;
546546
buffer_stream_invalidate(src, processed_data->source_bytes);
547547

548+
/* Validate converter function pointer to prevent NULL dereference crash */
549+
if (!cd->converter[i]) {
550+
comp_err(mod->dev, "NULL converter function for sink_queue_id=%d", i);
551+
return -EFAULT;
552+
}
553+
548554
cd->converter[i](&src->stream, 0, &sink->stream, 0,
549555
processed_data->frames * audio_stream_get_channels(&src->stream),
550556
DUMMY_CHMAP);
@@ -625,6 +631,13 @@ static int copier_module_copy(struct processing_module *mod,
625631

626632
source_samples = processed_data.frames *
627633
audio_stream_get_channels(input_buffers[0].data);
634+
/* Validate converter function pointer to prevent NULL dereference crash */
635+
if (!cd->converter[sink_queue_id]) {
636+
comp_err(mod->dev, "NULL converter function for sink_queue_id=%d",
637+
sink_queue_id);
638+
return -EFAULT;
639+
}
640+
628641
cd->converter[sink_queue_id](input_buffers[0].data, 0,
629642
output_buffers[i].data, 0,
630643
source_samples, DUMMY_CHMAP);

0 commit comments

Comments
 (0)