Skip to content

mux: validation fixes #10885

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
abonislawski wants to merge 3 commits into
base: main
Choose a base branch
from
+27 −7
Open

mux: validation fixes #10885

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ddc9b53
mux: ipc4: validate channels_count before building mask
abonislawski Jun 11, 2026
75c0ff7
mux: ipc4: reject out-of-range source queue ID
abonislawski Jun 11, 2026
0c6ba92
mux: ipc3: enforce mux_mix_check result
abonislawski Jun 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion src/audio/mux/mux_ipc3.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,8 +70,10 @@ static int mux_set_values(struct processing_module *mod)
}

if (cd->comp_type == SOF_COMP_MUX) {
if (mux_mix_check(cfg))
if (mux_mix_check(cfg)) {
comp_err(dev, "mux component is not able to mix channels");
return -EINVAL;
}
}

for (i = 0; i < cfg->num_streams; i++) {
Expand Down
30 changes: 24 additions & 6 deletions src/audio/mux/mux_ipc4.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,22 +36,34 @@ static int build_config(struct processing_module *mod, struct mux_data *cfg)
{
struct comp_dev *dev = mod->dev;
struct comp_data *cd = module_get_private_data(mod);
uint32_t base_ch = cfg->base_cfg.audio_fmt.channels_count;
uint32_t ref_ch = cfg->reference_format.channels_count;
uint32_t out_ch = cfg->output_format.channels_count;
Comment thread
abonislawski marked this conversation as resolved.
int mask = 1;
int i;

/* base+reference map 1:1 to contiguous output channels: sink width
* must equal their sum and fit the 8-bit output mask
*/
if (base_ch + ref_ch > PLATFORM_MAX_CHANNELS || out_ch != base_ch + ref_ch) {
comp_err(dev, "invalid channel count: base %u + reference %u -> output %u (max %d)",
base_ch, ref_ch, out_ch, PLATFORM_MAX_CHANNELS);
return -EINVAL;
}

cd->config.num_streams = MUX_MAX_STREAMS;

/* clear masks */
for (i = 0; i < cd->config.num_streams; i++)
memset(cd->config.streams[i].mask, 0, sizeof(cd->config.streams[i].mask));

/* Setting masks for streams */
for (i = 0; i < cfg->base_cfg.audio_fmt.channels_count; i++) {
for (i = 0; i < base_ch; i++) {
cd->config.streams[0].mask[i] = mask;
mask <<= 1;
}

for (i = 0; i < cfg->reference_format.channels_count; i++) {
for (i = 0; i < ref_ch; i++) {
cd->config.streams[1].mask[i] = mask;
mask <<= 1;
}
Expand All @@ -68,7 +80,7 @@ static int build_config(struct processing_module *mod, struct mux_data *cfg)
* set up param then verify param. BTW for IPC3 path, the param is sent by
* host driver.
*/
static void set_mux_params(struct processing_module *mod, struct mux_data *cfg)
static int set_mux_params(struct processing_module *mod, struct mux_data *cfg)
{
struct sof_ipc_stream_params *params = mod->stream_params;
struct comp_data *cd = module_get_private_data(mod);
Expand Down Expand Up @@ -107,6 +119,12 @@ static void set_mux_params(struct processing_module *mod, struct mux_data *cfg)

comp_dev_for_each_producer(dev, source) {
j = IPC4_SINK_QUEUE_ID(buf_get_id(source));
/* host-supplied queue ID indexes streams[] */
if (j >= MUX_MAX_STREAMS) {
comp_err(dev, "invalid source queue ID %d (valid range 0..%d)",
j, MUX_MAX_STREAMS - 1);
return -EINVAL;
}
cd->config.streams[j].pipeline_id = buffer_pipeline_id(source);
if (j == BASE_CFG_QUEUED_ID)
audio_fmt = &cfg->base_cfg.audio_fmt;
Expand All @@ -118,6 +136,8 @@ static void set_mux_params(struct processing_module *mod, struct mux_data *cfg)
}

mux_prepare_look_up_table(mod);

return 0;
}

int mux_params(struct processing_module *mod)
Expand All @@ -137,8 +157,6 @@ int mux_params(struct processing_module *mod)
if (ret < 0)
return ret;

set_mux_params(mod, cfg);

return ret;
return set_mux_params(mod, cfg);
}
#endif /* CONFIG_COMP_MUX */
Loading