Skip to content

Audio: Fix the init() in modules to not initialize bytes control with invalid data #10646

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
singalsu wants to merge 8 commits into
base: main
Choose a base branch
from
+38 −189
Draft

Audio: Fix the init() in modules to not initialize bytes control with invalid data #10646

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
a0e6da2
Audio: EQ FIR: Remove bytes control blob set from init()
singalsu Mar 23, 2026
05e2ce1
Audio: EQ IIR: Remove bytes control blob set from init()
singalsu Mar 23, 2026
53cd9f3
Audio: TDFB: Same init() cleanup
singalsu Mar 23, 2026
aee54eb
Audio: DRC: Same init() cleanup
singalsu Mar 23, 2026
c7ddaf4
Audio: DC block: same for init()
singalsu Mar 23, 2026
1f98fbe
Audio: Crossover: same for init()
singalsu Mar 23, 2026
9d94cfb
Audio: Multi-band DRC: Same for init()
singalsu Mar 23, 2026
f9b0c16
Audio: MFCC: Same for MFCC init()
singalsu Mar 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 4 additions & 18 deletions src/audio/crossover/crossover.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,19 +296,10 @@ static int crossover_init(struct processing_module *mod)
struct module_data *md = &mod->priv;
struct comp_dev *dev = mod->dev;
struct comp_data *cd;
const struct module_config *ipc_crossover = &md->cfg;
size_t bs = ipc_crossover->size;
int ret;

comp_info(dev, "entry");

/* Check that the coefficients blob size is sane */
if (bs > SOF_CROSSOVER_MAX_SIZE) {
comp_err(dev, "blob size (%d) exceeds maximum allowed size (%i)",
bs, SOF_CROSSOVER_MAX_SIZE);
return -ENOMEM;
}

cd = mod_zalloc(mod, sizeof(*cd));
if (!cd)
return -ENOMEM;
Expand All @@ -323,13 +314,6 @@ static int crossover_init(struct processing_module *mod)
goto cd_fail;
}

/* Get configuration data and reset Crossover state */
ret = comp_init_data_blob(cd->model_handler, bs, ipc_crossover->data);
if (ret < 0) {
comp_err(dev, "comp_init_data_blob() failed.");
goto cd_fail;
}

ret = crossover_output_pin_init(mod);
if (ret < 0) {
comp_err(dev, "failed.");
Expand Down Expand Up @@ -527,6 +511,7 @@ static int crossover_prepare(struct processing_module *mod,
struct comp_data *cd = module_get_private_data(mod);
struct comp_dev *dev = mod->dev;
struct comp_buffer *source, *sink;
size_t data_size;
int channels;

comp_info(dev, "entry");
Expand Down Expand Up @@ -558,10 +543,11 @@ static int crossover_prepare(struct processing_module *mod,
comp_info(dev, "source_format=%d, sink_formats=%d, nch=%d",
cd->source_format, cd->source_format, channels);

cd->config = comp_get_data_blob(cd->model_handler, NULL, NULL);
cd->config = comp_get_data_blob(cd->model_handler, &data_size, NULL);

/* Initialize Crossover */
if (cd->config && crossover_validate_config(mod, cd->config) < 0) {
if (cd->config && data_size > 0 &&
crossover_validate_config(mod, cd->config) < 0) {
/* If config is invalid then delete it */
comp_err(dev, "invalid binary config format");
crossover_free_config(&cd->config);
Expand Down
25 changes: 5 additions & 20 deletions src/audio/dcblock/dcblock.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,10 +80,7 @@ static int dcblock_init(struct processing_module *mod)
{
struct module_data *md = &mod->priv;
struct comp_dev *dev = mod->dev;
struct module_config *ipc_dcblock = &md->cfg;
struct comp_data *cd;
size_t bs = ipc_dcblock->size;
int ret;

comp_info(dev, "entry");

Expand All @@ -98,24 +95,11 @@ static int dcblock_init(struct processing_module *mod)
cd->model_handler = comp_data_blob_handler_new(dev);
if (!cd->model_handler) {
comp_err(dev, "comp_data_blob_handler_new() failed.");
ret = -ENOMEM;
goto err_cd;
}

ret = comp_init_data_blob(cd->model_handler, bs, ipc_dcblock->data);
if (ret < 0) {
comp_err(dev, "comp_init_data_blob() failed with error: %d", ret);
goto err_model_cd;
rfree(cd);
return -ENOMEM;
}

return 0;

err_model_cd:
comp_data_blob_handler_free(cd->model_handler);

err_cd:
rfree(cd);
return ret;
}

/**
Expand Down Expand Up @@ -190,6 +174,7 @@ static int dcblock_prepare(struct processing_module *mod,
struct comp_data *cd = module_get_private_data(mod);
struct comp_buffer *sourceb, *sinkb;
struct comp_dev *dev = mod->dev;
size_t data_size;

comp_info(dev, "entry");

Expand Down Expand Up @@ -219,8 +204,8 @@ static int dcblock_prepare(struct processing_module *mod,
comp_info(mod->dev, "source_format=%d, sink_format=%d",
cd->source_format, cd->sink_format);

cd->config = comp_get_data_blob(cd->model_handler, NULL, NULL);
if (cd->config)
cd->config = comp_get_data_blob(cd->model_handler, &data_size, NULL);
if (cd->config && data_size > 0)
dcblock_copy_coefficients(mod);
else
dcblock_set_passthrough(mod);
Expand Down
23 changes: 3 additions & 20 deletions src/audio/drc/drc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,24 +147,13 @@ __cold static int drc_init(struct processing_module *mod)
{
struct module_data *md = &mod->priv;
struct comp_dev *dev = mod->dev;
struct module_config *cfg = &md->cfg;
struct drc_comp_data *cd;
size_t bs = cfg->size;
int ret;

assert_can_be_cold();

comp_info(dev, "entry");

/* Check first before proceeding with dev and cd that coefficients
* blob size is sane.
*/
if (bs > SOF_DRC_MAX_SIZE) {
comp_err(dev, "error: configuration blob size = %u > %d",
bs, SOF_DRC_MAX_SIZE);
return -EINVAL;
}

cd = mod_zalloc(mod, sizeof(*cd));
if (!cd)
return -ENOMEM;
Expand All @@ -179,13 +168,6 @@ __cold static int drc_init(struct processing_module *mod)
goto cd_fail;
}

/* Get configuration data and reset DRC state */
ret = comp_init_data_blob(cd->model_handler, bs, cfg->data);
if (ret < 0) {
comp_err(dev, "comp_init_data_blob() failed.");
goto cd_fail;
}

drc_reset_state(mod, &cd->state);

/* Initialize DRC to enabled. If defined by topology, a control may set
Expand Down Expand Up @@ -344,6 +326,7 @@ static int drc_prepare(struct processing_module *mod,
struct drc_comp_data *cd = module_get_private_data(mod);
struct comp_buffer *sourceb, *sinkb;
struct comp_dev *dev = mod->dev;
size_t data_size;
int channels;
int rate;
int ret;
Expand All @@ -369,8 +352,8 @@ static int drc_prepare(struct processing_module *mod,

/* Initialize DRC */
comp_info(dev, "source_format=%d", cd->source_format);
cd->config = comp_get_data_blob(cd->model_handler, NULL, NULL);
if (cd->config) {
cd->config = comp_get_data_blob(cd->model_handler, &data_size, NULL);
if (cd->config && data_size > 0) {
ret = drc_setup(mod, channels, rate);
if (ret < 0) {
comp_err(dev, "error: drc_setup failed.");
Expand Down
36 changes: 5 additions & 31 deletions src/audio/eq_fir/eq_fir.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -247,23 +247,11 @@ static int eq_fir_init(struct processing_module *mod)
{
struct module_data *md = &mod->priv;
struct comp_dev *dev = mod->dev;
struct module_config *cfg = &md->cfg;
struct comp_data *cd = NULL;
size_t bs = cfg->size;
int i;
int ret;

comp_info(dev, "entry");

/* Check first before proceeding with dev and cd that coefficients
* blob size is sane.
*/
if (bs > SOF_EQ_FIR_MAX_SIZE) {
comp_err(dev, "coefficients blob size = %zu > SOF_EQ_FIR_MAX_SIZE",
bs);
return -EINVAL;
}

cd = mod_zalloc(mod, sizeof(*cd));
if (!cd)
return -ENOMEM;
Expand All @@ -277,31 +265,16 @@ static int eq_fir_init(struct processing_module *mod)
cd->model_handler = mod_data_blob_handler_new(mod);
if (!cd->model_handler) {
comp_err(dev, "mod_data_blob_handler_new() failed.");
ret = -ENOMEM;
goto err;
mod_free(mod, cd);
return -ENOMEM;
}

md->private = cd;

/* Allocate and make a copy of the coefficients blob and reset FIR. If
* the EQ is configured later in run-time the size is zero.
*/
ret = comp_init_data_blob(cd->model_handler, bs, cfg->init_data);
if (ret < 0) {
comp_err(dev, "comp_init_data_blob() failed.");
goto err_init;
}

for (i = 0; i < PLATFORM_MAX_CHANNELS; i++)
fir_reset(&cd->fir[i]);

return 0;

err_init:
mod_data_blob_handler_free(mod, cd->model_handler);
err:
mod_free(mod, cd);
return ret;
}

static int eq_fir_free(struct processing_module *mod)
Expand Down Expand Up @@ -413,6 +386,7 @@ static int eq_fir_prepare(struct processing_module *mod,
int channels;
enum sof_ipc_frame frame_fmt;
int ret = 0;
size_t data_size;

comp_dbg(dev, "entry");

Expand All @@ -435,8 +409,8 @@ static int eq_fir_prepare(struct processing_module *mod,
frame_fmt = audio_stream_get_frm_fmt(&sourceb->stream);

cd->eq_fir_func = eq_fir_passthrough;
cd->config = comp_get_data_blob(cd->model_handler, NULL, NULL);
if (cd->config) {
cd->config = comp_get_data_blob(cd->model_handler, &data_size, NULL);
if (cd->config && data_size > 0) {
ret = eq_fir_setup(mod, channels);
if (ret < 0)
comp_err(dev, "eq_fir_setup failed.");
Expand Down
34 changes: 7 additions & 27 deletions src/audio/eq_iir/eq_iir.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,19 +44,11 @@ static int eq_iir_init(struct processing_module *mod)
{
struct module_data *md = &mod->priv;
struct comp_dev *dev = mod->dev;
struct module_config *cfg = &md->cfg;
struct comp_data *cd;
size_t bs = cfg->size;
int i, ret;
int i;

comp_info(dev, "entry");

/* Check first before proceeding with dev and cd that coefficients blob size is sane */
if (bs > SOF_EQ_IIR_MAX_SIZE) {
comp_err(dev, "coefficients blob size %zu exceeds maximum", bs);
return -EINVAL;
}

cd = mod_zalloc(mod, sizeof(*cd));
if (!cd)
return -ENOMEM;
Expand All @@ -67,28 +59,15 @@ static int eq_iir_init(struct processing_module *mod)
cd->model_handler = mod_data_blob_handler_new(mod);
if (!cd->model_handler) {
comp_err(dev, "mod_data_blob_handler_new() failed.");
ret = -ENOMEM;
goto err;
}

/* Allocate and make a copy of the coefficients blob and reset IIR. If
* the EQ is configured later in run-time the size is zero.
*/
ret = comp_init_data_blob(cd->model_handler, bs, cfg->data);
if (ret < 0) {
comp_err(dev, "comp_init_data_blob() failed with error: %d", ret);
goto err;
mod_data_blob_handler_free(mod, cd->model_handler);
mod_free(mod, cd);
return -ENOMEM;
}

for (i = 0; i < PLATFORM_MAX_CHANNELS; i++)
iir_reset_df1(&cd->iir[i]);

return 0;

err:
mod_data_blob_handler_free(mod, cd->model_handler);
mod_free(mod, cd);
return ret;
}

static int eq_iir_free(struct processing_module *mod)
Expand Down Expand Up @@ -180,6 +159,7 @@ static int eq_iir_prepare(struct processing_module *mod,
struct comp_dev *dev = mod->dev;
enum sof_ipc_frame source_format;
enum sof_ipc_frame sink_format;
size_t data_size;
int channels;
int ret = 0;

Expand All @@ -204,7 +184,7 @@ static int eq_iir_prepare(struct processing_module *mod,
source_format = audio_stream_get_frm_fmt(&sourceb->stream);
sink_format = audio_stream_get_frm_fmt(&sinkb->stream);

cd->config = comp_get_data_blob(cd->model_handler, NULL, NULL);
cd->config = comp_get_data_blob(cd->model_handler, &data_size, NULL);

/* Initialize EQ */
comp_info(dev, "source_format=%d, sink_format=%d",
Expand All @@ -213,7 +193,7 @@ static int eq_iir_prepare(struct processing_module *mod,
eq_iir_set_passthrough_func(cd, source_format, sink_format);

/* Initialize EQ */
if (cd->config) {
if (cd->config && data_size > 0) {
ret = eq_iir_new_blob(mod, source_format, sink_format, channels);
if (ret)
return ret;
Expand Down
33 changes: 5 additions & 28 deletions src/audio/mfcc/mfcc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,20 +72,10 @@ static int mfcc_init(struct processing_module *mod)
{
struct module_data *md = &mod->priv;
struct comp_dev *dev = mod->dev;
struct module_config *cfg = &md->cfg;
struct mfcc_comp_data *cd = NULL;
size_t bs = cfg->size;
int ret;

comp_info(dev, "entry");

/* Check first that configuration blob size is sane */
if (bs > SOF_MFCC_CONFIG_MAX_SIZE) {
comp_err(dev, "error: configuration blob size %zu exceeds %d",
bs, SOF_MFCC_CONFIG_MAX_SIZE);
return -EINVAL;
}

cd = mod_zalloc(mod, sizeof(*cd));
if (!cd)
return -ENOMEM;
Expand All @@ -95,25 +85,11 @@ static int mfcc_init(struct processing_module *mod)
cd->model_handler = mod_data_blob_handler_new(mod);
if (!cd->model_handler) {
comp_err(dev, "comp_data_blob_handler_new() failed.");
ret = -ENOMEM;
goto err;
}

/* Get configuration data */
ret = comp_init_data_blob(cd->model_handler, bs, cfg->init_data);
if (ret < 0) {
comp_err(mod->dev, "comp_init_data_blob() failed.");
goto err_init;
mod_free(mod, cd);
return -ENOMEM;
}

return 0;

err_init:
comp_data_blob_handler_free(cd->model_handler);

err:
mod_free(mod, cd);
return ret;
}

static int mfcc_free(struct processing_module *mod)
Expand Down Expand Up @@ -183,6 +159,7 @@ static int mfcc_prepare(struct processing_module *mod,
struct comp_dev *dev = mod->dev;
enum sof_ipc_frame source_format;
enum sof_ipc_frame sink_format;
size_t data_size;
uint32_t sink_period_bytes;
int ret;

Expand Down Expand Up @@ -211,10 +188,10 @@ static int mfcc_prepare(struct processing_module *mod,
goto err;
}

cd->config = comp_get_data_blob(cd->model_handler, NULL, NULL);
cd->config = comp_get_data_blob(cd->model_handler, &data_size, NULL);

/* Initialize MFCC, max_frames is set to dev->frames + 4 */
if (cd->config) {
if (cd->config && data_size > 0) {
ret = mfcc_setup(mod, dev->frames + 4, audio_stream_get_rate(&sourceb->stream),
audio_stream_get_channels(&sourceb->stream));
if (ret < 0) {
Expand Down
Loading
Loading