From df32cb30bcab4e67193bdbc6d47da936842a5fd4 Mon Sep 17 00:00:00 2001 From: Tomasz Leman Date: Wed, 14 Oct 2026 12:42:20 +0200 Subject: [PATCH] audio: selector: check source and sink buffers before prepare The IPC4 fuzzer hit a NULL pointer dereference in selector_prepare(). ASan reports a READ SEGV at address 0x10 in audio_buffer_hw_params_configured() reached from set_selector_params(), UBSan reports "member access within null pointer of type 'struct comp_buffer'" at selector.c set_selector_params(). The host can instantiate a selector (MICSEL) in a pipeline and send SET_PIPELINE_STATE before binding any buffers to it. Prepare then runs with empty source and sink lists, and set_selector_params() takes comp_dev_get_first_data_producer() == NULL and dereferences src_buf->audio_buffer.audio_stream_params (offset 0x10). The rest of selector_verify_params() and selector_prepare() also use the first producer/consumer without checking them. look the sink/source count at the start of selector_prepare() and fail with -ENOTCONN if either is missing, as rtnr does. Valid topologies always bind the selector before prepare, so this does not reject legitimate configurations. Signed-off-by: Tomasz Leman --- src/audio/selector/selector.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/audio/selector/selector.c b/src/audio/selector/selector.c index 285a48396e4f..e68845ad99ad 100644 --- a/src/audio/selector/selector.c +++ b/src/audio/selector/selector.c @@ -1089,6 +1089,11 @@ static int selector_prepare(struct processing_module *mod, comp_dbg(dev, "entry"); + if (!num_of_sources || !num_of_sinks) { + comp_err(dev, "no source or sink buffer"); + return -ENOTCONN; + } + ret = selector_params(mod); if (ret < 0) return ret;