Repository navigation
math: iir: reject series count that does not divide num_sections - #11318
Open
Shrusti-pk wants to merge 1 commit into
Open
Shrusti-pk wants to merge 1 commit into
Shrusti-pk wants to merge 1 commit into
Conversation
iir_delay_size_df1() is the only check an IIR response header gets before eq_iir, sound_dose and the tdfb direction emphasis filter size the delay lines (4 * num_sections words per channel) and point iir->coef at the blob biquads. It accepts any num_sections_in_series in [1, num_sections]. iir_df1() and its HiFi, ARM and RISC-V variants step the outer loop by num_sections_in_series until it reaches num_sections, so they run ceil(num_sections / nseries) * nseries biquads. When the series count does not divide num_sections the filter reads coefficients past the end of the blob and writes filter state past the delay line. Both values come from the bytes control blob. With num_sections = 11 and num_sections_in_series = 10, 20 biquads run: ASan reports a heap read past the 332 byte blob copy and a heap write past the 352 byte two channel delay allocation in iir_df1(). Require num_sections to be a multiple of num_sections_in_series. Do the same in iir_delay_size_df2t(), which has the identical check. The tuning scripts always set num_sections_in_series to num_sections, so generated blobs are not affected. Add a cmocka case for the validator. Signed-off-by: Shrushti P K <shrusthi@labs.digiscrypt.com>
Shrusti-pk
requested review from
dbaluta,
kv2019i,
lbetlej,
lgirdwood,
mmaka1,
plbossart and
singalsu
as code owners
October 16, 2026 13:43
Collaborator
|
Can one of the admins verify this patch?
|
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The checks safely enforce the processing loops’ requirements, and no blocking issues remain.
No open issues 🎉
What changed in this PR
Extends IIR configuration validation to reject series counts that do not divide the section count, preventing out-of-bounds filter processing.
Changes:
- Adds divisibility checks to both DF1 and DF2T validators.
- Adds a DF1 regression test covering valid and invalid series counts.
| File | Description |
|---|---|
test/cmocka/src/audio/eq_iir/eq_iir_process.c |
Tests series-count validation. |
src/math/iir_df2t.c |
Rejects non-divisible DF2T configurations. |
src/math/iir_df1.c |
Rejects non-divisible DF1 configurations. |
Review effort: Balanced
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
iir_delay_size_df1() range-checks num_sections_in_series (added in #10892) but never requires it to divide num_sections:
The tuning scripts always emit num_sections_in_series == num_sections, so generated blobs still load. sof-testbench4 output for the eqiir16/24/32, gain32 and drc32 benchmark topologies is byte-identical before and after, test-all-defconfigs.sh is green, and the new cmocka case fails without the fix.