audio: module_adapter: clear pipeline back-pointers on create failure - #11158
Open
tmleman wants to merge 1 commit into
Open
audio: module_adapter: clear pipeline back-pointers on create failure#11158tmleman wants to merge 1 commit into
tmleman wants to merge 1 commit into
Conversation
tmleman
requested review from
abonislawski,
kv2019i,
lyakh,
serhiy-katsyuba-intel and
softwarecki
September 2, 2026 12:37
serhiy-katsyuba-intel
approved these changes
Sep 2, 2026
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The change directly addresses a concrete UAF on the creation-failure path with targeted, low-risk pointer cleanup consistent with existing ipc_comp_free() behavior.
Pull request overview
Fixes a use-after-free scenario in IPC4 pipeline handling where a module’s init path can stash a comp_dev * into pipeline->source_comp / sink_comp / sched_comp before module_adapter_new_ext() finishes successfully, leaving stale back-pointers if creation later fails and the dev is freed.
Changes:
- Clear
pipeline->source_comp,pipeline->sink_comp, andpipeline->sched_compif they reference the component being freed on themodule_adapter_new_ext()error path. - Mirror the back-pointer cleanup behavior already present in
ipc_comp_free()for fully-registered components, but apply it to the pre-registration failure path.
File summaries
| File | Description |
|---|---|
| src/audio/module_adapter/module_adapter.c | Adds error-path cleanup to null pipeline back-pointers to a just-freed component, preventing later dereferences in IPC4 pipeline state transitions. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
PR 11158: test resultsRun date: 2026-09-02 19:41 UTC Tested commit: 6b80e8a1d477bd41d50a482600594f081ffc9278
|
A module's init op can store its comp_dev into the parent pipeline's source_comp/sink_comp before module creation completes. When a later step of module_adapter_new_ext fails, the dev is freed on the err: path before it has been added to the IPC component list, so ipc_comp_free back-pointer cleanup never runs for it and pipeline->source_comp/sink_comp is left pointing at freed memory. A subsequent SET_PIPELINE_STATE then dereferences the freed component in ipc4 pipeline_get_host_dev. Found by the IPC4 libFuzzer target under AddressSanitizer. Clear pipeline->source_comp/sink_comp/sched_comp that reference the dev being freed on the creation-failure path, mirroring the cleanup ipc_comp_free already performs for registered components. Signed-off-by: Tomasz Leman <tomasz.m.leman@intel.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A module's init op can store its comp_dev into the parent pipeline's source_comp/sink_comp before module creation completes. When a later step of module_adapter_new_ext fails, the dev is freed on the err: path before it has been added to the IPC component list, so ipc_comp_free back-pointer cleanup never runs for it and
pipeline->source_comp/sink_comp is left pointing at freed memory.
A subsequent SET_PIPELINE_STATE then dereferences the freed component in ipc4 pipeline_get_host_dev.
Found by the IPC4 libFuzzer target under AddressSanitizer.
Clear pipeline->source_comp/sink_comp/sched_comp that reference the dev being freed on the creation-failure path, mirroring the cleanup ipc_comp_free already performs for registered components.