Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Topic/module - Test Ignore #2

Closed
wants to merge 12 commits into from
Closed

Topic/module - Test Ignore #2

wants to merge 12 commits into from

Conversation

lgirdwood
Copy link
Member

Test Request - Ignore

@lrgirdwo
ipc: page tables; Make page table API generic for use outside IPC core
45e6b91 
Allow users outside of IPC to make use of compressed host page tables.

Signed-off-by: Liam Girdwood <[email protected]>
@lrgirdwo
core: symbols: Add support for building a symbol table.
804e290 
Build a symbol table to support runtime loading and linking of external
modules. This can be enabled/disabled via configure.

Signed-off-by: Liam Girdwood <[email protected]>
@lrgirdwo
core: symbols: Export common functions into symbol table
ebc9286 
Export commonly used functions into the symbol table.

Signed-off-by: Liam Girdwood <[email protected]>
@lrgirdwo
core: linker: Add runtime linker for xtensa architecture
2f2e30f 
Add a runtime module linker for the xtensa architecture. This will
support
loading external modules at runtime and linking them with symbols in the
symbol table.

Signed-off-by: Liam Girdwood <[email protected]>
@lrgirdwo
core: modules: Add external module template
946ad2a 
Template code showing how to create an external module.

Signed-off-by: Liam Girdwood <[email protected]>
@lrgirdwo
rimage: add support to build and sign runtime modules
5e59c6e 
Currently rimage only supports building ELF images with know TEXT, DATA
and BSS addresses. This patch adds support to build runtime relocatable
modules that can be loaded linked into the base SOF FW at runtime.

Signed-off-by: Liam Girdwood <[email protected]>
@lrgirdwo
uapi: ipc: Add executable memory flag
2f29d89 
Add flag to mark memory as executable.

Signed-off-by: Liam Girdwood <[email protected]>
@lrgirdwo
host: linker: Add relocator stubs - WIP
f216fa8 
Signed-off-by: Liam Girdwood <[email protected]>
@lrgirdwo
test: Add unit test for runtime linker.
b6f79d0 
Signed-off-by: Liam Girdwood <[email protected]>
@lrgirdwo
module: Add template module.
18547ef 
This module does nothing but can be copied as template code.

Signed-off-by: Liam Girdwood <[email protected]>
@lrgirdwo
module platf isa
595b8bc 
Signed-off-by: Liam Girdwood <[email protected]>
@lrgirdwo
xtensa: reloc: Add more support for other reloc types.
2c92275 
To be squashed.

Signed-off-by: Liam Girdwood <[email protected]>
@lgirdwood lgirdwood added the enhancement New feature or request label Jun 5, 2018
@lgirdwood lgirdwood added this to the 1.2 milestone Jun 5, 2018
@lgirdwood lgirdwood self-assigned this Jun 5, 2018
lgirdwood
lgirdwood commented Jun 5, 2018
View reviewed changes
Copy link
Member Author

@lgirdwood lgirdwood left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Test feedback

src/ipc/handler.c
@@ -83,134 +83,6 @@ static inline struct sof_ipc_hdr *mailbox_validate(void)
return hdr;
}

#ifdef CONFIG_HOST_PTABLE
static void dma_complete(void *data, uint32_t type, struct dma_sg_elem *next)
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Test - Ignore. Comment

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

test for code review comment.

@lgirdwood lgirdwood closed this Jun 20, 2018
@singalsu singalsu mentioned this pull request Aug 10, 2018
Merged
@lgirdwood lgirdwood mentioned this pull request Aug 20, 2018
Closed
@ranj063 ranj063 mentioned this pull request Apr 19, 2019
Closed
@keyonjie keyonjie mentioned this pull request Sep 6, 2019
Closed
@pfps pfps mentioned this pull request Dec 5, 2019
Closed
@kv2019i kv2019i mentioned this pull request Dec 13, 2019
Closed
@ktrzcinx ktrzcinx mentioned this pull request Jan 15, 2020
Merged
@emilchudzik emilchudzik mentioned this pull request Mar 9, 2020
Closed
@sinahuang sinahuang mentioned this pull request Mar 17, 2020
Closed
RDharageswari pushed a commit to RDharageswari/sof that referenced this pull request Jun 6, 2020
@nhorman @davem330
sctp: Don't add the shutdown timer if its already been added
20a785a 
This BUG halt was reported a while back, but the patch somehow got
missed:

PID: 2879   TASK: c16adaa0  CPU: 1   COMMAND: "sctpn"
 #0 [f418dd28] crash_kexec at c04a7d8c
 thesofproject#1 [f418dd7c] oops_end at c0863e02
 thesofproject#2 [f418dd90] do_invalid_op at c040aaca
 thesofproject#3 [f418de28] error_code (via invalid_op) at c08631a5
    EAX: f34baac0  EBX: 00000090  ECX: f418deb0  EDX: f5542950  EBP: 00000000
    DS:  007b      ESI: f34ba800  ES:  007b      EDI: f418dea0  GS:  00e0
    CS:  0060      EIP: c046fa5e  ERR: ffffffff  EFLAGS: 00010286
 thesofproject#4 [f418de5c] add_timer at c046fa5e
 thesofproject#5 [f418de68] sctp_do_sm at f8db8c77 [sctp]
 thesofproject#6 [f418df30] sctp_primitive_SHUTDOWN at f8dcc1b5 [sctp]
 thesofproject#7 [f418df48] inet_shutdown at c080baf9
 thesofproject#8 [f418df5c] sys_shutdown at c079eedf
 thesofproject#9 [f418df70] sys_socketcall at c079fe88
    EAX: ffffffda  EBX: 0000000d  ECX: bfceea90  EDX: 0937af98
    DS:  007b      ESI: 0000000c  ES:  007b      EDI: b7150ae4
    SS:  007b      ESP: bfceea7c  EBP: bfceeaa8  GS:  0033
    CS:  0073      EIP: b775c424  ERR: 00000066  EFLAGS: 00000282

It appears that the side effect that starts the shutdown timer was processed
multiple times, which can happen as multiple paths can trigger it.  This of
course leads to the BUG halt in add_timer getting called.

Fix seems pretty straightforward, just check before the timer is added if its
already been started.  If it has mod the timer instead to min(current
expiration, new expiration)

Its been tested but not confirmed to fix the problem, as the issue has only
occured in production environments where test kernels are enjoined from being
installed.  It appears to be a sane fix to me though.  Also, recentely,
Jere found a reproducer posted on list to confirm that this resolves the
issues

Signed-off-by: Neil Horman <[email protected]>
CC: Vlad Yasevich <[email protected]>
CC: "David S. Miller" <[email protected]>
CC: [email protected]
CC: [email protected]
CC: [email protected]
Acked-by: Marcelo Ricardo Leitner <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
RDharageswari pushed a commit to RDharageswari/sof that referenced this pull request Jun 6, 2020
@davem330
Merge branch 'netdevsim-Two-small-fixes'
7a40a2d 
Ido Schimmel says:

====================
netdevsim: Two small fixes

Fix two bugs observed while analyzing regression failures.

Patch thesofproject#1 fixes a bug where sometimes the drop counter of a packet trap
policer would not increase.

Patch thesofproject#2 adds a missing initialization of a variable in a related
selftest.
====================

Signed-off-by: David S. Miller <[email protected]>
RDharageswari pushed a commit to RDharageswari/sof that referenced this pull request Jun 6, 2020
@davem330
Merge branch 'mlxsw-Various-fixes'
156ee62 
Ido Schimmel says:

====================
mlxsw: Various fixes

Patch thesofproject#1 from Jiri fixes a use-after-free discovered while fuzzing mlxsw
/ devlink with syzkaller.

Patch thesofproject#2 from Amit works around a limitation in new versions of arping,
which is used in several selftests.
====================

Signed-off-by: David S. Miller <[email protected]>
RDharageswari pushed a commit to RDharageswari/sof that referenced this pull request Jun 6, 2020
@davem330
Merge tag 'rxrpc-fixes-20200523-v2' of git://git.kernel.org/pub/scm/l…
d04322a 
…inux/kernel/git/dhowells/linux-fs

David Howells says:

====================
rxrpc: Fix a warning and a leak [ver thesofproject#2]

Here are a couple of fixes for AF_RXRPC:

 (1) Fix an uninitialised variable warning.

 (2) Fix a leak of the ticket on error in rxkad.
====================

Signed-off-by: David S. Miller <[email protected]>
mrajwa added a commit to mrajwa/sof that referenced this pull request Sep 10, 2020
@mrajwa
fixing prepare issue thesofproject#2
755bc38
@lgirdwood lgirdwood deleted the topic/module branch January 27, 2021 09:21
juimonen pushed a commit to juimonen/sof that referenced this pull request Aug 13, 2021
@RanderWang
Merge pull request thesofproject#2 from bardliao/to-rander-ipc4_dmic
4141b40 
fixup! tplg2.0: add dmic support
@kv2019i kv2019i mentioned this pull request Oct 4, 2021
Open
@lyakh lyakh mentioned this pull request Nov 15, 2021
Closed
johnylin76 added a commit that referenced this pull request Oct 12, 2022
@johnylin76
topology: support enum control for module_adater
39138d4 
(For AMD Banch Only)

An enum control is added to module_adapter. In this commit the enum
control is used for multi-config identification of DTS module.

Usage via amixer/ALSA UCM:

- The control should be listed under `amixer -c1 contents` as follows:

numid=17,iface=MIXER,name='CODEC_ADAPTER1.0 DTS Codec Config Mode 1'
  ; type=ENUMERATED,access=rw------,values=1,items=3
  ; Item #0 'bypass'
  ; Item #1 'speaker'
  ; Item #2 'headphone'
  : values=0

- Set the control value by the name of enumeration items. For example:

cset numid=17,iface=MIXER,name='CODEC_ADAPTER1.0 DTS Codec Config Mode 1' speaker

Signed-off-by: Pin-chih Lin <[email protected]>
@macchian macchian mentioned this pull request Nov 2, 2022
Closed
@msyrota msyrota mentioned this pull request Nov 21, 2022
Open
@juimonen juimonen mentioned this pull request Nov 29, 2022
Closed
keqiaozhang pushed a commit to keqiaozhang/sof that referenced this pull request Mar 7, 2023
@lgirdwood
Merge pull request thesofproject#2 from dbaluta/db
502b581 
rimage: Add support for i.MX8X
@andrula-song andrula-song mentioned this pull request May 12, 2023
Merged
@CBala21 CBala21 mentioned this pull request Jun 8, 2023
Merged
softwarecki added a commit to softwarecki/sof that referenced this pull request Jul 14, 2023
@softwarecki
[CI ONLY] Test rimage PR 155 thesofproject#2
ba984a4 
changed rimage revision in west and git submodule

Signed-off-by: Adrian Warecki <[email protected]>
@mengdonglin mengdonglin mentioned this pull request Jul 26, 2023
Closed
@jsarha jsarha mentioned this pull request Aug 2, 2023
Merged
@mengdonglin mengdonglin mentioned this pull request Sep 5, 2023
Closed
softwarecki added a commit to softwarecki/sof that referenced this pull request Sep 22, 2023
@softwarecki
[CI ONLY] Test rimage PR 155 thesofproject#2
d63e6a7 
changed rimage revision in west and git submodule

Signed-off-by: Adrian Warecki <[email protected]>
softwarecki added a commit to softwarecki/sof that referenced this pull request Sep 25, 2023
@softwarecki
[CI ONLY] Test rimage PR 155 thesofproject#2
71b7ba5 
changed rimage revision in west and git submodule

Signed-off-by: Adrian Warecki <[email protected]>
@davidrau-renesas-opensource davidrau-renesas-opensource mentioned this pull request Sep 27, 2023
Open
@yesi yesi mentioned this pull request Dec 18, 2023
Closed
marc-hb added a commit to marc-hb/sof that referenced this pull request Feb 27, 2024
@marc-hb
zephyr/wrapper.c: dereference NULL in POSIX for better k_panic() trace
aafa56b 
As discussed in the alternative approach
zephyrproject-rtos/zephyr#68494, k_panic() in
POSIX mode has various shortcomings that do not provide a useful
trace. Useless pointers to signal handlers or other cleanup routines are
printed instead. Leverage our already existing
k_sys_fatal_error_handler() and dereference a NULL pointer there when in
POSIX mode. This "fails fast" and provides a complete and relevant stack
trace in CI when fuzzing or when using some other static
analyzer. Example of how fuzzing failure thesofproject#8832 would have looked like in
CI results thanks to this commit:

```
./build-fuzz/zephyr/zephyr.exe: Running 1 inputs 1 time(s) each.
Running: ./rballoc_align_fuzz_crash
*** Booting Zephyr OS build zephyr-v3.5.0-3971-ge07de4e0a167 ***
[00:00:00.000,000] <inf> main: SOF on native_posix
[00:00:00.000,000] <inf> main: SOF initialized
@ WEST_TOPDIR/sof/zephyr/lib/alloc.c:391
[00:00:00.000,000] <err> os: >>> ZEPHYR FATAL ERROR 4: Kernel panic
[00:00:00.000,000] <err> os: Current thread: 0x891f8a0 (unknown)
[00:00:00.000,000] <err> zephyr: Halting emulation
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1784402==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000
==1784402==The signal is caused by a WRITE memory access.
==1784402==Hint: address points to the zero page.
    #0 0x829a77d in k_sys_fatal_error_handler zephyr/wrapper.c:352:19
    #1 0x829b8c0 in rballoc_align zephyr/lib/alloc.c:391:3
    thesofproject#2 0x8281438 in buffer_alloc src/audio/buffer.c:58:16
    thesofproject#3 0x826a60a in buffer_new src/ipc/ipc-helper.c:48:11
    thesofproject#4 0x8262107 in ipc_buffer_new src/ipc/ipc3/helper.c:459:11
    thesofproject#5 0x825944d in ipc_glb_tplg_buffer_new src/ipc/ipc3/handler.c:1305:8
    thesofproject#6 0x8257036 in ipc_cmd src/ipc/ipc3/handler.c:1651:9
    thesofproject#7 0x8272e59 in ipc_platform_do_cmd src/platform/posix/ipc.c:162:2
    thesofproject#8 0x826a2ac in ipc_do_cmd src/ipc/ipc-common.c:328:9
    thesofproject#9 0x829b0ab in task_run zephyr/include/rtos/task.h:94:9
    thesofproject#10 0x829abd8 in edf_work_handler zephyr/edf_schedule.c:32:16
    thesofproject#11 0x83560f7 in work_queue_main zephyr/kernel/work.c:688:3
    thesofproject#12 0x82244c2 in z_thread_entry zephyr/lib/os/thread_entry.c:48:2
```

Signed-off-by: Marc Herbert <[email protected]>
marc-hb added a commit to marc-hb/sof that referenced this pull request Feb 27, 2024
@marc-hb
zephyr/wrapper.c: dereference NULL in POSIX for better k_panic() trace
dcf6b6b 
As discussed in the alternative approach
zephyrproject-rtos/zephyr#68494, k_panic() in
POSIX mode has various shortcomings that do not provide a useful
trace. Useless pointers to signal handlers or other cleanup routines are
printed instead. Leverage our already existing
k_sys_fatal_error_handler() and dereference a NULL pointer there when in
POSIX mode. This "fails fast" and provides a complete and relevant stack
trace in CI when fuzzing or when using some other static
analyzer. Example of how fuzzing failure thesofproject#8832 would have looked like in
CI results thanks to this commit:

```
./build-fuzz/zephyr/zephyr.exe: Running 1 inputs 1 time(s) each.
Running: ./rballoc_align_fuzz_crash
*** Booting Zephyr OS build zephyr-v3.5.0-3971-ge07de4e0a167 ***
[00:00:00.000,000] <inf> main: SOF on native_posix
[00:00:00.000,000] <inf> main: SOF initialized
@ WEST_TOPDIR/sof/zephyr/lib/alloc.c:391
[00:00:00.000,000] <err> os: >>> ZEPHYR FATAL ERROR 4: Kernel panic
[00:00:00.000,000] <err> os: Current thread: 0x891f8a0 (unknown)
[00:00:00.000,000] <err> zephyr: Halting emulation
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1784402==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000
==1784402==The signal is caused by a WRITE memory access.
==1784402==Hint: address points to the zero page.
    #0 0x829a77d in k_sys_fatal_error_handler zephyr/wrapper.c:352:19
    #1 0x829b8c0 in rballoc_align zephyr/lib/alloc.c:391:3
    thesofproject#2 0x8281438 in buffer_alloc src/audio/buffer.c:58:16
    thesofproject#3 0x826a60a in buffer_new src/ipc/ipc-helper.c:48:11
    thesofproject#4 0x8262107 in ipc_buffer_new src/ipc/ipc3/helper.c:459:11
    thesofproject#5 0x825944d in ipc_glb_tplg_buffer_new src/ipc/ipc3/handler.c:1305:8
    thesofproject#6 0x8257036 in ipc_cmd src/ipc/ipc3/handler.c:1651:9
    thesofproject#7 0x8272e59 in ipc_platform_do_cmd src/platform/posix/ipc.c:162:2
    thesofproject#8 0x826a2ac in ipc_do_cmd src/ipc/ipc-common.c:328:9
    thesofproject#9 0x829b0ab in task_run zephyr/include/rtos/task.h:94:9
    thesofproject#10 0x829abd8 in edf_work_handler zephyr/edf_schedule.c:32:16
    thesofproject#11 0x83560f7 in work_queue_main zephyr/kernel/work.c:688:3
    thesofproject#12 0x82244c2 in z_thread_entry zephyr/lib/os/thread_entry.c:48:2
```

Signed-off-by: Marc Herbert <[email protected]>
lgirdwood pushed a commit that referenced this pull request Feb 28, 2024
@marc-hb @lgirdwood
zephyr/wrapper.c: dereference NULL in POSIX for better k_panic() trace
884305b 
As discussed in the alternative approach
zephyrproject-rtos/zephyr#68494, k_panic() in
POSIX mode has various shortcomings that do not provide a useful
trace. Useless pointers to signal handlers or other cleanup routines are
printed instead. Leverage our already existing
k_sys_fatal_error_handler() and dereference a NULL pointer there when in
POSIX mode. This "fails fast" and provides a complete and relevant stack
trace in CI when fuzzing or when using some other static
analyzer. Example of how fuzzing failure #8832 would have looked like in
CI results thanks to this commit:

```
./build-fuzz/zephyr/zephyr.exe: Running 1 inputs 1 time(s) each.
Running: ./rballoc_align_fuzz_crash
*** Booting Zephyr OS build zephyr-v3.5.0-3971-ge07de4e0a167 ***
[00:00:00.000,000] <inf> main: SOF on native_posix
[00:00:00.000,000] <inf> main: SOF initialized
@ WEST_TOPDIR/sof/zephyr/lib/alloc.c:391
[00:00:00.000,000] <err> os: >>> ZEPHYR FATAL ERROR 4: Kernel panic
[00:00:00.000,000] <err> os: Current thread: 0x891f8a0 (unknown)
[00:00:00.000,000] <err> zephyr: Halting emulation
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1784402==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000
==1784402==The signal is caused by a WRITE memory access.
==1784402==Hint: address points to the zero page.
    #0 0x829a77d in k_sys_fatal_error_handler zephyr/wrapper.c:352:19
    #1 0x829b8c0 in rballoc_align zephyr/lib/alloc.c:391:3
    #2 0x8281438 in buffer_alloc src/audio/buffer.c:58:16
    #3 0x826a60a in buffer_new src/ipc/ipc-helper.c:48:11
    #4 0x8262107 in ipc_buffer_new src/ipc/ipc3/helper.c:459:11
    #5 0x825944d in ipc_glb_tplg_buffer_new src/ipc/ipc3/handler.c:1305:8
    #6 0x8257036 in ipc_cmd src/ipc/ipc3/handler.c:1651:9
    #7 0x8272e59 in ipc_platform_do_cmd src/platform/posix/ipc.c:162:2
    #8 0x826a2ac in ipc_do_cmd src/ipc/ipc-common.c:328:9
    #9 0x829b0ab in task_run zephyr/include/rtos/task.h:94:9
    #10 0x829abd8 in edf_work_handler zephyr/edf_schedule.c:32:16
    #11 0x83560f7 in work_queue_main zephyr/kernel/work.c:688:3
    #12 0x82244c2 in z_thread_entry zephyr/lib/os/thread_entry.c:48:2
```

Signed-off-by: Marc Herbert <[email protected]>
@fredoh9 fredoh9 mentioned this pull request Jul 16, 2024
Closed
@cujomalainey cujomalainey mentioned this pull request Oct 11, 2024
Open
jsarha pushed a commit to jsarha/sof that referenced this pull request Oct 16, 2024
ipc3: handler: Add check for pipeline->source_comp being NULL
de50527 
The fuzzer engine has produced crash caused by NULL pointer read that
originated from ipc_stream_pcm_free(). The crash happens when the
pipeline of the found comp_dev does not have a source_comp and
pipeline_reset() is called for it. This commit simply adds a test
for such a situation and bails out if it is found.

Here is the call stack from the situation:

    #0 0x81e9317 in dev_comp_pipe_id sof/sof/src/include/sof/audio/component.h:646:25
    thesofproject#1 0x81e8015 in pipeline_comp_reset sof/sof/src/audio/pipeline/pipeline-graph.c:326:22
    thesofproject#2 0x81e7d1d in pipeline_reset sof/sof/src/audio/pipeline/pipeline-graph.c:393:8
    thesofproject#3 0x820d7ea in ipc_stream_pcm_free sof/sof/src/ipc/ipc3/handler.c:398:8
    thesofproject#4 0x8208969 in ipc_cmd sof/sof/src/ipc/ipc3/handler.c:1689:9
    thesofproject#5 0x81cbed8 in ipc_platform_do_cmd sof/sof/src/platform/posix/ipc.c:162:2
    thesofproject#6 0x81d10db in ipc_do_cmd sof/sof/src/ipc/ipc-common.c:330:9
    thesofproject#7 0x81f87e9 in task_run sof/sof/zephyr/include/rtos/task.h:94:9
    thesofproject#8 0x81f8308 in edf_work_handler sof/sof/zephyr/edf_schedule.c:31:16
    thesofproject#9 0x82b4b32 in work_queue_main sof/zephyr/kernel/work.c:668:3
    thesofproject#10 0x8193ec2 in z_thread_entry sof/zephyr/lib/os/thread_entry.c:36:2
    thesofproject#11 0x815f639 in __asan::AsanThread::ThreadStart(unsigned long long) /src/llvm-project/compiler-rt/lib/asan/asan_thread.cpp:277:25

Signed-off-by: Jyri Sarha <[email protected]>
@md0-code md0-code mentioned this pull request Oct 16, 2024
Closed
jsarha pushed a commit to jsarha/sof that referenced this pull request Oct 17, 2024
ipc3: handler: Add check for pipeline->source_comp being NULL
71afb2f 
The fuzzer engine has produced crash caused by NULL pointer read that
originated from ipc_stream_pcm_free(). The crash happens when the
pipeline of the found comp_dev does not have a source_comp and
pipeline_reset() is called for it. This commit simply adds a test
for such a situation and bails out if it is found.

Here is the call stack from the situation:

    #0 0x81e9317 in dev_comp_pipe_id sof/sof/src/include/sof/audio/component.h:646:25
    thesofproject#1 0x81e8015 in pipeline_comp_reset sof/sof/src/audio/pipeline/pipeline-graph.c:326:22
    thesofproject#2 0x81e7d1d in pipeline_reset sof/sof/src/audio/pipeline/pipeline-graph.c:393:8
    thesofproject#3 0x820d7ea in ipc_stream_pcm_free sof/sof/src/ipc/ipc3/handler.c:398:8
    thesofproject#4 0x8208969 in ipc_cmd sof/sof/src/ipc/ipc3/handler.c:1689:9
    thesofproject#5 0x81cbed8 in ipc_platform_do_cmd sof/sof/src/platform/posix/ipc.c:162:2
    thesofproject#6 0x81d10db in ipc_do_cmd sof/sof/src/ipc/ipc-common.c:330:9
    thesofproject#7 0x81f87e9 in task_run sof/sof/zephyr/include/rtos/task.h:94:9
    thesofproject#8 0x81f8308 in edf_work_handler sof/sof/zephyr/edf_schedule.c:31:16
    thesofproject#9 0x82b4b32 in work_queue_main sof/zephyr/kernel/work.c:668:3
    thesofproject#10 0x8193ec2 in z_thread_entry sof/zephyr/lib/os/thread_entry.c:36:2
    thesofproject#11 0x815f639 in __asan::AsanThread::ThreadStart(unsigned long long) /src/llvm-project/compiler-rt/lib/asan/asan_thread.cpp:277:25

Signed-off-by: Jyri Sarha <[email protected]>
jsarha pushed a commit to jsarha/sof that referenced this pull request Oct 18, 2024
pipeline: graph: Check if source_comp is NULL in pipeline_comp_reset()
5c1f737 
The fuzzer engine has produced crash caused by NULL pointer read
that originated from ipc3 ipc_stream_pcm_free(). The crash happens
when the pipeline of the found comp_dev does not have a
source_comp and pipeline_reset() is called for it. This commit
adds check to pipeline_comp_test() for this situation and bails
out if it is found.

Here is the call stack from the situation:

    #0 0x81e9317 in dev_comp_pipe_id sof/sof/src/include/sof/audio/component.h:646:25
    thesofproject#1 0x81e8015 in pipeline_comp_reset sof/sof/src/audio/pipeline/pipeline-graph.c:326:22
    thesofproject#2 0x81e7d1d in pipeline_reset sof/sof/src/audio/pipeline/pipeline-graph.c:393:8
    thesofproject#3 0x820d7ea in ipc_stream_pcm_free sof/sof/src/ipc/ipc3/handler.c:398:8
    thesofproject#4 0x8208969 in ipc_cmd sof/sof/src/ipc/ipc3/handler.c:1689:9
    thesofproject#5 0x81cbed8 in ipc_platform_do_cmd sof/sof/src/platform/posix/ipc.c:162:2
    thesofproject#6 0x81d10db in ipc_do_cmd sof/sof/src/ipc/ipc-common.c:330:9
    thesofproject#7 0x81f87e9 in task_run sof/sof/zephyr/include/rtos/task.h:94:9
    thesofproject#8 0x81f8308 in edf_work_handler sof/sof/zephyr/edf_schedule.c:31:16
    thesofproject#9 0x82b4b32 in work_queue_main sof/zephyr/kernel/work.c:668:3
    thesofproject#10 0x8193ec2 in z_thread_entry sof/zephyr/lib/os/thread_entry.c:36:2
    thesofproject#11 0x815f639 in __asan::AsanThread::ThreadStart(unsigned long long) /src/llvm-project/compiler-rt/lib/asan/asan_thread.cpp:277:25

Signed-off-by: Jyri Sarha <[email protected]>
lgirdwood pushed a commit that referenced this pull request Oct 21, 2024
@lgirdwood
pipeline: graph: Check if source_comp is NULL in pipeline_comp_reset()
73a17ae 
The fuzzer engine has produced crash caused by NULL pointer read
that originated from ipc3 ipc_stream_pcm_free(). The crash happens
when the pipeline of the found comp_dev does not have a
source_comp and pipeline_reset() is called for it. This commit
adds check to pipeline_comp_test() for this situation and bails
out if it is found.

Here is the call stack from the situation:

    #0 0x81e9317 in dev_comp_pipe_id sof/sof/src/include/sof/audio/component.h:646:25
    #1 0x81e8015 in pipeline_comp_reset sof/sof/src/audio/pipeline/pipeline-graph.c:326:22
    #2 0x81e7d1d in pipeline_reset sof/sof/src/audio/pipeline/pipeline-graph.c:393:8
    #3 0x820d7ea in ipc_stream_pcm_free sof/sof/src/ipc/ipc3/handler.c:398:8
    #4 0x8208969 in ipc_cmd sof/sof/src/ipc/ipc3/handler.c:1689:9
    #5 0x81cbed8 in ipc_platform_do_cmd sof/sof/src/platform/posix/ipc.c:162:2
    #6 0x81d10db in ipc_do_cmd sof/sof/src/ipc/ipc-common.c:330:9
    #7 0x81f87e9 in task_run sof/sof/zephyr/include/rtos/task.h:94:9
    #8 0x81f8308 in edf_work_handler sof/sof/zephyr/edf_schedule.c:31:16
    #9 0x82b4b32 in work_queue_main sof/zephyr/kernel/work.c:668:3
    #10 0x8193ec2 in z_thread_entry sof/zephyr/lib/os/thread_entry.c:36:2
    #11 0x815f639 in __asan::AsanThread::ThreadStart(unsigned long long) /src/llvm-project/compiler-rt/lib/asan/asan_thread.cpp:277:25

Signed-off-by: Jyri Sarha <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@keyonjie keyonjie keyonjie left review comments

Assignees

@lgirdwood lgirdwood

Labels
enhancement New feature or request
Projects
None yet
Milestone
1.2
Development

Successfully merging this pull request may close these issues.
3 participants
@lgirdwood @keyonjie @lrgirdwo