From c25232ef90af3f249863ff4389a4309a41cca909 Mon Sep 17 00:00:00 2001 From: Adrian Bonislawski Date: Mon, 8 Jun 2026 21:13:58 +0200 Subject: [PATCH 1/2] audio: mixin_mixout: check sink_get_buffer() return value sink_get_buffer() can return -EBUSY or -ENODATA without writing its output parameters, so using buf_size right after the call read an uninitialized value and built an invalid buffer end pointer. Check the return value in both acquire sites. In mixout_process() bail out on error. In mixin_process() skip only the failed mixout and keep mixing the rest; the source is consumed once after the loop so it is never reprocessed. Signed-off-by: Adrian Bonislawski --- src/audio/mixin_mixout/mixin_mixout.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/src/audio/mixin_mixout/mixin_mixout.c b/src/audio/mixin_mixout/mixin_mixout.c index 81dfb20e143e..932c216ad4f1 100644 --- a/src/audio/mixin_mixout/mixin_mixout.c +++ b/src/audio/mixin_mixout/mixin_mixout.c @@ -458,8 +458,13 @@ static int mixin_process(struct processing_module *mod, size_t free_bytes = sink_get_free_size(sink); size_t buf_size; - sink_get_buffer(sink, free_bytes, &mixout_data->acquired_buf.ptr, - &mixout_data->acquired_buf.buf_start, &buf_size); + ret = sink_get_buffer(sink, free_bytes, &mixout_data->acquired_buf.ptr, + &mixout_data->acquired_buf.buf_start, &buf_size); + /* on failed acquire, skip this mixout and keep mixing the rest; + * source is consumed once after the loop so it is not reprocessed + */ + if (ret < 0) + continue; mixout_data->acquired_buf.buf_end = (uint8_t *)mixout_data->acquired_buf.buf_start + buf_size; mixout_data->acquired_buf_free_frames = @@ -513,7 +518,7 @@ static int mixout_process(struct processing_module *mod, uint32_t frames_to_produce = INT32_MAX; uint32_t bytes_to_produce; struct pending_frames *pending_frames; - int i; + int i, ret; comp_dbg(dev, "entry"); @@ -574,8 +579,11 @@ static int mixout_process(struct processing_module *mod, if (!md->acquired_buf.ptr) { size_t buf_size; - sink_get_buffer(sinks[0], bytes_to_produce, &md->acquired_buf.ptr, - &md->acquired_buf.buf_start, &buf_size); + ret = sink_get_buffer(sinks[0], bytes_to_produce, &md->acquired_buf.ptr, + &md->acquired_buf.buf_start, &buf_size); + if (ret < 0) + return ret; + md->acquired_buf.buf_end = (uint8_t *)md->acquired_buf.buf_start + buf_size; } From aaf10988a62e7986d5e64b41e73d9db1edaac299 Mon Sep 17 00:00:00 2001 From: Adrian Bonislawski Date: Wed, 10 Jun 2026 16:28:42 +0200 Subject: [PATCH 2/2] audio: mixin_mixout: check source_get_data() return source_get_data() can return -EBUSY/-ENODATA without writing the buf_size out-parameter, leaving it (and source_ptr) uninitialized. Return the error instead of deriving buf_end from stack garbage, mirroring the sink_get_buffer() check. Signed-off-by: Adrian Bonislawski --- src/audio/mixin_mixout/mixin_mixout.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/audio/mixin_mixout/mixin_mixout.c b/src/audio/mixin_mixout/mixin_mixout.c index 932c216ad4f1..6e30eaee72d3 100644 --- a/src/audio/mixin_mixout/mixin_mixout.c +++ b/src/audio/mixin_mixout/mixin_mixout.c @@ -412,8 +412,10 @@ static int mixin_process(struct processing_module *mod, frames_to_copy = MIN(source_avail_frames, sinks_free_frames); bytes_to_consume = frames_to_copy * source_get_frame_bytes(sources[0]); - source_get_data(sources[0], bytes_to_consume, (const void **)&source_ptr.ptr, - (const void **)&source_ptr.buf_start, &buf_size); + ret = source_get_data(sources[0], bytes_to_consume, (const void **)&source_ptr.ptr, + (const void **)&source_ptr.buf_start, &buf_size); + if (ret < 0) + return ret; source_ptr.buf_end = (uint8_t *)source_ptr.buf_start + buf_size; } else { /* if source does not produce any data -- do NOT block mixing but generate