[PATCH 0/3] ASoC: Intel: avs: Fix for recovery procedure and new size-checks

[PATCH 0/3] ASoC: Intel: avs: Fix for recovery procedure and new size-checks

[Cezary Rojewski]

The first change addresses XRUN recovery for HDA-Link i.e.: BackEnd
side of a HDAudio stream.

It is the BE side equivalent of job done previously for FE side only
with commit cfca1637bc2b ("ASoC: Intel: avs: Unprepare a stream when
XRUN occurs") and its follow up titled: ("ASoC: Intel: avs: Reset the
stream unless it is already prepared") [1].

The next fix problems found by static analyzers. Additional size checks
for topology and a fix for module underflow should a DSP-module be
unloaded on the DSP side in unexpected fashion. Theoretically that's not
possible without a corrupted firmware, but the if-statement is already
there, just a dev_warn() though.

[1]: https://lore.kernel.org/linux-sound/20261010103753.16969-1-stiraspo@gmail.com/


Cezary Rojewski (3):
  ASoC: Intel: avs: Unprepare a stream when recovery occurs
  ASoC: Intel: avs: Verify sizes of configs coming from topology
  ASoC: Intel: avs: Prevent module info underflow

 sound/soc/intel/avs/pcm.c      | 2 ++
 sound/soc/intel/avs/topology.c | 6 ++++++
 sound/soc/intel/avs/utils.c    | 6 ++++--
 3 files changed, 12 insertions(+), 2 deletions(-)

-- 
2.34.1

[PATCH 1/3] ASoC: Intel: avs: Unprepare a stream when recovery occurs

[Cezary Rojewski]

Recovery on alsa-lib side is handled with either:
1) snd_pcm_prepare(state=XRUN)
2) snd_pcm_drop/drain() -> snd_pcm_prepare(state=SETUP)

before starting the PCM anew. Relying solely on state=XRUN leaves 2)
unaccounted for. sound/core/pcm_native.c ensures correctness of the
state machine so plain state!=PREPARED check suffices.

This is the BE equivalent of job done previously for FE side only with
commit cfca1637bc2b ("ASoC: Intel: avs: Unprepare a stream when XRUN
occurs") and its follow up titled: ("ASoC: Intel: avs: Reset the stream
unless it is already prepared").

Link: https://lore.kernel.org/linux-sound/20261010103753.16969-1-stiraspo@gmail.com/T/
Fixes: d070002a20fc ("ASoC: Intel: avs: HDA PCM BE operations")
Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
---
 sound/soc/intel/avs/pcm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/soc/intel/avs/pcm.c b/sound/soc/intel/avs/pcm.c
index 3cf455e8b879..a0a0d645ea33 100644
--- a/sound/soc/intel/avs/pcm.c
+++ b/sound/soc/intel/avs/pcm.c
@@ -461,6 +461,8 @@ static int avs_dai_hda_be_prepare(struct snd_pcm_substream *substream, struct sn
 	link_stream = data->link_stream;
 	p = &be->dpcm[substream->stream].hw_params;
 
+	if (substream->runtime->state != SNDRV_PCM_STATE_PREPARED)
+		link_stream->link_prepared = false;
 	if (link_stream->link_prepared)
 		return 0;
 
-- 
2.34.1

[PATCH 2/3] ASoC: Intel: avs: Verify sizes of configs coming from topology

[Cezary Rojewski]

Before operating on the init_config or NHLT-blob entries check whether
their sizes are within bounds of the block being parsed.

Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
---
 sound/soc/intel/avs/topology.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sound/soc/intel/avs/topology.c b/sound/soc/intel/avs/topology.c
index 1085090d5a9c..e81401bb6dbd 100644
--- a/sound/soc/intel/avs/topology.c
+++ b/sound/soc/intel/avs/topology.c
@@ -1720,6 +1720,10 @@ static int avs_tplg_parse_initial_configs(struct snd_soc_component *comp,
 					       AVS_TKN_INIT_CONFIG_ID_U32,
 					       mod_init_config_parsers,
 					       ARRAY_SIZE(mod_init_config_parsers));
+		if (ret)
+			return ret;
+		if (config->length > block_size)
+			return -EINVAL;
 
 		block_size -= esize;
 
@@ -1790,6 +1794,8 @@ static int avs_tplg_parse_nhlt_configs(struct snd_soc_component *comp,
 		/* With tuples parsed, the blob shall be allocated. */
 		if (!config->blob)
 			return -EINVAL;
+		if (config->blob->capabilities_size > block_size)
+			return -EINVAL;
 
 		/* Consume the raw data and move to the next entry. */
 		memcpy(config->blob->capabilities, (u8 *)tuples + esize,
-- 
2.34.1

[PATCH 3/3] ASoC: Intel: avs: Prevent module info underflow

[Cezary Rojewski]

Typically modules information is first initialized when loading the base
AudioDSP base firmware and then expanded when loadable DSP modules are
requested by platform-components, see avs_component_load_libraries().

While theoretically not possible in a production scenario, there is no
reason to continue the IDAs preparation if an event caused the newly
obtained module information to be smaller or equal than the existing
information.

Fixes: c1a427e8da93 ("ASoC: Intel: avs: Firmware resources management utilities")
Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
---
 sound/soc/intel/avs/utils.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/sound/soc/intel/avs/utils.c b/sound/soc/intel/avs/utils.c
index ea14ec173855..f19a62e7e8b5 100644
--- a/sound/soc/intel/avs/utils.c
+++ b/sound/soc/intel/avs/utils.c
@@ -116,9 +116,11 @@ avs_module_ida_alloc(struct avs_dev *adev, struct avs_mods_info *newinfo, bool p
 	int i;
 
 	if (!purge && oldinfo) {
-		if (oldinfo->count >= newinfo->count)
-			dev_warn(adev->dev, "refreshing %d modules info with %d\n",
+		if (oldinfo->count >= newinfo->count) {
+			dev_warn(adev->dev, "modules info underflow, old: %d, new: %d\n",
 				 oldinfo->count, newinfo->count);
+			return -EPROTO;
+		}
 		tocopy_count = oldinfo->count;
 	}
 
-- 
2.34.1

Re: [PATCH 1/3] ASoC: Intel: avs: Unprepare a stream when recovery occurs

[Amadeusz Sławiński]

On Thu, 15 Oct 2026 21:02:38 +0200
Cezary Rojewski <cezary.rojewski@intel.com> wrote:

> Recovery on alsa-lib side is handled with either:
> 1) snd_pcm_prepare(state=XRUN)
> 2) snd_pcm_drop/drain() -> snd_pcm_prepare(state=SETUP)
> 
> before starting the PCM anew. Relying solely on state=XRUN leaves 2)
> unaccounted for. sound/core/pcm_native.c ensures correctness of the
> state machine so plain state!=PREPARED check suffices.
> 
> This is the BE equivalent of job done previously for FE side only with
> commit cfca1637bc2b ("ASoC: Intel: avs: Unprepare a stream when XRUN
> occurs") and its follow up titled: ("ASoC: Intel: avs: Reset the stream
> unless it is already prepared").
> 
> Link: https://lore.kernel.org/linux-sound/20261010103753.16969-1-stiraspo@gmail.com/T/
> Fixes: d070002a20fc ("ASoC: Intel: avs: HDA PCM BE operations")
> Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
> ---
>  sound/soc/intel/avs/pcm.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/sound/soc/intel/avs/pcm.c b/sound/soc/intel/avs/pcm.c
> index 3cf455e8b879..a0a0d645ea33 100644
> --- a/sound/soc/intel/avs/pcm.c
> +++ b/sound/soc/intel/avs/pcm.c
> @@ -461,6 +461,8 @@ static int avs_dai_hda_be_prepare(struct snd_pcm_substream *substream, struct sn
>  	link_stream = data->link_stream;
>  	p = &be->dpcm[substream->stream].hw_params;
>  
> +	if (substream->runtime->state != SNDRV_PCM_STATE_PREPARED)
> +		link_stream->link_prepared = false;
>  	if (link_stream->link_prepared)
>  		return 0;
>  

It's bit late, so I can be wrong, but if you are going to execute whole
function in most cases anyway, is link_prepared even needed? Why not just:
	if (substream->runtime->state == SNDRV_PCM_STATE_PREPARED)
		return 0;
and remove link_prepared entirely?