ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers

Other, non DAI copier widgets could have the same  stream name (sname) as
the ALH copier and in that case the copier->data is NULL, no alh_data is
attached, which could lead to NULL pointer dereference.
We could check for this NULL pointer in sof_ipc4_prepare_copier_module()
and avoid the crash, but a similar loop in sof_ipc4_widget_setup_comp_dai()
will miscalculate the ALH device count, causing broken audio.

The correct fix is to harden the matching logic by making sure that the
1. widget is a DAI widget - so dai = w->private is valid
2. the dai (and thus the copier) is ALH copier

Fixes: a150345aa758 ("ASoC: SOF: ipc4-topology: add SoundWire/ALH aggregation support")
Reported-by: Seppo Ingalsuo <seppo.ingalsuo@linux.intel.com>
Link: https://github.com/thesofproject/sof/pull/9652
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20250206084642.14988-1-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>

diff --git a/sound/soc/sof/ipc4-topology.c b/sound/soc/sof/ipc4-topology.c
index c04c62478827a5e268c71cb82e29f32b99a2a256..6d5cda813e4878eb758776dd3bc03b199dd5e87b 100644 (file)
--- a/sound/soc/sof/ipc4-topology.c
+++ b/sound/soc/sof/ipc4-topology.c
@@ -765,10 +765,16 @@ static int sof_ipc4_widget_setup_comp_dai(struct snd_sof_widget *swidget)
                }
 
                list_for_each_entry(w, &sdev->widget_list, list) {
-                       if (w->widget->sname &&
+                       struct snd_sof_dai *alh_dai;
+
+                       if (!WIDGET_IS_DAI(w->id) || !w->widget->sname ||
                            strcmp(w->widget->sname, swidget->widget->sname))
                                continue;
 
+                       alh_dai = w->private;
+                       if (alh_dai->type != SOF_DAI_INTEL_ALH)
+                               continue;
+
                        blob->alh_cfg.device_count++;
                }
 
@@ -2061,11 +2067,13 @@ sof_ipc4_prepare_copier_module(struct snd_sof_widget *swidget,
                        list_for_each_entry(w, &sdev->widget_list, list) {
                                u32 node_type;
 
-                               if (w->widget->sname &&
+                               if (!WIDGET_IS_DAI(w->id) || !w->widget->sname ||
                                    strcmp(w->widget->sname, swidget->widget->sname))
                                        continue;
 
                                dai = w->private;
+                               if (dai->type != SOF_DAI_INTEL_ALH)
+                                       continue;
                                alh_copier = (struct sof_ipc4_copier *)dai->private;
                                alh_data = &alh_copier->data;
                                node_type = SOF_IPC4_GET_NODE_TYPE(alh_data->gtw_cfg.node_id);