From f36752833ad1e2ccd6080b89e3253ae0efd93b46 Mon Sep 17 00:00:00 2001 From: Tomasz Leman Date: Wed, 3 Jun 2026 18:38:22 +0200 Subject: [PATCH] audio: mux: Fix incorrect iterator in demux_trigger demux_trigger() checks for cross-pipeline sinks to set the overrun_permitted flag. Commit 96b4fdb4f ("buf: use API for iteration bsource_list in components") incorrectly converted the bsink_list iteration to comp_dev_for_each_producer instead of comp_dev_for_each_consumer. Since demux has 1 input and multiple outputs, the loop must iterate over consumers (sinks), not producers (sources). The incorrect iterator caused the pipeline comparison to never match, making audio_stream_set_overrun() unreachable. Fix by using comp_dev_for_each_consumer with comp_buffer_get_sink_component and add a defensive NULL check on the returned component pointer. Issue found using semgrep with custom rules. Signed-off-by: Tomasz Leman --- src/audio/mux/mux.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/audio/mux/mux.c b/src/audio/mux/mux.c index 965faaf8037e..1476779e7324 100644 --- a/src/audio/mux/mux.c +++ b/src/audio/mux/mux.c @@ -290,9 +290,11 @@ static int demux_trigger(struct processing_module *mod, int cmd) */ if (cmd == COMP_TRIGGER_PRE_START) { struct comp_buffer *b; + struct comp_dev *sink_comp; - comp_dev_for_each_producer(mod->dev, b) { - if (comp_buffer_get_sink_component(b)->pipeline != mod->dev->pipeline) + comp_dev_for_each_consumer(mod->dev, b) { + sink_comp = comp_buffer_get_sink_component(b); + if (sink_comp && sink_comp->pipeline != mod->dev->pipeline) audio_stream_set_overrun(&b->stream, true); } }