Cloud-detected fuzz fixups

src/audio/kpb.c

@@ -394,7 +394,12 @@ static int kpb_set_verify_ipc_params(struct comp_dev *dev,
 
 	ret = memcpy_s(&kpb->config, sizeof(kpb->config), ipc_config->data,
 		       ipc_config->size);
-	assert(!ret);
+
+	if (ret) {
+		comp_err(dev, "kpb_new(): cannot memcpy_s %d bytes into sof_kpb_config (%d)\n",
+			 ipc_config->size, sizeof(kpb->config));
+		return -EINVAL;
+	}
 
 	/* Initialize sinks */
 	kpb->sel_sink = NULL;

src/ipc/ipc-helper.c

@@ -201,6 +201,12 @@ int ipc_pipeline_complete(struct ipc *ipc, uint32_t comp_id)
 		return -EINVAL;
 	}
 
+	if (ipc_pipe->type != COMP_TYPE_PIPELINE) {
+		tr_err(&ipc_tr, "ipc_pipeline_complete(): component %d not pipeline (type %d)",
+		       ipc_pipe->id, ipc_pipe->type);
+		return -EINVAL;
+	}
+
 	/* check core */
 	if (!cpu_is_me(ipc_pipe->core))
 		return ipc_process_on_core(ipc_pipe->core, false);
@@ -285,6 +291,21 @@ int ipc_comp_free(struct ipc *ipc, uint32_t comp_id)
 		return -EINVAL;
 	}
 
+	if (!icd->cd->bsource_list.next || !icd->cd->bsource_list.next) {
+		/* Unfortunate: the buffer list node gets initialized
+		 * at the component level and thus can contain NULLs
+		 * (which is an invalid list!) if the component's
+		 * lifecycle hasn't reached that point.  There's no
+		 * single place to ensure a valid/empty list, so we
+		 * have to do it here and eat the resulting memory
+		 * leak on error.  Bug-free host drivers won't do
+		 * this, this was found via fuzzing.
+		 */
+		tr_err(&ipc_tr, "ipc_comp_free(): uninitialized buffer lists on comp %d\n",
+		       icd->id);
+		return -EINVAL;
+	}
+
 	irq_local_disable(flags);
 	list_for_item_safe(clist, tmp, &icd->cd->bsource_list) {
 		struct comp_buffer *buffer = container_of(clist, struct comp_buffer, sink_list);

src/ipc/ipc3/handler.c

@@ -222,6 +222,12 @@ static int ipc_stream_pcm_params(uint32_t stream)
 		return -ENODEV;
 	}
 
+	if (pcm_dev->type != COMP_TYPE_COMPONENT) {
+		tr_err(&ipc_tr, "ipc_stream_pcm_params(): pcm_dev id %d not component (type %d)",
+		       pcm_dev->id, pcm_dev->type);
+		return -EINVAL;
+	}
+
 	/* check core */
 	if (!cpu_is_me(pcm_dev->core))
 		return ipc_process_on_core(pcm_dev->core, false);