module_adapter: dp: Add check for DP task creation error

Check the value returned by the pipeline_comp_dp_task_init() call in
module_adapter_new_ext(). Update scheduler_dp_task_init() to assign the
output task structure pointer only on success. The function allocates task
structure and free it on failure. Returning a non-null task on error could
lead to a double free in the module adapter or use after free.

Signed-off-by: Adrian Warecki <adrian.warecki@intel.com>

Author: softwarecki

src/audio/module_adapter/module_adapter.c

@@ -238,7 +238,11 @@ struct comp_dev *module_adapter_new_ext(const struct comp_driver *drv,
 	/* create a task for DP processing */
 	if (config->proc_domain == COMP_PROCESSING_DOMAIN_DP) {
 		/* All data allocated, create a thread */
-		pipeline_comp_dp_task_init(dev);
+		ret = pipeline_comp_dp_task_init(dev);
+		if (ret) {
+			comp_cl_err(drv, "DP task creation failed with error %d.", ret);
+			goto err;
+		}
 	}
 #endif /* CONFIG_ZEPHYR_DP_SCHEDULER */
 

src/schedule/zephyr_dp_schedule_thread.c

@@ -262,12 +262,12 @@ int scheduler_dp_task_init(struct task **task,
 	/* success, fill the structures */
 	pdata->p_stack = p_stack;
 	pdata->mod = mod;
-	*task = &task_memory->task;
 
 	/* create a zephyr thread for the task */
 	pdata->thread_id = k_thread_create(pdata->thread, (__sparse_force void *)p_stack,
-					   stack_size, dp_thread_fn, *task, NULL, NULL,
-					   CONFIG_DP_THREAD_PRIORITY, (*task)->flags, K_FOREVER);
+					   stack_size, dp_thread_fn, &task_memory->task, NULL, NULL,
+					   CONFIG_DP_THREAD_PRIORITY, task_memory->task.flags,
+					   K_FOREVER);
 
 	k_thread_access_grant(pdata->thread_id, pdata->event);
 	scheduler_dp_grant(pdata->thread_id, cpu_get_id());
@@ -280,7 +280,7 @@ int scheduler_dp_task_init(struct task **task,
 	}
 
 #ifdef CONFIG_USERSPACE
-	if ((*task)->flags & K_USER) {
+	if (task_memory->task.flags & K_USER) {
 		ret = user_memory_init_shared(pdata->thread_id, pdata->mod);
 		if (ret < 0) {
 			tr_err(&dp_tr, "user_memory_init_shared() failed");
@@ -293,6 +293,8 @@ int scheduler_dp_task_init(struct task **task,
 	k_event_init(pdata->event);
 	k_thread_start(pdata->thread_id);
 
+	/* success, fill output parameter */
+	*task = &task_memory->task;
 	return 0;
 
 e_thread: