Peter Ujfalusi

The issue is related to a null pointer dereference in the `sof ipc4 get input pin audio fmt()` function in the sound/soc/sof/ipc4-topology.c module of the Linux kernel. This occurs when a process module does not have a base config extension, causing the `process->base config ext` to be NULL. The vulnerability can be exploited by using specifically crafted topology and sequences, potentially leading to a denial of service.

The issue occurs when the system is suspended while audio is active, causing the `sof ipc4 pcm hw free()` function to reset the pipelines. If the firmware crashes during audio playback or when resetting the stream before suspend, the `sof ipc4 set multi pipeline state()` function will fail with an IPC error, interrupting the state change. This misalignment between the kernel and firmware state can result in errors returned by firmware for IPC messages, eventually failing the audio resume. The kernel state will be corrected on the next DSP boot after the DSP panic.

The issue is related to a memory leak in the Linux kernel when the `driver register()` function fails. This memory leak occurs because the memory allocated for `auxdrv->driver.name` is not freed before returning from ` auxiliary driver register()`. The exploitation of this issue may allow an attacker to cause a denial of service.