Pierre-Louis Bossart

A bug has been resolved in the Linux kernel related to a null dereference on system suspend entry. When the system enters suspend with an active stream, the SOF core calls `hw params upon resume()`. On Intel platforms with HDA DMA used to manage the link DMA, this leads to a call chain of `hda dsp set hw params upon resume()` -> `hda dsp dais suspend()` -> `hda dai suspend()` -> `hda ipc4 post trigger()`. A bug is hit in `hda dai suspend()` as `hda link dma cleanup()` is run first, which clears `hext stream->link substream`, and then `hda ipc4 post trigger()` is called with a NULL `snd pcm substream` pointer.

The issue is related to an out-of-bounds access in the soundwire cadence component. The code adds an offset to the PDI, presumably to skip the PDI0 and PDI1, which are reserved for BPT. However, this code is incorrect and leads to an out-of-bounds access. A follow-up patch completely removes this useless offset.

The issue occurs when the system is suspended while audio is active, causing the `sof ipc4 pcm hw free()` function to reset the pipelines. If the firmware crashes during audio playback or when resetting the stream before suspend, the `sof ipc4 set multi pipeline state()` function will fail with an IPC error, interrupting the state change. This misalignment between the kernel and firmware state can result in errors returned by firmware for IPC messages, eventually failing the audio resume. The kernel state will be corrected on the next DSP boot after the DSP panic.

A vulnerability in the Linux kernel has been resolved, specifically in the ASoC: rt7*-sdw module. The issue arises from the lack of a check on the card pointer in the rt700, rt711, and rt711-sdca Realtek headset codec drivers, which can lead to NULL dereferences during driver bind/unbind tests.

A issue in the Linux kernel has been identified where the device properties added for headset codecs are not removed if card registration fails, typically due to deferred probes. This can lead to kernel oopses in driver bind/unbind tests. The code that cleans up device properties when the card is removed can be moved as a helper and called upon card registration errors.