From 07d213a1d40d5e1bb6e4d6bbcfb60cd4b75524ec Mon Sep 17 00:00:00 2001 From: Adrian Warecki Date: Fri, 13 Feb 2026 14:28:28 +0100 Subject: [PATCH 1/5] module_adapter: Fill module fields before starting dp thread Move mod field initialization in module_adapter_new_ext() before creating the dp thread. Moving the initialization earlier prevents the dp thread from use uninitialized data. Signed-off-by: Adrian Warecki --- src/audio/module_adapter/module_adapter.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/audio/module_adapter/module_adapter.c b/src/audio/module_adapter/module_adapter.c index 048eda0d47e0..e6aa903940ff 100644 --- a/src/audio/module_adapter/module_adapter.c +++ b/src/audio/module_adapter/module_adapter.c @@ -226,6 +226,12 @@ struct comp_dev *module_adapter_new_ext(const struct comp_driver *drv, if (!mod) return NULL; + module_set_private_data(mod, mod_priv); + list_init(&mod->raw_data_buffers_list); +#if CONFIG_USERSPACE + mod->user_ctx = user_ctx; +#endif /* CONFIG_USERSPACE */ + struct comp_dev *dev = mod->dev; #if CONFIG_ZEPHYR_DP_SCHEDULER @@ -236,12 +242,6 @@ struct comp_dev *module_adapter_new_ext(const struct comp_driver *drv, } #endif /* CONFIG_ZEPHYR_DP_SCHEDULER */ - module_set_private_data(mod, mod_priv); - list_init(&mod->raw_data_buffers_list); -#if CONFIG_USERSPACE - mod->user_ctx = user_ctx; -#endif /* CONFIG_USERSPACE */ - dst = &mod->priv.cfg; /* * NOTE: dst->ext_data points to stack variable and contains From 31573c9e004c275f8f25e90603fe873f7cfdc006 Mon Sep 17 00:00:00 2001 From: Adrian Warecki Date: Fri, 13 Feb 2026 15:52:01 +0100 Subject: [PATCH 2/5] module_adapter: dp: Add check for DP task creation error Check the value returned by the pipeline_comp_dp_task_init() call in module_adapter_new_ext(). Update scheduler_dp_task_init() to assign the output task structure pointer only on success. The function allocates task structure and free it on failure. Returning a non-null task on error could lead to a double free in the module adapter or use after free. Signed-off-by: Adrian Warecki --- src/audio/module_adapter/module_adapter.c | 6 +++++- src/schedule/zephyr_dp_schedule_thread.c | 10 ++++++---- 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/src/audio/module_adapter/module_adapter.c b/src/audio/module_adapter/module_adapter.c index e6aa903940ff..6f9f629fd9d8 100644 --- a/src/audio/module_adapter/module_adapter.c +++ b/src/audio/module_adapter/module_adapter.c @@ -238,7 +238,11 @@ struct comp_dev *module_adapter_new_ext(const struct comp_driver *drv, /* create a task for DP processing */ if (config->proc_domain == COMP_PROCESSING_DOMAIN_DP) { /* All data allocated, create a thread */ - pipeline_comp_dp_task_init(dev); + ret = pipeline_comp_dp_task_init(dev); + if (ret) { + comp_cl_err(drv, "DP task creation failed with error %d.", ret); + goto err; + } } #endif /* CONFIG_ZEPHYR_DP_SCHEDULER */ diff --git a/src/schedule/zephyr_dp_schedule_thread.c b/src/schedule/zephyr_dp_schedule_thread.c index a2d703528b33..621717155bd4 100644 --- a/src/schedule/zephyr_dp_schedule_thread.c +++ b/src/schedule/zephyr_dp_schedule_thread.c @@ -262,12 +262,12 @@ int scheduler_dp_task_init(struct task **task, /* success, fill the structures */ pdata->p_stack = p_stack; pdata->mod = mod; - *task = &task_memory->task; /* create a zephyr thread for the task */ pdata->thread_id = k_thread_create(pdata->thread, (__sparse_force void *)p_stack, - stack_size, dp_thread_fn, *task, NULL, NULL, - CONFIG_DP_THREAD_PRIORITY, (*task)->flags, K_FOREVER); + stack_size, dp_thread_fn, &task_memory->task, NULL, NULL, + CONFIG_DP_THREAD_PRIORITY, task_memory->task.flags, + K_FOREVER); /* pin the thread to specific core */ ret = k_thread_cpu_pin(pdata->thread_id, core); @@ -280,7 +280,7 @@ int scheduler_dp_task_init(struct task **task, k_thread_access_grant(pdata->thread_id, pdata->event); scheduler_dp_grant(pdata->thread_id, cpu_get_id()); - if ((*task)->flags & K_USER) { + if (task_memory->task.flags & K_USER) { ret = user_memory_init_shared(pdata->thread_id, pdata->mod); if (ret < 0) { tr_err(&dp_tr, "user_memory_init_shared() failed"); @@ -293,6 +293,8 @@ int scheduler_dp_task_init(struct task **task, k_event_init(pdata->event); k_thread_start(pdata->thread_id); + /* success, fill output parameter */ + *task = &task_memory->task; return 0; e_thread: From e32e702edfa462ec330260a9ebd6198c452a3416 Mon Sep 17 00:00:00 2001 From: Adrian Warecki Date: Fri, 13 Feb 2026 18:02:32 +0100 Subject: [PATCH 3/5] module_adapter: Fix use after free in module_adapter_new_ext Fix use after free in module_adapter_new_ext() by removing the dst access after freeing mod. The dst points to a field inside the previously allocated mod structure. The structure is freed on error so its fields do not need to be cleared beforehand. Signed-off-by: Adrian Warecki --- src/audio/module_adapter/module_adapter.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/src/audio/module_adapter/module_adapter.c b/src/audio/module_adapter/module_adapter.c index 6f9f629fd9d8..9a0bb90aaea3 100644 --- a/src/audio/module_adapter/module_adapter.c +++ b/src/audio/module_adapter/module_adapter.c @@ -334,10 +334,6 @@ struct comp_dev *module_adapter_new_ext(const struct comp_driver *drv, schedule_task_free(dev->task); #endif module_adapter_mem_free(mod); -#if CONFIG_IPC_MAJOR_4 - dst->ext_data = NULL; -#endif - return NULL; } From d099a1bca485a62b0c800cac6c43e1ce00bddcd1 Mon Sep 17 00:00:00 2001 From: Adrian Warecki Date: Mon, 23 Feb 2026 17:44:10 +0100 Subject: [PATCH 4/5] dp: thread: Remove user_memory_init_shared() Remove the no longer needed user_memory_init_shared(). Add the dp thread to the memory domain directly in the dp scheduler. The function originally added the common partition to the memory domain and added thread to that domain. The userspace proxy now adds the common partition to memory domain, so the function cannot perform this step. Grant access to thread only when userspace is used. Kernel threads have access to all the memory, no need to additionally grant access to them. Signed-off-by: Adrian Warecki --- src/schedule/zephyr_dp_schedule_thread.c | 11 ++++++----- zephyr/include/rtos/userspace_helper.h | 12 ------------ zephyr/lib/userspace_helper.c | 12 ------------ 3 files changed, 6 insertions(+), 29 deletions(-) diff --git a/src/schedule/zephyr_dp_schedule_thread.c b/src/schedule/zephyr_dp_schedule_thread.c index 621717155bd4..5d5d495b9160 100644 --- a/src/schedule/zephyr_dp_schedule_thread.c +++ b/src/schedule/zephyr_dp_schedule_thread.c @@ -8,6 +8,7 @@ #include #include +#include #include #include #include @@ -277,13 +278,13 @@ int scheduler_dp_task_init(struct task **task, } #ifdef CONFIG_USERSPACE - k_thread_access_grant(pdata->thread_id, pdata->event); - scheduler_dp_grant(pdata->thread_id, cpu_get_id()); + if (options & K_USER) { + k_thread_access_grant(pdata->thread_id, pdata->event); + scheduler_dp_grant(pdata->thread_id, core); - if (task_memory->task.flags & K_USER) { - ret = user_memory_init_shared(pdata->thread_id, pdata->mod); + ret = k_mem_domain_add_thread(pdata->mod->user_ctx->comp_dom, pdata->thread_id); if (ret < 0) { - tr_err(&dp_tr, "user_memory_init_shared() failed"); + tr_err(&dp_tr, "k_mem_domain_add_thread() failed %d", ret); goto e_thread; } } diff --git a/zephyr/include/rtos/userspace_helper.h b/zephyr/include/rtos/userspace_helper.h index 8cdcc4b291f6..29635fb942ad 100644 --- a/zephyr/include/rtos/userspace_helper.h +++ b/zephyr/include/rtos/userspace_helper.h @@ -42,18 +42,6 @@ struct userspace_context; */ struct k_heap *module_driver_heap_init(void); -/** - * Add DP scheduler created thread to module memory domain. - * @param thread_id - id of thread to be added to memory domain. - * @param module - processing module structure - * - * @return 0 for success, error otherwise. - * - * @note - * Function used only when CONFIG_USERSPACE is set. - */ -int user_memory_init_shared(k_tid_t thread_id, struct processing_module *mod); - /** * Attach common userspace memory partition to a module memory domain. * @param dom - memory domain to attach the common partition to. diff --git a/zephyr/lib/userspace_helper.c b/zephyr/lib/userspace_helper.c index 0aecf7079256..8c4aef423e15 100644 --- a/zephyr/lib/userspace_helper.c +++ b/zephyr/lib/userspace_helper.c @@ -77,18 +77,6 @@ int user_stack_free(void *p_stack) return k_thread_stack_free(p_stack); } -int user_memory_init_shared(k_tid_t thread_id, struct processing_module *mod) -{ - struct k_mem_domain *comp_dom = mod->user_ctx->comp_dom; - int ret; - - ret = k_mem_domain_add_partition(comp_dom, &common_partition); - if (ret < 0) - return ret; - - return k_mem_domain_add_thread(comp_dom, thread_id); -} - int user_memory_attach_common_partition(struct k_mem_domain *dom) { return k_mem_domain_add_partition(dom, &common_partition); From f2a7c053e41c18e92b415f53c9e051a8acc7a690 Mon Sep 17 00:00:00 2001 From: Adrian Warecki Date: Mon, 23 Feb 2026 15:22:15 +0100 Subject: [PATCH 5/5] west.yml: update zephyr to d885cfebaa3 Total of 153 commits. Changes include: d885cfebaa3 soc: intel_adsp/ace: Fix MMU mapping for shared heap bb8d441d201 tests: llext: add harvard to scope, build for nsim/nsim_em ebf1f9d019b tests: llext: fixes for arcmwdt, gcc Signed-off-by: Adrian Warecki --- west.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/west.yml b/west.yml index d5a72f1f3c35..f60267a887a2 100644 --- a/west.yml +++ b/west.yml @@ -43,7 +43,7 @@ manifest: - name: zephyr repo-path: zephyr - revision: b246d3f3f987f5ddfa6530bea2082c09ce1f00d8 + revision: d885cfebaa3464bf8bbf731a8b7f94854a90ae15 remote: zephyrproject # Import some projects listed in zephyr/west.yml@revision