ipc4: helper: reject module creation for non-existent pipeline

[tmleman]

comp_new_ipc4() copied the host-supplied ppl_instance_id into ipc_config.pipeline_id without verifying that the referenced pipeline exists. The module_adapter creation path then does:

ipc_pipe = ipc_get_comp_by_ppl_id(ipc, COMP_TYPE_PIPELINE,
                                  config->pipeline_id,
                                  IPC_COMP_IGNORE_REMOTE);
if (ipc_pipe)
        dev->pipeline = ipc_pipe->pipeline;   /* skipped when NULL */

so when the pipeline is missing the lookup returns NULL, the assignment is skipped, and the component is created with dev->pipeline left unset. A gateway module such as the copier then dereferences that NULL pointer while wiring the graph, e.g. copier_dai_init() writing pipeline->source_comp / pipeline->sink_comp, giving a NULL-pointer SEGV reachable from a single unprivileged IPC.

The case

The offending IPC stream carries one meaningful command: a MODULE / INIT_INSTANCE request for a copier-class module (module_id 26, instance_id 36) whose extension.ppl_instance_id names a parent pipeline (id 90) for which no GLB / CREATE_PIPELINE command was ever sent. That pipeline is therefore absent from ipc->comp_list. IPC4 mandates that the host create the pipeline before instantiating any module inside it; here that ordering is violated, so the invariant "an INIT_INSTANCE always targets an existing pipeline" does not hold.

The firmware accepted the request anyway, allocated the component, ran module_init() -> copier_init() -> copier_dai_create(), and copier_dai_init() performed a WRITE to the source_comp field (offset 0x54) through the NULL dev->pipeline, faulting on the zero page:

ERROR: SEGV on unknown address 0x00000054 (WRITE)
copier_dai_init -> copier_dai_create -> copier_init
-> module_init -> module_adapter_new_ext -> module_adapter_new
-> comp_new_ipc4 -> ipc4_init_module_instance
-> ipc4_process_module_message -> ipc_cmd

All three copier gateway variants are affected (copier_host_create, copier_dai_create and copier_ipcgtw_create all pass dev->pipeline down), and any future module reading dev->pipeline during init would hit the same latent NULL.

Fix

Rather than guarding the individual copier/module_adapter dereference, reject the request at the common creation entry point: in comp_new_ipc4(), before the component is allocated, look up the parent pipeline and fail with a NULL return (reported to the host as IPC4_MOD_NOT_INITIALIZED) when it does not exist. This fails fast with no partially-initialized component to unwind and enforces the invariant "a live IPC4 component always belongs to a live pipeline" for every module driver, not just the module adapter; the later module_adapter lookup is then guaranteed to succeed.

[Copilot]

Pull request overview

Enforces IPC4’s required ordering by rejecting MODULE / INIT_INSTANCE requests that reference a non-existent parent pipeline, preventing NULL dev->pipeline dereferences during module initialization (e.g., copier gateway init) and turning a host-triggerable SEGV into a clean failure.

Changes:

• Adds an early validation in comp_new_ipc4() to ensure ppl_instance_id refers to an existing COMP_TYPE_PIPELINE.
• Logs a clear error and fails module creation before allocating/initializing the component when the pipeline is missing.