ASoC: SOF: sof-audio: harden recursive widget free walk

During widget FREE traversal, SOF walks DAPM sink paths recursively while
widgets and paths can be torn down. This can lead to stale pointer usage in
sof_free_widgets_in_path() when path entries disappear during recursion.

Harden the FREE path by:
- validating scheduler/pipeline pointers before recursive free
- using a safe DAPM path iterator for sink traversal
- carrying a stable widget-list snapshot through recursion
- skipping NULL sink edges during traversal

The safe traversal can leave path->walking set on surviving edges after FREE,
which may short-circuit later DAPM walks and break consecutive playback
open/stop cycles. Reset walking flags for widgets in the current DAPM list
after FREE walks (including error paths) to keep subsequent traversals clean.

This keeps teardown robust for module-remove race scenarios while preserving
normal consecutive playback behavior.

Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>

Author: ujfalusi

sound/soc/sof/sof-audio.c

@@ -103,7 +103,7 @@ static int sof_widget_free_unlocked(struct snd_sof_dev *sdev,
 	 * decrement ref count for cores associated with all modules in the pipeline and clear
 	 * the complete flag
 	 */
-	if (swidget->id == snd_soc_dapm_scheduler) {
+	if (swidget->id == snd_soc_dapm_scheduler && spipe) {
 		int i;
 
 		for_each_set_bit(i, &spipe->core_mask, sdev->num_cores) {
@@ -115,16 +115,16 @@ static int sof_widget_free_unlocked(struct snd_sof_dev *sdev,
 					err = ret;
 			}
 		}
-		swidget->spipe->complete = 0;
+		spipe->complete = 0;
 	}
 
 	/*
 	 * free the scheduler widget (same as pipe_widget) associated with the current swidget.
 	 * skip for static pipelines
 	 */
-	if (swidget->spipe && swidget->dynamic_pipeline_widget &&
+	if (spipe && spipe->pipe_widget && swidget->dynamic_pipeline_widget &&
 	    swidget->id != snd_soc_dapm_scheduler) {
-		ret = sof_widget_free_unlocked(sdev, swidget->spipe->pipe_widget);
+		ret = sof_widget_free_unlocked(sdev, spipe->pipe_widget);
 		if (ret < 0 && !err)
 			err = ret;
 	}
@@ -548,15 +548,20 @@ sof_prepare_widgets_in_path(struct snd_sof_dev *sdev, struct snd_soc_dapm_widget
  * free all widgets in the sink path starting from the source widget
  * (DAI type for capture, AIF type for playback)
  */
-static int sof_free_widgets_in_path(struct snd_sof_dev *sdev, struct snd_soc_dapm_widget *widget,
-				    int dir, struct snd_sof_pcm *spcm)
+static int sof_free_widgets_in_path_internal(struct snd_sof_dev *sdev,
+					     struct snd_soc_dapm_widget *widget,
+					     int dir, struct snd_sof_pcm *spcm,
+					     struct snd_soc_dapm_widget_list *list)
 {
-	struct snd_soc_dapm_widget_list *list = spcm->stream[dir].list;
 	struct snd_sof_widget *swidget = widget->dobj.private;
 	struct snd_soc_dapm_path *p;
+	struct snd_soc_dapm_path *next_p;
 	int err;
 	int ret = 0;
 
+	if (!list)
+		return 0;
+
 	if (is_virtual_widget(sdev, widget, __func__))
 		return 0;
 
@@ -576,23 +581,52 @@ static int sof_free_widgets_in_path(struct snd_sof_dev *sdev, struct snd_soc_dap
 		ret = err;
 sink_free:
 	/* free all widgets in the sink paths even in case of error to keep use counts balanced */
-	snd_soc_dapm_widget_for_each_sink_path(widget, p) {
+	snd_soc_dapm_widget_for_each_path_safe(widget, SND_SOC_DAPM_DIR_IN, p, next_p) {
 		if (!p->walking) {
+			if (!p->sink)
+				continue;
+
 			if (!widget_in_list(list, p->sink))
 				continue;
 
 			p->walking = true;
 
-			err = sof_free_widgets_in_path(sdev, p->sink, dir, spcm);
+			err = sof_free_widgets_in_path_internal(sdev, p->sink,
+								dir, spcm, list);
 			if (err < 0)
 				ret = err;
-			p->walking = false;
 		}
 	}
 
 	return ret;
 }
 
+static int sof_free_widgets_in_path(struct snd_sof_dev *sdev,
+				    struct snd_soc_dapm_widget *widget,
+				    int dir, struct snd_sof_pcm *spcm)
+{
+	return sof_free_widgets_in_path_internal(sdev, widget, dir, spcm,
+						 spcm->stream[dir].list);
+}
+
+static void sof_reset_path_walking_flags(struct snd_soc_dapm_widget_list *list)
+{
+	struct snd_soc_dapm_widget *widget;
+	struct snd_soc_dapm_path *p;
+	int i;
+
+	if (!list)
+		return;
+
+	for_each_dapm_widgets(list, i, widget) {
+		snd_soc_dapm_widget_for_each_sink_path(widget, p)
+			p->walking = false;
+
+		snd_soc_dapm_widget_for_each_source_path(widget, p)
+			p->walking = false;
+	}
+}
+
 /*
  * set up all widgets in the sink path starting from the source widget
  * (DAI type for capture, AIF type for playback).
@@ -727,11 +761,17 @@ sof_walk_widgets_in_order(struct snd_sof_dev *sdev, struct snd_sof_pcm *spcm,
 			return -EINVAL;
 		}
 		if (ret < 0) {
+			if (op == SOF_WIDGET_FREE)
+				sof_reset_path_walking_flags(list);
+
 			dev_err(sdev->dev, "Failed to %s connected widgets\n", str);
 			return ret;
 		}
 	}
 
+	if (op == SOF_WIDGET_FREE)
+		sof_reset_path_walking_flags(list);
+
 	return 0;
 }