schedule: zephyr_ll: fix NULL pointer dereference and race conditions during task free

When a task is freed by zephyr_ll_task_free(), zephyr_ll_run() can still hold
a reference to the task's pdata structure across the LL lock boundary.
Re-fetching task->priv_data under zephyr_ll_lock() prevents evaluating
pdata->freeing on a stale/freed pointer. Additionally, add NULL checks for
pdata in zephyr_ll_task_done() and task/pdata in zephyr_ll_task_free().

Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>

Author: lrgirdwo

src/schedule/zephyr_ll.c

@@ -132,7 +132,7 @@ static void zephyr_ll_task_done(struct zephyr_ll *sch,
 
 	task->state = SOF_TASK_STATE_FREE;
 
-	if (pdata->freeing)
+	if (pdata && pdata->freeing)
 		/*
 		 * zephyr_ll_task_free() is trying to free this task. Complete
 		 * it and signal the semaphore to let the function proceed
@@ -297,8 +297,9 @@ static void zephyr_ll_run(void *data)
 #ifndef CONFIG_SOF_USERSPACE_LL
 		zephyr_ll_lock(sch, &flags);
 #endif
+		pdata = task->priv_data;
 
-		if (pdata->freeing || state == SOF_TASK_STATE_COMPLETED) {
+		if (!pdata || pdata->freeing || state == SOF_TASK_STATE_COMPLETED) {
 			zephyr_ll_task_done(sch, task);
 		} else {
 			/*
@@ -457,9 +458,16 @@ static int zephyr_ll_task_free(void *data, struct task *task)
 {
 	struct zephyr_ll *sch = data;
 	uint32_t flags;
-	struct zephyr_ll_pdata *pdata = task->priv_data;
+	struct zephyr_ll_pdata *pdata;
 	bool must_wait, on_list = true;
 
+	if (!task)
+		return 0;
+
+	pdata = task->priv_data;
+	if (!pdata)
+		return 0;
+
 	zephyr_ll_assert_core(sch);
 
 #ifndef CONFIG_SOF_USERSPACE_LL