Re: [RFC PATCH v2 2/2] ALSA: usb-audio: bind the Topping M62's vendor controls

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Kernel panic due to ERR_PTR dereference if component_match_add() fails on OOM.
--

commit 2f96a32362993ba059fe1ac1ed3ecb8fe309cd34
Author: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>

ALSA: usb-audio: bind the Topping M62's vendor controls

This commit adds a component master for the Topping M62 sound card's vendor
controls to bind the audio and HID sides together. It registers a component
master that passes its snd_card to the HID driver at bind time and cleans
it up at unbind.

> diff --git a/sound/usb/mixer_topping.c b/sound/usb/mixer_topping.c
> new file mode 100644
> index 0000000000000..922b0f61cbd41
> --- /dev/null
> +++ b/sound/usb/mixer_topping.c
[ ... ]
> +int snd_topping_init(struct usb_mixer_interface *mixer)
> +{
[ ... ]
> +	component_match_add(dev, &match, topping_match_component,
> +			    &chip->dev->dev);
> +
> +	/*
> +	 * This returns 0 with the aggregate merely pending when
> +	 * hid-topping-m62 has not registered its component yet:
> +	 * try_to_bring_up_aggregate_device() reports an incomplete set as
> +	 * "not ready", not as an error.  So the card comes up either way and
> +	 * grows the vendor controls if and when the other half appears.
> +	 */
> +	err = component_master_add_with_match(dev, &topping_master_ops, match);

[Severity: High]
Does this code risk a kernel panic if component_match_add() fails during OOM?

If component_match_add() fails to allocate memory, it sets the match pointer
to ERR_PTR(-ENOMEM).

The match pointer is then passed directly to component_master_add_with_match(),
which unconditionally dereferences it when accessing match->num, leading to
an invalid pointer dereference.

Should there be an IS_ERR() check for the match pointer before passing it to
component_master_add_with_match()?

> +	if (err < 0) {
> +		mixer->private_data = NULL;
> +		mixer->private_free = NULL;
> +		devres_destroy(dev, topping_master_release, NULL, NULL);
> +		usb_audio_err(chip, "Topping: no component master: %d\n", err);
> +		return err;
> +	}
> +
> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260904141158.33398-1-mikhail.v.gavrilov@gmail.com?part=2