Re: [PATCH v2 09/27] ASoC: soc-devres: use snd_soc_component_unregister() for devm_snd_soc_register_component()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] ASoC: soc-devres: double list_del() in devm_component_release()
  on teardown
--

commit 38a63673c76cb0aea6b0a6701713c1de6335cb5e
Author: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>

ASoC: soc-devres: use snd_soc_component_unregister() for devm_snd_soc_register_component()

This commit changes devm_snd_soc_register_component() to store the
registered struct snd_soc_component pointer in devres and pass it
directly to snd_soc_component_unregister() on release.

> diff --git a/sound/soc/soc-devres.c b/sound/soc/soc-devres.c
> index ca6c29b54f6ab..0323897c664dc 100644
> --- a/sound/soc/soc-devres.c
> +++ b/sound/soc/soc-devres.c
> @@ -11,9 +11,9 @@
>  
>  static void devm_component_release(struct device *dev, void *res)
>  {
> -	const struct snd_soc_component_driver **cmpnt_drv = res;
> +	struct snd_soc_component **component = res;
>  
> -	snd_soc_unregister_component_by_driver(dev, *cmpnt_drv);
> +	snd_soc_component_unregister(*component);
>  }

[Severity: High]
Can devm_component_release() call list_del(&component->list) a second
time if the driver already called snd_soc_unregister_component(dev)?

Previously, snd_soc_unregister_component_by_driver() looked up the
component on component_list first, making devm_component_release() a
no-op if it had already been removed.  Now, calling
snd_soc_component_unregister(*component) directly invokes
snd_soc_component_unregister_unlocked(), which unconditionally runs
list_del(&component->list) without checking whether the component is
still linked.

Drivers that mix devm_snd_soc_register_component() with
snd_soc_unregister_component(dev) will hit a double list_del() on a
poisoned list head during teardown:

sound/soc/mediatek/mt8173/mt8173-afe-pcm.c:mt8173_afe_pcm_dev_probe() {
	...
	ret = devm_snd_soc_register_component(dev, &mtk_afe_pcm_platform,
					      NULL, 0);
	if (ret)
		goto err_pm;

	ret = snd_soc_register_component(dev,
					 &mt8173_afe_pcm_dai_component,
					 mt8173_afe_pcm_dais,
					 ARRAY_SIZE(mt8173_afe_pcm_dais));
	...
err_cleanup_components:
	snd_soc_unregister_component(dev);
	...
}

mt8173_afe_pcm_dev_remove(), stm32_adfsdm_remove(), and tas_remove() in
sound/soc/codecs/tas2783-sdw.c also call snd_soc_unregister_component()
before devres_release_all() runs devm_component_release().

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/87zeve28ol.wl-kuninori.morimoto.gx@renesas.com?part=9