Re: [RFC PATCH 2/2] ALSA: usb-audio: bind the Topping M62's vendor controls

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Missing check for IS_ERR(match) after component_match_add() could lead to an invalid pointer dereference under OOM.
--

commit ba009c1371d8827cf3c93bcfa9e391f4cb1fd549
Author: Mikhail Gavrilov [off-list ref]
Subject: ALSA: usb-audio: bind the Topping M62's vendor controls

The M62's vendor controls are driven by hid-topping-m62, added in the
previous patch, which speaks a vendor protocol on the card's HID
interface. Those controls belong on the sound card that plays the
audio, not on a card of the HID driver's own.

[ ... ]

+int snd_topping_init(struct usb_mixer_interface *mixer)
+{
+	struct snd_usb_audio *chip = mixer->chip;
+	struct component_match *match = NULL;
+	struct usb_interface *intf;
+	struct topping_master *tm;
+	struct device *dev;
+	int err;

[ ... ]

+	component_match_add(dev, &match, topping_match_component,
+			    &chip->dev->dev);
+
+	/*
+	 * This returns 0 with the aggregate merely pending when
+	 * hid-topping-m62 has not registered its component yet:
+	 * try_to_bring_up_aggregate_device() reports an incomplete set as
+	 * "not ready", not as an error.  So the card comes up either way and
+	 * grows the vendor controls if and when the other half appears.
+	 */
+	err = component_master_add_with_match(dev, &topping_master_ops, match);

[Severity: High]
Should we check if match is an error pointer before passing it to
component_master_add_with_match()?

If memory allocation fails inside component_match_add(), it assigns an
ERR_PTR(-ENOMEM) to the match pointer.

Because this unchecked pointer is then passed directly to
component_master_add_with_match(), it gets dereferenced (match->num)
inside the component core. This would trigger a page fault and kernel
panic under memory pressure.

Could we add an IS_ERR(match) check here before proceeding?

+	if (err < 0) {
+		mixer->private_data = NULL;
+		mixer->private_free = NULL;
+		devres_destroy(dev, topping_master_release, NULL, NULL);
+		usb_audio_err(chip, "Topping: no component master: %d\n", err);
+		return err;
+	}
+
+	return 0;
+}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260904112610.3286659-1-mikhail.v.gavrilov@gmail.com?part=2