Re: [RFC PATCH v2 2/2] ALSA: usb-audio: bind the Topping M62's vendor controls

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Kernel panic due to ERR_PTR dereference if component_match_add() fails on OOM.
--

commit 2f96a32362993ba059fe1ac1ed3ecb8fe309cd34
Author: Mikhail Gavrilov [off-list ref]

ALSA: usb-audio: bind the Topping M62's vendor controls

This commit adds a component master for the Topping M62 sound card's vendor
controls to bind the audio and HID sides together. It registers a component
master that passes its snd_card to the HID driver at bind time and cleans
it up at unbind.

[ ... ]

+int snd_topping_init(struct usb_mixer_interface *mixer)
+{

[ ... ]

+	component_match_add(dev, &match, topping_match_component,
+			    &chip->dev->dev);
+
+	/*
+	 * This returns 0 with the aggregate merely pending when
+	 * hid-topping-m62 has not registered its component yet:
+	 * try_to_bring_up_aggregate_device() reports an incomplete set as
+	 * "not ready", not as an error.  So the card comes up either way and
+	 * grows the vendor controls if and when the other half appears.
+	 */
+	err = component_master_add_with_match(dev, &topping_master_ops, match);

[Severity: High]
Does this code risk a kernel panic if component_match_add() fails during OOM?

If component_match_add() fails to allocate memory, it sets the match pointer
to ERR_PTR(-ENOMEM).

The match pointer is then passed directly to component_master_add_with_match(),
which unconditionally dereferences it when accessing match->num, leading to
an invalid pointer dereference.

Should there be an IS_ERR() check for the match pointer before passing it to
component_master_add_with_match()?

+	if (err < 0) {
+		mixer->private_data = NULL;
+		mixer->private_free = NULL;
+		devres_destroy(dev, topping_master_release, NULL, NULL);
+		usb_audio_err(chip, "Topping: no component master: %d\n", err);
+		return err;
+	}
+
+	return 0;
+}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260904141158.33398-1-mikhail.v.gavrilov@gmail.com?part=2