Re: [RFC PATCH v4 2/2] ALSA: usb-audio: bind the Topping M62's vendor controls

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Devres LIFO release order in the probe error path triggers a WARN_ON and skips component unbinding.
--

commit cf20bcaed73c317ecf96294d265e775046594f6a
Author: Mikhail Gavrilov [off-list ref]

ALSA: usb-audio: bind the Topping M62's vendor controls

This commit registers a component master from the Topping M62's mixer quirk
to hand its struct snd_card to the HID driver at bind time. The master's
context is managed using devres on the audio control interface.

[ ... ]

+static void topping_master_unbind(struct device *dev)
+{
+	struct topping_master *tm = topping_get_master(dev);
+
+	if (WARN_ON(!tm))
+		return;

[Severity: High]
If snd_topping_init() succeeds but a later initialization step fails,
the USB core releases the devres group for the interface.

In snd_topping_init(), the match array is added to devres after the master:

snd_topping_init()
    ...
    devres_add(dev, tm);
    ...
    component_match_add(dev, &match, topping_match_component, ...);

Due to devres LIFO order, the match array is freed first.

Then, topping_master_release() runs and calls component_master_del(),
which invokes topping_master_unbind().

During devres cleanup, the node is unlinked before the callback runs,
so topping_get_master() (which uses devres_find()) will return NULL here.

Will this return NULL trigger the WARN_ON and skip component unbinding?

If the unbind is skipped, does it leave the component bound to a
destroyed master and prevent a use-after-free on the already-freed
match array that would have occurred during component_unbind_all()?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260904153051.1785280-1-mikhail.v.gavrilov@gmail.com?part=2