Re: [PATCH] ALSA: jack: Remove debugfs before freeing unregistered jacks

[Cen Zhang]

Hi Takashi,

Takashi Iwai <tiwai@xxxxxxx> 于2026年10月12日周一 15:28写道：
>
> Could you verify whether the problem still exists with the latest
> sound.git tree for-next branch (i.e. for 7.4)?  There have been fixes
> for the races at the disconnection, and snd_card_disconnect() became
> already mandatory before the release.
>

Thank you for the review and pointing out the recent disconnection
fixes. I checked
sound.git for-next at 8d70e364e866. A potential remaining issue is in
the cleanup after a failed HDA codec rebind on a live card. The call
paths below show how a newly created, unregistered jack can be freed
before its debugfs entries are removed.

For the generic HDA codec driver, jack creation follows:

  hda_codec_driver_probe()
    snd_hda_codec_build_controls()
      snd_hda_gen_build_controls()  [build_controls callback]
        snd_hda_jack_add_kctls()
          add_jack_kctl()
            snd_hda_jack_add_kctl_mst()
              snd_jack_new()

snd_jack_new() creates a component in SNDRV_DEV_BUILD. With
CONFIG_SND_JACK_INJECTION_DEBUG enabled, snd_jack_kctl_add() publishes
its debugfs files. Even though the card already exists, this newly
created component is not registered yet.

If a later jack-control allocation fails, the error returns to
hda_codec_driver_probe() before its snd_card_register() call. Its error
path reaches:

  snd_hda_codec_cleanup_for_unbind()
    snd_hda_jack_tbl_clear()
      snd_device_free()
        __snd_device_free()
          __snd_device_disconnect()  [skips SNDRV_DEV_BUILD]
          snd_jack_dev_free()

snd_jack_dev_free() unlinks the controls and frees their snd_jack_kctl
attachments before calling snd_jack_dev_disconnect(). By then the
kctl_list is empty, so snd_jack_remove_debugfs() has no entries left to
remove. The card-level debugfs directory has not been removed by a
snd_card_disconnect() call along this cleanup path.

Best regards,
Cen Zhang