Re: [PATCH] ALSA: jack: Remove debugfs before freeing unregistered jacks

[Takashi Iwai]

On Tue, 13 Oct 2026 06:21:22 +0200,
Cen Zhang wrote:
> 
> Hi Takashi,
> 
> Takashi Iwai <tiwai@xxxxxxx> 于2026年10月12日周一 15:28写道：
> >
> > Could you verify whether the problem still exists with the latest
> > sound.git tree for-next branch (i.e. for 7.4)?  There have been fixes
> > for the races at the disconnection, and snd_card_disconnect() became
> > already mandatory before the release.
> >
> 
> Thank you for the review and pointing out the recent disconnection
> fixes. I checked
> sound.git for-next at 8d70e364e866. A potential remaining issue is in
> the cleanup after a failed HDA codec rebind on a live card. The call
> paths below show how a newly created, unregistered jack can be freed
> before its debugfs entries are removed.
> 
> For the generic HDA codec driver, jack creation follows:
> 
>   hda_codec_driver_probe()
>     snd_hda_codec_build_controls()
>       snd_hda_gen_build_controls()  [build_controls callback]
>         snd_hda_jack_add_kctls()
>           add_jack_kctl()
>             snd_hda_jack_add_kctl_mst()
>               snd_jack_new()
> 
> snd_jack_new() creates a component in SNDRV_DEV_BUILD. With
> CONFIG_SND_JACK_INJECTION_DEBUG enabled, snd_jack_kctl_add() publishes
> its debugfs files. Even though the card already exists, this newly
> created component is not registered yet.
> 
> If a later jack-control allocation fails, the error returns to
> hda_codec_driver_probe() before its snd_card_register() call. Its error
> path reaches:
> 
>   snd_hda_codec_cleanup_for_unbind()
>     snd_hda_jack_tbl_clear()
>       snd_device_free()
>         __snd_device_free()
>           __snd_device_disconnect()  [skips SNDRV_DEV_BUILD]
>           snd_jack_dev_free()
> 
> snd_jack_dev_free() unlinks the controls and frees their snd_jack_kctl
> attachments before calling snd_jack_dev_disconnect(). By then the
> kctl_list is empty, so snd_jack_remove_debugfs() has no entries left to
> remove. The card-level debugfs directory has not been removed by a
> snd_card_disconnect() call along this cleanup path.

Thanks, now it's clearer.

IMO, ideally speaking, the debugfs entry addition should be done at
the registration phase, i.e. snd_jack_debugfs_add_inject_node() should
be performed in snd_jack_dev_register().  But it'd be a larger change,
so I take your patch as a quick fix for now to for-next branch.


thanks,

Takashi