[PATCH] sound: fix refcount leak in snd_ctl_elem_write_user()

[PATCH] sound: fix refcount leak in snd_ctl_elem_write_user()

[WenTao Liang]

snd_ctl_elem_write_user() calls snd_power_ref_and_wait(), which
unconditionally acquires a power reference via snd_power_ref().
If the call returns a negative error code (e.g. when the card is
powering down and wait_event_cmd triggers -ENODEV), the reference
is held but never released. The function then returns the error
without calling snd_power_unref(card), leaking the power reference
count.

Add the missing snd_power_unref(card) on the error path to restore
the reference count balance.

Cc: stable@vger.kernel.org
Fixes: fcc62b19104a ("ALSA: control: Take power_ref lock primarily")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
 sound/core/control.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sound/core/control.c b/sound/core/control.c
index e3bb26206c39..7b714b5f8d54 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -1408,8 +1408,10 @@ static int snd_ctl_elem_write_user(struct snd_ctl_file *file,
 
 	card = file->card;
 	result = snd_power_ref_and_wait(card);
-	if (result < 0)
+	if (result < 0) {
+		snd_power_unref(card);
 		return result;
+	}
 	result = snd_ctl_elem_write(card, file, control);
 	snd_power_unref(card);
 	if (result < 0)
-- 
2.50.1 (Apple Git-155)