[PATCH] ALSA: control: Fix power refcount leak in snd_ctl_elem_read_user

[PATCH] ALSA: control: Fix power refcount leak in snd_ctl_elem_read_user

[WenTao Liang]

snd_power_ref_and_wait() increments the power refcount before waiting.
When it returns an error (e.g., -ENODEV due to card shutdown), the
refcount is still held, as documented in its comment:

  "The caller needs to pull down the refcount via snd_power_unref()
   later no matter whether the error is returned from this function
   or not."

snd_ctl_elem_read_user() fails to release this refcount on the error
path, leaking a reference. This can impede proper card resource
cleanup during shutdown sequences.

Fix by calling snd_power_unref() before returning the error.

Cc: stable@vger.kernel.org
Fixes: fcc62b19104a ("ALSA: control: Take power_ref lock primarily")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
 sound/core/control.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sound/core/control.c b/sound/core/control.c
index 135a994e2d9e..e3bb26206c39 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -1261,8 +1261,10 @@ static int snd_ctl_elem_read_user(struct snd_card *card,
 		return PTR_ERR(control);
 
 	result = snd_power_ref_and_wait(card);
-	if (result)
+	if (result) {
+		snd_power_unref(card);
 		return result;
+	}
 	result = snd_ctl_elem_read(card, control);
 	snd_power_unref(card);
 	if (result < 0)
-- 
2.50.1 (Apple Git-155)

Re: [PATCH] ALSA: control: Fix power refcount leak in snd_ctl_elem_read_user

[Takashi Iwai]

On Fri, 12 Jun 2026 04:27:02 +0200,
WenTao Liang wrote:
> 
> snd_power_ref_and_wait() increments the power refcount before waiting.
> When it returns an error (e.g., -ENODEV due to card shutdown), the
> refcount is still held, as documented in its comment:
> 
>   "The caller needs to pull down the refcount via snd_power_unref()
>    later no matter whether the error is returned from this function
>    or not."
> 
> snd_ctl_elem_read_user() fails to release this refcount on the error
> path, leaking a reference. This can impede proper card resource
> cleanup during shutdown sequences.
> 
> Fix by calling snd_power_unref() before returning the error.
> 
> Cc: stable@vger.kernel.org
> Fixes: fcc62b19104a ("ALSA: control: Take power_ref lock primarily")
> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>

Your all other patches for sound/core/* look like similar fixes, and
should be better put in a single fix patch.  If need to split to
multiple patches, though, please send a series of patches in a thread,
instead, at the next time.


thanks,

Takashi