[PATCH] sound/core: fix refcount leak in snd_ctl_elem_info_user()

[PATCH] sound/core: fix refcount leak in snd_ctl_elem_info_user()

[WenTao Liang]

snd_ctl_elem_info_user() calls snd_power_ref_and_wait() to obtain
a power reference for the sound card.  If that function returns an
error (e.g. -ENODEV when the card is shutting down), the reference
is still held because snd_power_ref_and_wait() always acquires it
unconditionally.  However, the error path in snd_ctl_elem_info_user()
directly returns the error without releasing the reference, causing
a refcount leak.

Fix it by calling snd_power_unref() before returning the error,
matching the successful path that already does the paired unref.

Cc: stable@vger.kernel.org
Fixes: fcc62b19104a ("ALSA: control: Take power_ref lock primarily")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
 sound/core/control.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sound/core/control.c b/sound/core/control.c
index 5e51857635e6..135a994e2d9e 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -1186,8 +1186,10 @@ static int snd_ctl_elem_info_user(struct snd_ctl_file *ctl,
 	if (copy_from_user(&info, _info, sizeof(info)))
 		return -EFAULT;
 	result = snd_power_ref_and_wait(card);
-	if (result)
+	if (result) {
+		snd_power_unref(card);
 		return result;
+	}
 	result = snd_ctl_elem_info(ctl, &info);
 	snd_power_unref(card);
 	if (result < 0)
-- 
2.50.1 (Apple Git-155)

Re: [PATCH] sound/core: fix refcount leak in snd_ctl_elem_info_user()

[Takashi Iwai]

On Fri, 12 Jun 2026 04:21:21 +0200,
WenTao Liang wrote:
> 
> snd_ctl_elem_info_user() calls snd_power_ref_and_wait() to obtain
> a power reference for the sound card.  If that function returns an
> error (e.g. -ENODEV when the card is shutting down), the reference
> is still held because snd_power_ref_and_wait() always acquires it
> unconditionally.  However, the error path in snd_ctl_elem_info_user()
> directly returns the error without releasing the reference, causing
> a refcount leak.
> 
> Fix it by calling snd_power_unref() before returning the error,
> matching the successful path that already does the paired unref.
> 
> Cc: stable@vger.kernel.org
> Fixes: fcc62b19104a ("ALSA: control: Take power_ref lock primarily")
> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>

Judging from the current code patterns, it's better to fix the
function behavior itself -- unreference in snd_power_ref_and_wait()
itself when returning an error; otherwise there are way too many
callers to fix up, and the current behavior is rather confusing.

Could you try the patch below instead?


thanks,

Takashi

-- 8< --
--- a/sound/core/init.c
+++ b/sound/core/init.c
@@ -1139,7 +1139,7 @@ EXPORT_SYMBOL(snd_card_file_remove);
  * typically around calling control ops.
  *
  * The caller needs to pull down the refcount via snd_power_unref() later
- * no matter whether the error is returned from this function or not.
+ * when this function returns 0.
  *
  * Return: Zero if successful, or a negative error code.
  */
@@ -1152,7 +1152,11 @@ int snd_power_ref_and_wait(struct snd_card *card)
 		       card->shutdown ||
 		       snd_power_get_state(card) == SNDRV_CTL_POWER_D0,
 		       snd_power_unref(card), snd_power_ref(card));
-	return card->shutdown ? -ENODEV : 0;
+	if (card->shutdown) {
+		snd_power_unref(card);
+		return  -ENODEV;
+	}
+	return 0;
 }
 EXPORT_SYMBOL_GPL(snd_power_ref_and_wait);
 
@@ -1169,7 +1173,8 @@ int snd_power_wait(struct snd_card *card)
 	int ret;
 
 	ret = snd_power_ref_and_wait(card);
-	snd_power_unref(card);
+	if (!ret)
+		snd_power_unref(card);
 	return ret;
 }
 EXPORT_SYMBOL(snd_power_wait);