[PATCH] ASoC: Intel: avs: Fix d0ix reference count leak on set_params error path

[PATCH] ASoC: Intel: avs: Fix d0ix reference count leak on set_params error path

[WenTao Liang]

In avs_probe_compr_set_params(), avs_dsp_disable_d0ix() is called when
no probe streams are active. This function atomically increments the
d0ix_disable_depth counter before attempting the hardware power state
transition. If the transition (avs_dsp_set_d0ix()) fails, the function
returns an error but the counter remains elevated.

The caller does not balance the counter on this error path, causing a
reference count leak that permanently prevents the DSP from entering
d0ix.

Fix the leak by calling avs_dsp_enable_d0ix() to balance the previous
disable call before returning the error, mirroring the existing cleanup
pattern used when avs_dsp_init_probe() fails.

Cc: stable@vger.kernel.org
Fixes: 700462f55493 ("ASoC: Intel: avs: Probe compress operations")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
 sound/soc/intel/avs/probes.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sound/soc/intel/avs/probes.c b/sound/soc/intel/avs/probes.c
index 099119ad28b3..01d9421cf9ab 100644
--- a/sound/soc/intel/avs/probes.c
+++ b/sound/soc/intel/avs/probes.c
@@ -162,8 +162,10 @@ static int avs_probe_compr_set_params(struct snd_compr_stream *cstream,
 
 		/* D0ix not allowed during probing. */
 		ret = avs_dsp_disable_d0ix(adev);
-		if (ret)
+		if (ret) {
+			avs_dsp_enable_d0ix(adev);
 			return ret;
+		}
 
 		node_id.vindex = hdac_stream(host_stream)->stream_tag - 1;
 		node_id.dma_type = AVS_DMA_HDA_HOST_INPUT;
-- 
2.50.1 (Apple Git-155)

Re: [PATCH] ASoC: Intel: avs: Fix d0ix reference count leak on set_params error path

[Cezary Rojewski]

On 6/12/2026 5:22 AM, WenTao Liang wrote:
> In avs_probe_compr_set_params(), avs_dsp_disable_d0ix() is called when
> no probe streams are active. This function atomically increments the
> d0ix_disable_depth counter before attempting the hardware power state
> transition. If the transition (avs_dsp_set_d0ix()) fails, the function
> returns an error but the counter remains elevated.
> 
> The caller does not balance the counter on this error path, causing a
> reference count leak that permanently prevents the DSP from entering
> d0ix.
> 
> Fix the leak by calling avs_dsp_enable_d0ix() to balance the previous
> disable call before returning the error, mirroring the existing cleanup
> pattern used when avs_dsp_init_probe() fails.

Hi,

When using AI assistance to generate a commit message the strict kernel 
rules still apply.  Please plainly answer _why_ the change is made, no 
need to write a novel.  The last last two paragraphs could be simply 
dropped.

See Documentation/process for a number of helpful guides both for 
writing doc manually and with assistance.

> Cc: stable@vger.kernel.org
> Fixes: 700462f55493 ("ASoC: Intel: avs: Probe compress operations")
> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
> ---
>   sound/soc/intel/avs/probes.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/sound/soc/intel/avs/probes.c b/sound/soc/intel/avs/probes.c
> index 099119ad28b3..01d9421cf9ab 100644
> --- a/sound/soc/intel/avs/probes.c
> +++ b/sound/soc/intel/avs/probes.c
> @@ -162,8 +162,10 @@ static int avs_probe_compr_set_params(struct snd_compr_stream *cstream,
>   
>   		/* D0ix not allowed during probing. */
>   		ret = avs_dsp_disable_d0ix(adev);
> -		if (ret)
> +		if (ret) {
> +			avs_dsp_enable_d0ix(adev);

Things are not that simple with D0IX - D0-substates.  In short, if 
SET_D0IX IPC-message fails, the recommendation is to forgo the process 
entirely, see comments in avs_dsp_set_d0ix() and avs_dsp_get_core(). 
Blind enable - no.

I could see avs_dsp_disable_d0ix() receiving an update that takes care 
of lowering ->d0ix_disable_depth in case of non-IPC failure, if you're 
willing to follow up.

>   			return ret;
> +		}
>   
>   		node_id.vindex = hdac_stream(host_stream)->stream_tag - 1;
>   		node_id.dma_type = AVS_DMA_HDA_HOST_INPUT;