[PATCH] ALSA: control: fix refcount leak in snd_ctl_elem_info_compat()

From: WenTao Liang

Date: Thu Jun 11 2026 - 22:42:36 EST


The error path when snd_power_ref_and_wait() returns an error does
not drop the reference acquired by that function. Since
snd_power_ref_and_wait() always takes a reference even on failure
(e.g., returning -ENODEV when the card is shutting down), the caller
must release it to avoid a refcount leak.

Add the missing snd_power_unref(card) call before returning the error.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: a1066453b5e4 ("ALSA: control: Fix power_ref lock order for compat code, too")
Signed-off-by: WenTao Liang <vulab@xxxxxxxxxxx>
---
sound/core/control_compat.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
index 16bc80555f26..af0bb694b463 100644
--- a/sound/core/control_compat.c
+++ b/sound/core/control_compat.c
@@ -97,8 +97,10 @@ static int snd_ctl_elem_info_compat(struct snd_ctl_file *ctl,
return -EFAULT;

err = snd_power_ref_and_wait(card);
- if (err < 0)
+ if (err < 0) {
+ snd_power_unref(card);
return err;
+ }
err = snd_ctl_elem_info(ctl, data);
snd_power_unref(card);
if (err < 0)
--
2.50.1 (Apple Git-155)