[PATCH] sound/core: fix refcount leak in snd_ctl_elem_info_user()

[WenTao Liang]

snd_ctl_elem_info_user() calls snd_power_ref_and_wait() to obtain
a power reference for the sound card.  If that function returns an
error (e.g. -ENODEV when the card is shutting down), the reference
is still held because snd_power_ref_and_wait() always acquires it
unconditionally.  However, the error path in snd_ctl_elem_info_user()
directly returns the error without releasing the reference, causing
a refcount leak.

Fix it by calling snd_power_unref() before returning the error,
matching the successful path that already does the paired unref.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: fcc62b19104a ("ALSA: control: Take power_ref lock primarily")
Signed-off-by: WenTao Liang <vulab@xxxxxxxxxxx>
---
 sound/core/control.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sound/core/control.c b/sound/core/control.c
index 5e51857635e6..135a994e2d9e 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -1186,8 +1186,10 @@ static int snd_ctl_elem_info_user(struct snd_ctl_file *ctl,
 	if (copy_from_user(&info, _info, sizeof(info)))
 		return -EFAULT;
 	result = snd_power_ref_and_wait(card);
-	if (result)
+	if (result) {
+		snd_power_unref(card);
 		return result;
+	}
 	result = snd_ctl_elem_info(ctl, &info);
 	snd_power_unref(card);
 	if (result < 0)
-- 
2.50.1 (Apple Git-155)