[PATCH] ALSA: control: Fix power refcount leak in snd_ctl_elem_read_user

[WenTao Liang]

snd_power_ref_and_wait() increments the power refcount before waiting.
When it returns an error (e.g., -ENODEV due to card shutdown), the
refcount is still held, as documented in its comment:

  "The caller needs to pull down the refcount via snd_power_unref()
   later no matter whether the error is returned from this function
   or not."

snd_ctl_elem_read_user() fails to release this refcount on the error
path, leaking a reference. This can impede proper card resource
cleanup during shutdown sequences.

Fix by calling snd_power_unref() before returning the error.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: fcc62b19104a ("ALSA: control: Take power_ref lock primarily")
Signed-off-by: WenTao Liang <vulab@xxxxxxxxxxx>
---
 sound/core/control.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sound/core/control.c b/sound/core/control.c
index 135a994e2d9e..e3bb26206c39 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -1261,8 +1261,10 @@ static int snd_ctl_elem_read_user(struct snd_card *card,
 		return PTR_ERR(control);
 
 	result = snd_power_ref_and_wait(card);
-	if (result)
+	if (result) {
+		snd_power_unref(card);
 		return result;
+	}
 	result = snd_ctl_elem_read(card, control);
 	snd_power_unref(card);
 	if (result < 0)
-- 
2.50.1 (Apple Git-155)