[PATCH] ALSA: control: fix refcount leak in ctl_elem_read_user()

[WenTao Liang]

The error path when snd_power_ref_and_wait() returns an error does
not drop the reference acquired by that function.  Since
snd_power_ref_and_wait() always takes a reference even on failure
(e.g., returning -ENODEV when the card is shutting down), the caller
must release it to avoid a refcount leak.

Add the missing snd_power_unref(card) call before returning the error.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: a1066453b5e4 ("ALSA: control: Fix power_ref lock order for compat code, too")
Signed-off-by: WenTao Liang <vulab@xxxxxxxxxxx>
---
 sound/core/control_compat.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
index af0bb694b463..d53d0182fd42 100644
--- a/sound/core/control_compat.c
+++ b/sound/core/control_compat.c
@@ -307,8 +307,10 @@ static int ctl_elem_read_user(struct snd_card *card,
 	int err;
 
 	err = snd_power_ref_and_wait(card);
-	if (err < 0)
+	if (err < 0) {
+		snd_power_unref(card);
 		return err;
+	}
 	err = __ctl_elem_read_user(card, userdata, valuep);
 	snd_power_unref(card);
 	return err;
-- 
2.50.1 (Apple Git-155)