[PATCH] ALSA: control_compat: fix refcount leak in ctl_elem_write_user()

[WenTao Liang]

ctl_elem_write_user() calls snd_power_ref_and_wait() which always
increments the card's power refcount. The reference is released in the
success path after __ctl_elem_write_user(), but on error the function
returns without dropping it, resulting in a refcount leak.

Fix this by adding the missing snd_power_unref(card) before the error
return.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: a1066453b5e4 ("ALSA: control: Fix power_ref lock order for compat code, too")
Signed-off-by: WenTao Liang <vulab@xxxxxxxxxxx>
---
 sound/core/control_compat.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
index d53d0182fd42..7bbf5c35f013 100644
--- a/sound/core/control_compat.c
+++ b/sound/core/control_compat.c
@@ -99,7 +99,7 @@ static int snd_ctl_elem_info_compat(struct snd_ctl_file *ctl,
 	err = snd_power_ref_and_wait(card);
 	if (err < 0) {
 		snd_power_unref(card);
-		return err;
+		return
 	}
 	err = snd_ctl_elem_info(ctl, data);
 	snd_power_unref(card);
@@ -345,8 +345,10 @@ static int ctl_elem_write_user(struct snd_ctl_file *file,
 	int err;
 
 	err = snd_power_ref_and_wait(card);
-	if (err < 0)
+	if (err < 0) {
+		snd_power_unref(card);
 		return err;
+	}
 	err = __ctl_elem_write_user(file, userdata, valuep);
 	snd_power_unref(card);
 	return err;
-- 
2.50.1 (Apple Git-155)