Re: [PATCH] sound/core: fix refcount leak in snd_ctl_elem_info_user()

[Takashi Iwai]

On Fri, 12 Jun 2026 04:21:21 +0200,
WenTao Liang wrote:
> 
> snd_ctl_elem_info_user() calls snd_power_ref_and_wait() to obtain
> a power reference for the sound card.  If that function returns an
> error (e.g. -ENODEV when the card is shutting down), the reference
> is still held because snd_power_ref_and_wait() always acquires it
> unconditionally.  However, the error path in snd_ctl_elem_info_user()
> directly returns the error without releasing the reference, causing
> a refcount leak.
> 
> Fix it by calling snd_power_unref() before returning the error,
> matching the successful path that already does the paired unref.
> 
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: fcc62b19104a ("ALSA: control: Take power_ref lock primarily")
> Signed-off-by: WenTao Liang <vulab@xxxxxxxxxxx>

Judging from the current code patterns, it's better to fix the
function behavior itself -- unreference in snd_power_ref_and_wait()
itself when returning an error; otherwise there are way too many
callers to fix up, and the current behavior is rather confusing.

Could you try the patch below instead?


thanks,

Takashi

-- 8< --
--- a/sound/core/init.c
+++ b/sound/core/init.c
@@ -1139,7 +1139,7 @@ EXPORT_SYMBOL(snd_card_file_remove);
  * typically around calling control ops.
  *
  * The caller needs to pull down the refcount via snd_power_unref() later
- * no matter whether the error is returned from this function or not.
+ * when this function returns 0.
  *
  * Return: Zero if successful, or a negative error code.
  */
@@ -1152,7 +1152,11 @@ int snd_power_ref_and_wait(struct snd_card *card)
 		       card->shutdown ||
 		       snd_power_get_state(card) == SNDRV_CTL_POWER_D0,
 		       snd_power_unref(card), snd_power_ref(card));
-	return card->shutdown ? -ENODEV : 0;
+	if (card->shutdown) {
+		snd_power_unref(card);
+		return  -ENODEV;
+	}
+	return 0;
 }
 EXPORT_SYMBOL_GPL(snd_power_ref_and_wait);
 
@@ -1169,7 +1173,8 @@ int snd_power_wait(struct snd_card *card)
 	int ret;
 
 	ret = snd_power_ref_and_wait(card);
-	snd_power_unref(card);
+	if (!ret)
+		snd_power_unref(card);
 	return ret;
 }
 EXPORT_SYMBOL(snd_power_wait);