Re: [PATCH v3] ALSA: hda: cs35l41: Fix ACPI device reference leak on probe failure

[Takashi Iwai]

On Mon, 12 Oct 2026 10:41:52 +0200,
Ma Ke wrote:
> 
> cs35l41_hda_probe() takes an acpi_device through
> cs35l41_hda_read_acpi() and stores it in cs35l41->dacpi. Only the
> failures that happen later reach the err: label, which is where that
> reference and cs35l41->acpi_subsystem_id are released, so the early
> return taken when cs35l41_hda_read_acpi() fails leaves both behind.
> 
> Keep the ownership in the caller instead of dropping the reference
> inside cs35l41_hda_read_acpi(). That removes the need to work out
> whether a given failure path has already released it, and with it the
> double put that cs35l41_hda_parse_acpi() would otherwise cause when it
> fails after having released the device itself.
> 
> cs35l41_hda_parse_acpi() and the !physdev path no longer put the
> reference, and the early failure enters the existing err: cleanup tail
> through a new err_acpi label.
> 
> The label sits between the reset of the codec and the gpio cleanup, so
> an early failure also releases the reset and chip-select descriptors
> that cs35l41_hda_parse_acpi() may already have taken, while still
> skipping cs35l41_safe_reset() on a codec that was never brought up.
> 
> cs35l41->dacpi comes from devm_kzalloc() and is only assigned once the
> ACPI device has been found, so the put is a no-op when the lookup
> itself failed.
> 
> Found by code review.
> 
> Fixes: 447106e92a0c ("ALSA: hda: cs35l41: Support mute notifications for CS35L41 HDA")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Ma Ke <make_ruc2021@xxxxxxx>

Applied to for-next branch now.  Thanks.


Takashi