From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E993C369D6F; Tue, 21 Jul 2026 18:00:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784656829; cv=none; b=di+wdWP9mVVu1HEL5v8mgxOIqRNT9yp4sEXHJa11res9StxYPGbEcYEapFyzJ87mLFXGG6VSPFrki7yy+FlOuZd7A9flPnbxbI3eV6aCaCKBsdkVF/ORdflKhvJNo8OiRK3j+dLn+d8xugJtv+CZMhDQbp3qOIUe4xV+2J87ETw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784656829; c=relaxed/simple; bh=mA4NSLIySEQMc9PwVa2l3m9GB4iNshfZ7rM9vHMzyrw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=iqPjw1CxARz86MSN+JWQ32bHNYmYB37NWRt/QxbR1SioXlY/1quGqIWXg0eJEpbtoid5WZRb9wekC0h6jNm8lrKuhHEaaET/U7vTHewMP19vTCokmOKdjFJ8YlaU3lc0DUYRIf+CQBaA9tDBa2ewjGGIp8kP/AdU8dSofxbw75Q= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=f4+Jp4J7; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="f4+Jp4J7" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5BB9B1F000E9; Tue, 21 Jul 2026 18:00:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784656827; bh=IUAFk+sd/MwJLLKDxwTkANM2L6woA7bXaGMAxTsUBPo=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=f4+Jp4J73C2DDqG7eQfal9C8HrTqQdvCcaGvaAbVkxGuXfXnOtLoiJ1mU8mU8/mAa ++0budvg1HGnMrOj61EYiyjNfaYt94Jpi2Q2RRIbm9yF/QaynRcKcMEbn6Gxlf0tBp 5zHGFVjpVtM/owW/SGWqOAh2qQ4MYN9mgjRJDGlE= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, WenTao Liang , Takashi Iwai , Sasha Levin Subject: [PATCH 6.18 0534/1611] ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() Date: Tue, 21 Jul 2026 17:10:50 +0200 Message-ID: <20260721152527.369534553@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260721152514.750365251@linuxfoundation.org> References: <20260721152514.750365251@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Takashi Iwai [ Upstream commit b113a891252c3fa4fab11ec8c2894a22ecaf278c ] snd_power_ref_and_wait() takes the power refcount and doesn't leave it no matter whether it returns an error or not. However, the majority of callers don't expect but just returns without unreferencing in the caller side upon errors. For addressing the potential refcount unbalance, rather correct the behavior of snd_power_ref_wait() to unreference upon returning an error. Note that the problem above is likely negligible; the function returns an error only when the sound card is being shutdown, hence it doesn't matter about the power refcount any longer at such a state. Fixes: e94fdbd7b25d ("ALSA: control: Track in-flight control read/write/tlv accesses") Reported-by: WenTao Liang Closes: https://lore.kernel.org/20260612022121.14329-1-vulab@iscas.ac.cn Link: https://patch.msgid.link/20260614090507.772540-1-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin --- sound/core/init.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/sound/core/init.c b/sound/core/init.c index c372b3228785e7..c8f992cff4a437 100644 --- a/sound/core/init.c +++ b/sound/core/init.c @@ -1131,7 +1131,7 @@ EXPORT_SYMBOL(snd_card_file_remove); * typically around calling control ops. * * The caller needs to pull down the refcount via snd_power_unref() later - * no matter whether the error is returned from this function or not. + * when this function returns 0. * * Return: Zero if successful, or a negative error code. */ @@ -1144,7 +1144,11 @@ int snd_power_ref_and_wait(struct snd_card *card) card->shutdown || snd_power_get_state(card) == SNDRV_CTL_POWER_D0, snd_power_unref(card), snd_power_ref(card)); - return card->shutdown ? -ENODEV : 0; + if (card->shutdown) { + snd_power_unref(card); + return -ENODEV; + } + return 0; } EXPORT_SYMBOL_GPL(snd_power_ref_and_wait); @@ -1161,7 +1165,8 @@ int snd_power_wait(struct snd_card *card) int ret; ret = snd_power_ref_and_wait(card); - snd_power_unref(card); + if (!ret) + snd_power_unref(card); return ret; } EXPORT_SYMBOL(snd_power_wait); -- 2.53.0