[PATCH] ALSA: hda/tas2781: fix ACPI reference handling

[PATCH] ALSA: hda/tas2781: fix ACPI reference handling

[raoxu]

From: Xu Rao <raoxu@uniontech.com>

tas2781_read_acpi() gets a reference to the matching ACPI device and then
looks up its first physical device node. After taking a reference to the
physical device, it immediately drops the ACPI device reference.

However, every later failure jumps to an error path that drops the ACPI
device reference a second time. This unbalances the reference count and
may prematurely release the ACPI device.

In addition, acpi_get_first_physical_node() may return NULL. Without a
check, the driver passes the NULL physical device to the property helper
calls and may dereference it.

Return -ENODEV when no physical device is associated with the ACPI node,
and remove the duplicate acpi_dev_put() from the common error path.

Fixes: bb5f86ea50ff ("ALSA: hda/tas2781: Add tas2781 hda SPI driver")
Cc: stable@vger.kernel.org
Signed-off-by: Xu Rao <raoxu@uniontech.com>
---
 sound/hda/codecs/side-codecs/tas2781_hda_spi.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/hda/codecs/side-codecs/tas2781_hda_spi.c b/sound/hda/codecs/side-codecs/tas2781_hda_spi.c
index 4899ea372798..271c56a79c32 100644
--- a/sound/hda/codecs/side-codecs/tas2781_hda_spi.c
+++ b/sound/hda/codecs/side-codecs/tas2781_hda_spi.c
@@ -343,6 +343,8 @@ static int tas2781_read_acpi(struct tas2781_hda *tas_hda,
 	strscpy(p->dev_name, hid, sizeof(p->dev_name));
 	physdev = get_device(acpi_get_first_physical_node(adev));
 	acpi_dev_put(adev);
+	if (!physdev)
+		return -ENODEV;

 	property = "ti,dev-index";
 	ret = device_property_count_u32(physdev, property);
@@ -385,7 +387,6 @@ static int tas2781_read_acpi(struct tas2781_hda *tas_hda,
 err:
 	dev_err(p->dev, "read acpi error, ret: %d\n", ret);
 	put_device(physdev);
-	acpi_dev_put(adev);

 	return ret;
 }
--
2.50.1

Re: [PATCH] ALSA: hda/tas2781: fix ACPI reference handling

[Takashi Iwai]

On Fri, 31 Jul 2026 05:35:54 +0200,
raoxu wrote:
> 
> From: Xu Rao <raoxu@uniontech.com>
> 
> tas2781_read_acpi() gets a reference to the matching ACPI device and then
> looks up its first physical device node. After taking a reference to the
> physical device, it immediately drops the ACPI device reference.
> 
> However, every later failure jumps to an error path that drops the ACPI
> device reference a second time. This unbalances the reference count and
> may prematurely release the ACPI device.
> 
> In addition, acpi_get_first_physical_node() may return NULL. Without a
> check, the driver passes the NULL physical device to the property helper
> calls and may dereference it.
> 
> Return -ENODEV when no physical device is associated with the ACPI node,
> and remove the duplicate acpi_dev_put() from the common error path.
> 
> Fixes: bb5f86ea50ff ("ALSA: hda/tas2781: Add tas2781 hda SPI driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Xu Rao <raoxu@uniontech.com>

Applied now.  Thanks.


Takashi