ALSA: hda/tas2781: fix ACPI reference handling

tas2781_read_acpi() gets a reference to the matching ACPI device and then
looks up its first physical device node. After taking a reference to the
physical device, it immediately drops the ACPI device reference.

However, every later failure jumps to an error path that drops the ACPI
device reference a second time. This unbalances the reference count and
may prematurely release the ACPI device.

In addition, acpi_get_first_physical_node() may return NULL. Without a
check, the driver passes the NULL physical device to the property helper
calls and may dereference it.

Return -ENODEV when no physical device is associated with the ACPI node,
and remove the duplicate acpi_dev_put() from the common error path.

Fixes: bb5f86ea50ff ("ALSA: hda/tas2781: Add tas2781 hda SPI driver")
Cc: stable@vger.kernel.org
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Link: https://patch.msgid.link/97EA8F29DA0D9AF7+20260731033554.949564-1-raoxu@uniontech.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>

diff --git a/sound/hda/codecs/side-codecs/tas2781_hda_spi.c b/sound/hda/codecs/side-codecs/tas2781_hda_spi.c
index 4899ea3727983bd906ca000b19518cb6204eed1d..271c56a79c32ca188a577421b635113f4318c2a3 100644 (file)
--- a/sound/hda/codecs/side-codecs/tas2781_hda_spi.c
+++ b/sound/hda/codecs/side-codecs/tas2781_hda_spi.c
@@ -343,6 +343,8 @@ static int tas2781_read_acpi(struct tas2781_hda *tas_hda,
        strscpy(p->dev_name, hid, sizeof(p->dev_name));
        physdev = get_device(acpi_get_first_physical_node(adev));
        acpi_dev_put(adev);
+       if (!physdev)
+               return -ENODEV;
 
        property = "ti,dev-index";
        ret = device_property_count_u32(physdev, property);
@@ -385,7 +387,6 @@ static int tas2781_read_acpi(struct tas2781_hda *tas_hda,
 err:
        dev_err(p->dev, "read acpi error, ret: %d\n", ret);
        put_device(physdev);
-       acpi_dev_put(adev);
 
        return ret;
 }