From: Bob Song <songxiebing@kylinos.cn>

When userspace writes 1 to /sys/bus/pci/devices/XX/remove to remove HDA PCI device,
the HDA hardware control path is shut down and devres unmaps the BAR virtual address
bus->remap_addr automatically during driver removal.

If a delayed HDA verb command arrives after the MMIO region is unmapped, the driver
will access invalid virtual addresses and trigger a page fault splat.

So add an error check right after constructing snd_hda_power_pm:

Signed-off-by: Bob Song <songxiebing@kylinos.cn>
---
Changes in v3:
- Just use bus->core.chip_init for check
Changes in v2:
- Modify the judgment from pm_runtime_datus_stuspended to bus->core.chip_init
---
 sound/hda/common/codec.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sound/hda/common/codec.c b/sound/hda/common/codec.c
index ef533770179b..1af640148e90 100644
--- a/sound/hda/common/codec.c
+++ b/sound/hda/common/codec.c
@@ -39,6 +39,12 @@ static int call_exec_verb(struct hda_bus *bus, struct hda_codec *codec,
 	int err;
 
 	CLASS(snd_hda_power_pm, pm)(codec);
+	if (!bus->core.chip_init) {
+		codec_warn(codec,
+			   "Failed to send cmd 0x%x ret=[%d], hda control not init\n",
+			   cmd, pm.err);
+		return pm.err;
+	}
 	guard(mutex)(&bus->core.cmd_mutex);
 	if (flags & HDA_RW_NO_RESPONSE_FALLBACK)
 		bus->no_response_fallback = 1;
-- 
2.25.1