[PATCH] ALSA: hda: Check snd_hda_power_pm construct error before executing verb

[PATCH] ALSA: hda: Check snd_hda_power_pm construct error before executing verb

[songxiebing]

From: Bob Song <songxiebing@kylinos.cn>

When userspace writes 1 to /sys/bus/pci/devices/XX/remove to remove HDA PCI device,
the codec device enters runtime suspended state early. The snd_hda_power_pm RAII
constructor fails to wake up codec, but the original code ignores pm.err and continues
to execute hda verb commands. After pci driver remove callback completes, devres
automatically iounmap the BAR virtual address bus->remap_addr, resulting in access
to invalid unmapped MMIO address and triggering page fault BUG.

Add error check for snd_hda_power_pm constructor result:
1. Detect pm construction failure when HDA core device is suspended;
2. Print warning log with command and error code for debug;
3. Return early to skip subsequent hardware register access, avoid page fault crash.

Signed-off-by: Bob Song <songxiebing@kylinos.cn>
---
 sound/hda/common/codec.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sound/hda/common/codec.c b/sound/hda/common/codec.c
index ef533770179b..69ddd153509c 100644
--- a/sound/hda/common/codec.c
+++ b/sound/hda/common/codec.c
@@ -39,6 +39,12 @@ static int call_exec_verb(struct hda_bus *bus, struct hda_codec *codec,
 	int err;
 
 	CLASS(snd_hda_power_pm, pm)(codec);
+	if (pm.err < 0 && pm_runtime_status_suspended(bus->core.dev)) {
+		codec_warn(codec,
+			   "Failed to send cmd 0x%x ret=[%d], hda control device is suspended\n",
+			   cmd, pm.err);
+		return pm.err;
+	}
 	guard(mutex)(&bus->core.cmd_mutex);
 	if (flags & HDA_RW_NO_RESPONSE_FALLBACK)
 		bus->no_response_fallback = 1;
-- 
2.25.1

Re: [PATCH] ALSA: hda: Check snd_hda_power_pm construct error before executing verb

[Takashi Iwai]

On Mon, 13 Jul 2026 04:04:27 +0200,
songxiebing wrote:
> 
> From: Bob Song <songxiebing@kylinos.cn>
> 
> When userspace writes 1 to /sys/bus/pci/devices/XX/remove to remove HDA PCI device,
> the codec device enters runtime suspended state early. The snd_hda_power_pm RAII
> constructor fails to wake up codec, but the original code ignores pm.err and continues
> to execute hda verb commands. After pci driver remove callback completes, devres
> automatically iounmap the BAR virtual address bus->remap_addr, resulting in access
> to invalid unmapped MMIO address and triggering page fault BUG.
> 
> Add error check for snd_hda_power_pm constructor result:
> 1. Detect pm construction failure when HDA core device is suspended;
> 2. Print warning log with command and error code for debug;
> 3. Return early to skip subsequent hardware register access, avoid page fault crash.
> 
> Signed-off-by: Bob Song <songxiebing@kylinos.cn>

Applied to for-next branch.  Thanks.


Takashi

Re: [PATCH] ALSA: hda: Check snd_hda_power_pm construct error before executing verb

[songxiebing]

Hi Takashi,

At present, this patch may cause misjudgment for some platform devices.
If rpm is not enabled on the platform device, the default runtime_status is suspended,
which will result in the inability to write commands properly.

Could you please drop this patch? Sorry for the trouble.

>On Mon, 13 Jul 2026 04:04:27 +0200,
>songxiebing wrote:
>> 
>> From: Bob Song <songxiebing@kylinos.cn>
>> 
>> When userspace writes 1 to /sys/bus/pci/devices/XX/remove to remove HDA PCI device,
>> the codec device enters runtime suspended state early. The snd_hda_power_pm RAII
>> constructor fails to wake up codec, but the original code ignores pm.err and continues
>> to execute hda verb commands. After pci driver remove callback completes, devres
>> automatically iounmap the BAR virtual address bus->remap_addr, resulting in access
>> to invalid unmapped MMIO address and triggering page fault BUG.
>> 
>> Add error check for snd_hda_power_pm constructor result:
>> 1. Detect pm construction failure when HDA core device is suspended;
>> 2. Print warning log with command and error code for debug;
>> 3. Return early to skip subsequent hardware register access, avoid page fault crash.
>> 
>> Signed-off-by: Bob Song <songxiebing@kylinos.cn>
>
>Applied to for-next branch.  Thanks.
>
>
>Takashi

Re: [PATCH] ALSA: hda: Check snd_hda_power_pm construct error before executing verb

[Takashi Iwai]

On Tue, 14 Jul 2026 04:13:51 +0200,
songxiebing wrote:
> 
> Hi Takashi,
> 
> At present, this patch may cause misjudgment for some platform devices.
> If rpm is not enabled on the platform device, the default runtime_status is suspended,
> which will result in the inability to write commands properly.
> 
> Could you please drop this patch? Sorry for the trouble.

OK, dropped now.


thanks,

Takashi

> >On Mon, 13 Jul 2026 04:04:27 +0200,
> >songxiebing wrote:
> >> 
> >> From: Bob Song <songxiebing@kylinos.cn>
> >> 
> >> When userspace writes 1 to /sys/bus/pci/devices/XX/remove to remove HDA PCI device,
> >> the codec device enters runtime suspended state early. The snd_hda_power_pm RAII
> >> constructor fails to wake up codec, but the original code ignores pm.err and continues
> >> to execute hda verb commands. After pci driver remove callback completes, devres
> >> automatically iounmap the BAR virtual address bus->remap_addr, resulting in access
> >> to invalid unmapped MMIO address and triggering page fault BUG.
> >> 
> >> Add error check for snd_hda_power_pm constructor result:
> >> 1. Detect pm construction failure when HDA core device is suspended;
> >> 2. Print warning log with command and error code for debug;
> >> 3. Return early to skip subsequent hardware register access, avoid page fault crash.
> >> 
> >> Signed-off-by: Bob Song <songxiebing@kylinos.cn>
> >
> >Applied to for-next branch.  Thanks.
> >
> >
> >Takashi

[PATCH v2] ALSA: hda: Check snd_hda_power_pm construct error before executing verb

[songxiebing]

From: Bob Song <songxiebing@kylinos.cn>

When userspace writes 1 to /sys/bus/pci/devices/XX/remove to remove HDA PCI device,
the HDA hardware control path is shut down and devres unmaps the BAR virtual address
bus->remap_addr automatically during driver removal.

If a delayed HDA verb command arrives after the MMIO region is unmapped, the driver
will access invalid virtual addresses and trigger a page fault splat.

So add an error check right after constructing snd_hda_power_pm:

Signed-off-by: Bob Song <songxiebing@kylinos.cn>
---
Changes in v2:
- Modify the judgment from pm_runtime_datus_stuspended to bus->core.chip_init
---
 sound/hda/common/codec.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sound/hda/common/codec.c b/sound/hda/common/codec.c
index ef533770179b..607d47a5b286 100644
--- a/sound/hda/common/codec.c
+++ b/sound/hda/common/codec.c
@@ -39,6 +39,12 @@ static int call_exec_verb(struct hda_bus *bus, struct hda_codec *codec,
 	int err;
 
 	CLASS(snd_hda_power_pm, pm)(codec);
+	if (pm.err < 0 && !bus->core.chip_init) {
+		codec_warn(codec,
+			   "Failed to send cmd 0x%x ret=[%d], hda control stopped\n",
+			   cmd, pm.err);
+		return pm.err;
+	}
 	guard(mutex)(&bus->core.cmd_mutex);
 	if (flags & HDA_RW_NO_RESPONSE_FALLBACK)
 		bus->no_response_fallback = 1;
-- 
2.25.1

Re: [PATCH v2] ALSA: hda: Check snd_hda_power_pm construct error before executing verb

[Takashi Iwai]

On Fri, 17 Jul 2026 04:49:48 +0200,
songxiebing wrote:
> 
> From: Bob Song <songxiebing@kylinos.cn>
> 
> When userspace writes 1 to /sys/bus/pci/devices/XX/remove to remove HDA PCI device,
> the HDA hardware control path is shut down and devres unmaps the BAR virtual address
> bus->remap_addr automatically during driver removal.
> 
> If a delayed HDA verb command arrives after the MMIO region is unmapped, the driver
> will access invalid virtual addresses and trigger a page fault splat.
> 
> So add an error check right after constructing snd_hda_power_pm:
> 
> Signed-off-by: Bob Song <songxiebing@kylinos.cn>
> ---
> Changes in v2:
> - Modify the judgment from pm_runtime_datus_stuspended to bus->core.chip_init

Applied to for-next branch.  Thanks.


Takashi

[PATCH v3] ALSA: hda: Check snd_hda_power_pm construct error before executing verb

[songxiebing]

From: Bob Song <songxiebing@kylinos.cn>

When userspace writes 1 to /sys/bus/pci/devices/XX/remove to remove HDA PCI device,
the HDA hardware control path is shut down and devres unmaps the BAR virtual address
bus->remap_addr automatically during driver removal.

If a delayed HDA verb command arrives after the MMIO region is unmapped, the driver
will access invalid virtual addresses and trigger a page fault splat.

So add an error check right after constructing snd_hda_power_pm:

Signed-off-by: Bob Song <songxiebing@kylinos.cn>
---
Changes in v3:
- Just use bus->core.chip_init for check
Changes in v2:
- Modify the judgment from pm_runtime_datus_stuspended to bus->core.chip_init
---
 sound/hda/common/codec.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sound/hda/common/codec.c b/sound/hda/common/codec.c
index ef533770179b..1af640148e90 100644
--- a/sound/hda/common/codec.c
+++ b/sound/hda/common/codec.c
@@ -39,6 +39,12 @@ static int call_exec_verb(struct hda_bus *bus, struct hda_codec *codec,
 	int err;
 
 	CLASS(snd_hda_power_pm, pm)(codec);
+	if (!bus->core.chip_init) {
+		codec_warn(codec,
+			   "Failed to send cmd 0x%x ret=[%d], hda control not init\n",
+			   cmd, pm.err);
+		return pm.err;
+	}
 	guard(mutex)(&bus->core.cmd_mutex);
 	if (flags & HDA_RW_NO_RESPONSE_FALLBACK)
 		bus->no_response_fallback = 1;
-- 
2.25.1