Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 46d4be41 authored by Sam Bobroff's avatar Sam Bobroff Committed by Michael Ellerman
Browse files

powerpc/eeh: Fix use-after-release of EEH driver 



Correct two cases where eeh_pcid_get() is used to reference the driver's
module but the reference is dropped before the driver pointer is used.

In eeh_rmv_device() also refactor a little so that only two calls to
eeh_pcid_put() are needed, rather than three and the reference isn't
taken at all if it wasn't needed.

Signed-off-by: default avatarSam Bobroff <sbobroff@linux.ibm.com>
Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
parent 796b9f5b

arch/powerpc/kernel/eeh_driver.c

+16 −12
Original line number Diff line number Diff line
@@ -458,10 +458,12 @@ static void *eeh_add_virt_device(void *data, void *userdata) 


	driver = eeh_pcid_get(dev);

	if (driver) {

		if (driver->err_handler) {

			eeh_pcid_put(dev);

		if (driver->err_handler)

			return NULL;

		}

		eeh_pcid_put(dev);

	}



#ifdef CONFIG_PCI_IOV

	pci_iov_add_virtfn(edev->physfn, pdn->vf_index);
@@ -497,18 +499,20 @@ static void *eeh_rmv_device(void *data, void *userdata) 
	if (eeh_dev_removed(edev))

		return NULL;



	if (removed) {

		if (eeh_pe_passed(edev->pe))

			return NULL;

		driver = eeh_pcid_get(dev);

		if (driver) {

		eeh_pcid_put(dev);

		if (removed &&

		    eeh_pe_passed(edev->pe))

			return NULL;

		if (removed &&

		    driver->err_handler &&

			if (driver->err_handler &&

			    driver->err_handler->error_detected &&

		    driver->err_handler->slot_reset)

			    driver->err_handler->slot_reset) {

				eeh_pcid_put(dev);

				return NULL;

			}

			eeh_pcid_put(dev);

		}

	}



	/* Remove it from PCI subsystem */

	pr_debug("EEH: Removing %s without EEH sensitive driver\n",