powerpc/eeh: Fix use-after-release of EEH driver

[ Upstream commit 46d4be41 ]

Correct two cases where eeh_pcid_get() is used to reference the driver's
module but the reference is dropped before the driver pointer is used.

In eeh_rmv_device() also refactor a little so that only two calls to
eeh_pcid_put() are needed, rather than three and the reference isn't
taken at all if it wasn't needed.
Signed-off-by: Sam Bobroff <sbobroff@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

arch/powerpc/kernel/eeh_driver.c

@@ -450,10 +450,12 @@ static void *eeh_add_virt_device(void *data, void *userdata)
 
 	driver = eeh_pcid_get(dev);
 	if (driver) {
+		if (driver->err_handler) {
 			eeh_pcid_put(dev);
-		if (driver->err_handler)
 			return NULL;
 		}
+		eeh_pcid_put(dev);
+	}
 
 #ifdef CONFIG_PPC_POWERNV
 	pci_iov_add_virtfn(edev->physfn, pdn->vf_index, 0);
@@ -489,18 +491,20 @@ static void *eeh_rmv_device(void *data, void *userdata)
 	if (eeh_dev_removed(edev))
 		return NULL;
 
+	if (removed) {
+		if (eeh_pe_passed(edev->pe))
+			return NULL;
 		driver = eeh_pcid_get(dev);
 		if (driver) {
-		eeh_pcid_put(dev);
-		if (removed &&
-		    eeh_pe_passed(edev->pe))
-			return NULL;
-		if (removed &&
-		    driver->err_handler &&
+			if (driver->err_handler &&
 			    driver->err_handler->error_detected &&
-		    driver->err_handler->slot_reset)
+			    driver->err_handler->slot_reset) {
+				eeh_pcid_put(dev);
 				return NULL;
 			}
+			eeh_pcid_put(dev);
+		}
+	}
 
 	/* Remove it from PCI subsystem */
 	pr_debug("EEH: Removing %s without EEH sensitive driver\n",