[PATCH] powerpc/pseries/pci: Prevent double free of VF PE map

On failure of pcibios_sriov_enable(), drivers/pci/iov.c calls
pcibios_sriov_disable() unconditionally. pseries frees
pdn->pe_num_map without NULLing it, both on the error path of
pseries_pci_sriov_enable() and in pseries_pcibios_sriov_disable(),
so the dangling pointer is freed again when the core cleans up.
Set pdn->pe_num_map to NULL after kfree() in both places.

Fixes: 9a7f6b438664 ("powerpc/pseries/pci: Associate PEs to VFs in configure SR-IOV")
Cc: [email protected]
Reported-by: [email protected]
Link: https://sashiko.dev/#/patchset/20260813035323.245229-1-yijiangshan%40kylinos.cn
Signed-off-by: Jiangshan Yi <[email protected]>
---
 arch/powerpc/platforms/pseries/pci.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/powerpc/platforms/pseries/pci.c b/arch/powerpc/platforms/pseries/pci.c
index 6fc13f4a79a3..13d0baea5786 100644
--- a/arch/powerpc/platforms/pseries/pci.c
+++ b/arch/powerpc/platforms/pseries/pci.c
@@ -154,6 +154,7 @@ static int pseries_pci_sriov_enable(struct pci_dev *pdev, u16 num_vfs)
 	if (rc) {
 		dev_err(&pdev->dev, "Failure to enable sriov: %x\n", rc);
 		kfree(pdn->pe_num_map);
+		pdn->pe_num_map = NULL;
 	} else {
 		pci_vf_drivers_autoprobe(pdev, false);
 	}
@@ -175,6 +176,7 @@ static int pseries_pcibios_sriov_disable(struct pci_dev *pdev)
 	pdn = pci_get_pdn(pdev);
 	/* Releasing pe_num_map */
 	kfree(pdn->pe_num_map);
+	pdn->pe_num_map = NULL;
 	/* Release PCI data */
 	remove_sriov_vf_pdns(pdev);
 	pci_vf_drivers_autoprobe(pdev, true);
-- 
2.25.1