On Fri, 18 Mar 2022 14:42:19 +1100, Michael Ellerman wrote:

In remove_phb_dynamic() we use &phb->io_resource, after we've called
device_unregister(&host_bridge->dev). But the unregister may have freed
phb, because pcibios_free_controller_deferred() is the release function
for the host_bridge.

If there are no outstanding references when we call device_unregister()
then phb will be freed out from under us.

[...]

Applied to powerpc/next.

[1/1] powerpc/pseries: Fix use after free in remove_phb_dynamic()
      https://git.kernel.org/powerpc/c/fe2640bd7a62f1f7c3f55fbda31084085075bc30

cheers