Patch "s390/pci: Fix potential double remove of hotplug slot" has been added to the 6.12-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    s390/pci: Fix potential double remove of hotplug slot

to the 6.12-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     s390-pci-fix-potential-double-remove-of-hotplug-slot.patch
and it can be found in the queue-6.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 47da24c619cb6c89ab9b2671ec108ffe31b27956
Author: Niklas Schnelle <schnelle@xxxxxxxxxxxxx>
Date:   Mon Nov 25 16:02:38 2024 +0100

    s390/pci: Fix potential double remove of hotplug slot
    
    [ Upstream commit c4a585e952ca403a370586d3f16e8331a7564901 ]
    
    In commit 6ee600bfbe0f ("s390/pci: remove hotplug slot when releasing the
    device") the zpci_exit_slot() was moved from zpci_device_reserved() to
    zpci_release_device() with the intention of keeping the hotplug slot
    around until the device is actually removed.
    
    Now zpci_release_device() is only called once all references are
    dropped. Since the zPCI subsystem only drops its reference once the
    device is in the reserved state it follows that zpci_release_device()
    must only deal with devices in the reserved state. Despite that it
    contains code to tear down from both configured and standby state. For
    the standby case this already includes the removal of the hotplug slot
    so would cause a double removal if a device was ever removed in
    either configured or standby state.
    
    Instead of causing a potential double removal in a case that should
    never happen explicitly WARN_ON() if a device in non-reserved state is
    released and get rid of the dead code cases.
    
    Fixes: 6ee600bfbe0f ("s390/pci: remove hotplug slot when releasing the device")
    Reviewed-by: Matthew Rosato <mjrosato@xxxxxxxxxxxxx>
    Reviewed-by: Gerd Bayer <gbayer@xxxxxxxxxxxxx>
    Tested-by: Gerd Bayer <gbayer@xxxxxxxxxxxxx>
    Signed-off-by: Niklas Schnelle <schnelle@xxxxxxxxxxxxx>
    Signed-off-by: Heiko Carstens <hca@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
index be3299609f9b6..635fd8f2acbaa 100644
--- a/arch/s390/pci/pci.c
+++ b/arch/s390/pci/pci.c
@@ -917,10 +917,8 @@ void zpci_device_reserved(struct zpci_dev *zdev)
 void zpci_release_device(struct kref *kref)
 {
 	struct zpci_dev *zdev = container_of(kref, struct zpci_dev, kref);
-	int ret;
 
-	if (zdev->has_hp_slot)
-		zpci_exit_slot(zdev);
+	WARN_ON(zdev->state != ZPCI_FN_STATE_RESERVED);
 
 	if (zdev->zbus->bus)
 		zpci_bus_remove_device(zdev, false);
@@ -928,28 +926,14 @@ void zpci_release_device(struct kref *kref)
 	if (zdev_enabled(zdev))
 		zpci_disable_device(zdev);
 
-	switch (zdev->state) {
-	case ZPCI_FN_STATE_CONFIGURED:
-		ret = sclp_pci_deconfigure(zdev->fid);
-		zpci_dbg(3, "deconf fid:%x, rc:%d\n", zdev->fid, ret);
-		fallthrough;
-	case ZPCI_FN_STATE_STANDBY:
-		if (zdev->has_hp_slot)
-			zpci_exit_slot(zdev);
-		spin_lock(&zpci_list_lock);
-		list_del(&zdev->entry);
-		spin_unlock(&zpci_list_lock);
-		zpci_dbg(3, "rsv fid:%x\n", zdev->fid);
-		fallthrough;
-	case ZPCI_FN_STATE_RESERVED:
-		if (zdev->has_resources)
-			zpci_cleanup_bus_resources(zdev);
-		zpci_bus_device_unregister(zdev);
-		zpci_destroy_iommu(zdev);
-		fallthrough;
-	default:
-		break;
-	}
+	if (zdev->has_hp_slot)
+		zpci_exit_slot(zdev);
+
+	if (zdev->has_resources)
+		zpci_cleanup_bus_resources(zdev);
+
+	zpci_bus_device_unregister(zdev);
+	zpci_destroy_iommu(zdev);
 	zpci_dbg(3, "rem fid:%x\n", zdev->fid);
 	kfree_rcu(zdev, rcu);
 }