s390/pci: Fix potential double remove of hotplug slot

JIRA: https://issues.redhat.com/browse/RHEL-94944

commit c4a585e
Author: Niklas Schnelle <schnelle@linux.ibm.com>
Date:   Mon Nov 25 16:02:38 2024 +0100

    s390/pci: Fix potential double remove of hotplug slot

    In commit 6ee600b ("s390/pci: remove hotplug slot when releasing the
    device") the zpci_exit_slot() was moved from zpci_device_reserved() to
    zpci_release_device() with the intention of keeping the hotplug slot
    around until the device is actually removed.

    Now zpci_release_device() is only called once all references are
    dropped. Since the zPCI subsystem only drops its reference once the
    device is in the reserved state it follows that zpci_release_device()
    must only deal with devices in the reserved state. Despite that it
    contains code to tear down from both configured and standby state. For
    the standby case this already includes the removal of the hotplug slot
    so would cause a double removal if a device was ever removed in
    either configured or standby state.

    Instead of causing a potential double removal in a case that should
    never happen explicitly WARN_ON() if a device in non-reserved state is
    released and get rid of the dead code cases.

    Fixes: 6ee600b ("s390/pci: remove hotplug slot when releasing the device")
    Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
    Reviewed-by: Gerd Bayer <gbayer@linux.ibm.com>
    Tested-by: Gerd Bayer <gbayer@linux.ibm.com>
    Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
    Signed-off-by: Heiko Carstens <hca@linux.ibm.com>

Signed-off-by: Mete Durlu <mdurlu@redhat.com>

Author: Mete Durlu

arch/s390/pci/pci.c

@@ -940,39 +940,23 @@ void zpci_device_reserved(struct zpci_dev *zdev)
 void zpci_release_device(struct kref *kref)
 {
 	struct zpci_dev *zdev = container_of(kref, struct zpci_dev, kref);
-	int ret;
 
-	if (zdev->has_hp_slot)
-		zpci_exit_slot(zdev);
+	WARN_ON(zdev->state != ZPCI_FN_STATE_RESERVED);
 
 	if (zdev->zbus->bus)
 		zpci_bus_remove_device(zdev, false);
 
 	if (zdev_enabled(zdev))
 		zpci_disable_device(zdev);
 
-	switch (zdev->state) {
-	case ZPCI_FN_STATE_CONFIGURED:
-		ret = sclp_pci_deconfigure(zdev->fid);
-		zpci_dbg(3, "deconf fid:%x, rc:%d\n", zdev->fid, ret);
-		fallthrough;
-	case ZPCI_FN_STATE_STANDBY:
-		if (zdev->has_hp_slot)
-			zpci_exit_slot(zdev);
-		spin_lock(&zpci_list_lock);
-		list_del(&zdev->entry);
-		spin_unlock(&zpci_list_lock);
-		zpci_dbg(3, "rsv fid:%x\n", zdev->fid);
-		fallthrough;
-	case ZPCI_FN_STATE_RESERVED:
-		if (zdev->has_resources)
-			zpci_cleanup_bus_resources(zdev);
-		zpci_bus_device_unregister(zdev);
-		zpci_destroy_iommu(zdev);
-		fallthrough;
-	default:
-		break;
-	}
+	if (zdev->has_hp_slot)
+		zpci_exit_slot(zdev);
+
+	if (zdev->has_resources)
+		zpci_cleanup_bus_resources(zdev);
+
+	zpci_bus_device_unregister(zdev);
+	zpci_destroy_iommu(zdev);
 	zpci_dbg(3, "rem fid:%x\n", zdev->fid);
 	kfree_rcu(zdev, rcu);
 }