Re: [STABLE v5.15.y 4/8] eventpoll: kill __ep_remove()

[Sasha Levin]

> Remove the boolean conditional in __ep_remove() and restructure the code
> so the check for racing with eventpoll_release_file() are only done in
> the ep_remove_safe() path where they belong.

This leaves ep_remove() with a redundant second refcount decrement on 5.15.y.
On this tree the decrement already happens inside the helper (ep_remove_epi()
ends with return ep_refcount_dec_and_test(ep), carried over correctly by patch
3/8), but this patch imports upstream's caller body verbatim:

  if (ep_remove_epi(...))
          WARN_ON_ONCE(ep_refcount_dec_and_test(ep));

Upstream can do that because its own helper returns true without decrementing;
5.15.y's doesn't, so on the WARN_ON_ONCE path this decrements an already-zero
refcount.

Could you respin with WARN_ON_ONCE(ep_remove_epi(ep, epi)); here instead,
keeping the decrement inside the helper?

-- 
Thanks,
Sasha