[PATCH v2 0/2] platform/surface: aggregator: Fix packet list handling in ssh_ptl_shutdown()

[Wentao Liang <vulab@iscas.ac.cn>]

Hi Maximilian, Ilpo,

this is a split of the single patch I sent in September, following the
review comments from Ilpo and Maximilian. The two problems in
ssh_ptl_shutdown() are independent, so patch 1 corrects the list that
pending packets are moved to, and patch 2 makes both drain loops safe
against the packet being released while iterating.

Changes in v2:
 - Sorry for the delay in getting back to this review.
 - Split into two patches as requested, instead of one patch that mixes
   two independent problems.
 - The pending/complete list mismatch has its own changelog describing
   the effect of the wrong list node, as Maximilian asked for.
 - Both patches carry Maximilian's Acked-by.

Link: https://lore.kernel.org/all/20260917135607.2154130-1-vulab@iscas.ac.cn/

The candidate was found with our static analysis tooling; the audit and
the fix were then assisted by DeepSeek and GPT-6.1 Sol. The patches are
based on mainline as of d4872371bae (v7.4-rc1) and were built for x86_64
with CONFIG_SURFACE_AGGREGATOR=m, without new warnings; checkpatch.pl
reports no issues. I could not test them at runtime, as that needs a
Surface device shutting down with packets still queued or pending.

Wentao Liang (2):
  platform/surface: aggregator: Fix wrong completion list for pending
    packets
  platform/surface: aggregator: Fix use-after-free in ssh_ptl_shutdown()

 drivers/platform/surface/aggregator/ssh_packet_layer.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

-- 
2.34.1