[PATCH v2 1/2] platform/surface: aggregator: Fix wrong completion list for pending packets

[Wentao Liang <vulab@iscas.ac.cn>]

ssh_ptl_shutdown() takes the packets it has to cancel out of the queue
and out of the pending set and collects them in two local lists, which
are drained once both locks have been dropped. Packets from the pending
set are moved to complete_p through pending_node, as their queue_node
may still be in use by the queue when a pending packet is re-queued for
retransmission. The move itself, however, targets complete_q.

An entry added that way is linked into complete_q via pending_node,
while the loop that drains complete_q looks the entry up with
queue_node. The two nodes are at different offsets in struct
ssh_packet, so list_for_each_entry() derives a packet pointer that is
shifted by that difference: the state bit is updated at the wrong
offset and the completion and reference-drop run on an object that is
not the packet the list entry belongs to. At the same time complete_p
stays empty and its drain loop never runs.

Move the pending packets to complete_p as intended.

Fixes: c167b9c7e3d6 ("platform/surface: Add Surface Aggregator subsystem")
Cc: stable@vger.kernel.org
Acked-by: Maximilian Luz <luzmaximilian@gmail.com>
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/platform/surface/aggregator/ssh_packet_layer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/surface/aggregator/ssh_packet_layer.c b/drivers/platform/surface/aggregator/ssh_packet_layer.c
index 3dd22856570f..a51395942747 100644
--- a/drivers/platform/surface/aggregator/ssh_packet_layer.c
+++ b/drivers/platform/surface/aggregator/ssh_packet_layer.c
@@ -1983,7 +1983,7 @@ void ssh_ptl_shutdown(struct ssh_ptl *ptl)
 		smp_mb__before_atomic();
 		clear_bit(SSH_PACKET_SF_PENDING_BIT, &p->state);
 
-		list_move_tail(&p->pending_node, &complete_q);
+		list_move_tail(&p->pending_node, &complete_p);
 	}
 	atomic_set(&ptl->pending.count, 0);
 	spin_unlock(&ptl->pending.lock);

-- 
2.34.1