drm/panfrost: Fix shrinker list corruption by madvise IOCTL

stable inclusion
from stable-v5.10.132
commit 0581613df7f9a4c5fac096ce1d5fb15b7b994240
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I5YS3T

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0581613df7f9a4c5fac096ce1d5fb15b7b994240

--------------------------------

commit 9fc33eaa upstream.

Calling madvise IOCTL twice on BO causes memory shrinker list corruption
and crashes kernel because BO is already on the list and it's added to
the list again, while BO should be removed from the list before it's
re-added. Fix it.

Cc: stable@vger.kernel.org
Fixes: 013b6510 ("drm/panfrost: Add madvise and shrinker support")
Acked-by: NAlyssa Rosenzweig <alyssa.rosenzweig@collabora.com>
Reviewed-by: NSteven Price <steven.price@arm.com>
Signed-off-by: NDmitry Osipenko <dmitry.osipenko@collabora.com>
Signed-off-by: NSteven Price <steven.price@arm.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20220630200601.1884120-3-dmitry.osipenko@collabora.comSigned-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Acked-by: NXie XiuQi <xiexiuqi@huawei.com>

drivers/gpu/drm/panfrost/panfrost_drv.c

@@ -427,8 +427,8 @@ static int panfrost_ioctl_madvise(struct drm_device *dev, void *data,
 
 	if (args->retained) {
 		if (args->madv == PANFROST_MADV_DONTNEED)
-			list_add_tail(&bo->base.madv_list,
-				      &pfdev->shrinker_list);
+			list_move_tail(&bo->base.madv_list,
+				       &pfdev->shrinker_list);
 		else if (args->madv == PANFROST_MADV_WILLNEED)
 			list_del_init(&bo->base.madv_list);
 	}