···9797{9898 struct idxd_desc *d, *t, *found = NULL;9999 struct llist_node *head;100100+ LIST_HEAD(flist);100101101102 desc->completion->status = IDXD_COMP_DESC_ABORT;102103 /*···112111 found = desc;113112 continue;114113 }115115- list_add_tail(&desc->list, &ie->work_list);114114+115115+ if (d->completion->status)116116+ list_add_tail(&d->list, &flist);117117+ else118118+ list_add_tail(&d->list, &ie->work_list);116119 }117120 }118121···126121127122 if (found)128123 idxd_dma_complete_txd(found, IDXD_COMPLETE_ABORT, false);124124+125125+ /*126126+ * completing the descriptor will return desc to allocator and127127+ * the desc can be acquired by a different process and the128128+ * desc->list can be modified. Delete desc from list so the129129+ * list trasversing does not get corrupted by the other process.130130+ */131131+ list_for_each_entry_safe(d, t, &flist, list) {132132+ list_del_init(&d->list);133133+ idxd_dma_complete_txd(found, IDXD_COMPLETE_ABORT, true);134134+ }129135}130136131137/*