Michael S. Tsirkin wrote: > We traced this back to local_completions unlocking mad_agent_priv->lock > while still keeping a pointer into local_list. A later call to > list_del(&local->completion_list) would then corrupt the list. Nice catch. Thanks - applied. - Sean