Re: [PATCH] vdpa/mlx5: fix wrong list iterated in add_direct_chain error path

[Eugenio Perez Martin]

On Wed, Jul 1, 2026 at 1:36 PM lirongqing <lirongqing@xxxxxxxxx> wrote:
>
> From: Li RongQing <lirongqing@xxxxxxxxx>
>
> In add_direct_chain(), newly allocated direct MR entries are added to
> the local list 'tmp', which is spliced into mr->head only on success.
> On the error path, the cleanup loop was incorrectly iterating over
> mr->head instead of tmp.
>
> Fix by iterating over 'tmp' in the err_alloc cleanup path.
>
> Fixes: 94abbccdf291 ("vdpa/mlx5: Add shared memory registration code")

Acked-by: Eugenio Pérez <eperezma@xxxxxxxxxx>

Thanks!

> Signed-off-by: Li RongQing <lirongqing@xxxxxxxxx>
> ---
>  drivers/vdpa/mlx5/core/mr.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/vdpa/mlx5/core/mr.c b/drivers/vdpa/mlx5/core/mr.c
> index 6d02ccf..1a224f0 100644
> --- a/drivers/vdpa/mlx5/core/mr.c
> +++ b/drivers/vdpa/mlx5/core/mr.c
> @@ -480,7 +480,7 @@ static int add_direct_chain(struct mlx5_vdpa_dev *mvdev,
>         return 0;
>
>  err_alloc:
> -       list_for_each_entry_safe(dmr, n, &mr->head, list) {
> +       list_for_each_entry_safe(dmr, n, &tmp, list) {
>                 list_del_init(&dmr->list);
>                 unmap_direct_mr(mvdev, dmr);
>                 kfree(dmr);
> --
> 2.9.4
>