Shouldn't this code also do a list_del(e) ?
in drivers/infiniband/core/iwcm.c:
static void dealloc_work_entries(struct iwcm_id_private *cm_id_priv)
{
struct list_head *e, *tmp;
list_for_each_safe(e, tmp, &cm_id_priv->work_free_list)
kfree(list_entry(e, struct iwcm_work, free_list));
}