net/mlx4_en: dereferencing freed memory
authorDan Carpenter <dan.carpenter@oracle.com>
Tue, 10 Jul 2012 20:34:07 +0000 (20:34 +0000)
committerDavid S. Miller <davem@davemloft.net>
Tue, 17 Jul 2012 05:58:07 +0000 (22:58 -0700)
We dereferenced "mclist" after the kfree().

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/ethernet/mellanox/mlx4/en_netdev.c

index 94375a8..4ce5ca8 100644 (file)
@@ -503,9 +503,7 @@ static void mlx4_en_do_set_multicast(struct work_struct *work)
                                /* remove from list */
                                list_del(&mclist->list);
                                kfree(mclist);
-                       }
-
-                       if (mclist->action == MCLIST_ADD) {
+                       } else if (mclist->action == MCLIST_ADD) {
                                /* attach the address */
                                memcpy(&mc_list[10], mclist->addr, ETH_ALEN);
                                /* needed for B0 steering support */