net/mlx4_en: dereferencing freed memory

We dereferenced "mclist" after the kfree().

Signed-off-by: Dan Carpenter <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 94375a8c6d42ac1b022ebeca37e13201b4f5d85a..4ce5ca81a010e67bc92e74b5db7ca9e300c0db58 100644 (file)
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -503,9 +503,7 @@ static void mlx4_en_do_set_multicast(struct work_struct *work)
                                /* remove from list */
                                list_del(&mclist->list);
                                kfree(mclist);
-                       }
-
-                       if (mclist->action == MCLIST_ADD) {
+                       } else if (mclist->action == MCLIST_ADD) {
                                /* attach the address */
                                memcpy(&mc_list[10], mclist->addr, ETH_ALEN);
                                /* needed for B0 steering support */