Re: FW: [patch] net/mlx4_en: dereferencing freed memory

-----Original Message-----
From: Dan Carpenter [mailto:dan.carpenter@oracle.com]
Sent: Wednesday, July 11, 2012 9:34 AM
To: Yevgeny Petrilin
Cc: David S. Miller; Amir Vadai; Or Gerlitz; Alexander Guller; netdev@vger.kernel.org; kernel-janitors@vger.kernel.org
Subject: [patch] net/mlx4_en: dereferencing freed memory

We dereferenced "mclist" after the kfree().

Signed-off-by: Dan Carpenter <redacted>

diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 94375a8..4ce5ca8 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c

@@ -503,9 +503,7 @@ static void mlx4_en_do_set_multicast(struct work_struct *work)
  				/* remove from list */
  				list_del(&mclist->list);
  				kfree(mclist);
-			}
-
-			if (mclist->action == MCLIST_ADD) {
+			} else if (mclist->action == MCLIST_ADD) {
  				/* attach the address */
  				memcpy(&mc_list[10], mclist->addr, ETH_ALEN);
  				/* needed for B0 steering support */