11 Jul 2012 08:34
[patch] net/mlx4_en: dereferencing freed memory
Dan Carpenter <dan.carpenter <at> oracle.com>
2012-07-11 06:34:07 GMT
2012-07-11 06:34:07 GMT
We dereferenced "mclist" after the kfree().
Signed-off-by: Dan Carpenter <dan.carpenter <at> oracle.com>
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 94375a8..4ce5ca8 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
<at> <at> -503,9 +503,7 <at> <at> static void mlx4_en_do_set_multicast(struct work_struct *work)
/* remove from list */
list_del(&mclist->list);
kfree(mclist);
- }
-
- if (mclist->action == MCLIST_ADD) {
+ } else if (mclist->action == MCLIST_ADD) {
/* attach the address */
memcpy(&mc_list[10], mclist->addr, ETH_ALEN);
/* needed for B0 steering support */
RSS Feed