net/mlx4_en: dereferencing freed memory

We dereferenced "mclist" after the kfree().

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 1 insertions, 3 deletions

diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 94375a8c6d42..4ce5ca81a010 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -503,9 +503,7 @@ static void mlx4_en_do_set_multicast(struct work_struct *work)
                                 /* remove from list */
                                 list_del(&mclist->list);
                                 kfree(mclist);
-                        }
-
-                        if (mclist->action == MCLIST_ADD) {
+                        } else if (mclist->action == MCLIST_ADD) {
                                 /* attach the address */
                                 memcpy(&mc_list[10], mclist->addr, ETH_ALEN);
                                 /* needed for B0 steering support */