Subject: smatch stuff: use after free bug

From: Dan Carpenter <[email-masked]>
Date: Mon, 28 Mar 2011 13:31:40 +0300

Smatch complains about this.  It's not obvious to me how to fix it.  The
bug was introduced in b12d93d63 "mlx4: Add support for promiscuous mode
in the new steering model.".

drivers/net/mlx4/mcg.c +530
	remove_promisc_qp(89) warn: 'pqp' was already freed.

   526  out_mailbox:
   527          mlx4_free_cmd_mailbox(dev, mailbox);
   528  out_list:
   529          if (back_to_list)
   530                  list_add_tail(&pqp->list, &s_steer->promisc_qps[steer]);
                                      ^^^^^^^^^^

This list was deleted and pqp was freed at this point.

   531  out_mutex:
   532          mutex_unlock(&priv->mcg_table.mutex);
   533          return err;
   534  }

regards,
dan carpenter