mlx4_core: Fix possible bad free in mlx4_buf_free()