[PATCH net] mISDN: hfcpci: Fix a use after free in hfcmulti_tx()

[Dan Carpenter <dan.carpenter@xxxxxxxxxx>]

This frees "*sp" before dereferencing it to get "len = (*sp)->len;".

Fixes: af69fb3a8ffa ("Add mISDN HFC multiport driver")
Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
---
 drivers/isdn/hardware/mISDN/hfcmulti.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/drivers/isdn/hardware/mISDN/hfcmulti.c b/drivers/isdn/hardware/mISDN/hfcmulti.c
index 7013a3f08429..ce6c160e0df4 100644
--- a/drivers/isdn/hardware/mISDN/hfcmulti.c
+++ b/drivers/isdn/hardware/mISDN/hfcmulti.c
@@ -2152,16 +2152,14 @@ hfcmulti_tx(struct hfc_multi *hc, int ch)
 		HFC_wait_nodebug(hc);
 	}
 
+	len = (*sp)->len;
 	dev_kfree_skb(*sp);
 	/* check for next frame */
-	if (bch && get_next_bframe(bch)) {
-		len = (*sp)->len;
+	if (bch && get_next_bframe(bch))
 		goto next_frame;
-	}
-	if (dch && get_next_dframe(dch)) {
-		len = (*sp)->len;
+
+	if (dch && get_next_dframe(dch))
 		goto next_frame;
-	}
 
 	/*
 	 * now we have no more data, so in case of transparent,
-- 
2.28.0