mISDN: Fix a use after free in hfcmulti_tx()

Don't dereference *sp after calling dev_kfree_skb(*sp).

Fixes: af69fb3a8ffa ("Add mISDN HFC multiport driver")
Signed-off-by: Dan Carpenter <[email protected]>
Reviewed-by: Simon Horman <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>

diff --git a/drivers/isdn/hardware/mISDN/hfcmulti.c b/drivers/isdn/hardware/mISDN/hfcmulti.c
index 0d2928d8aeae8f45d28b4263321d87ee4f09785b..e5a483fd9ad86f5878b9fcb5a603025aa8b68cb7 100644 (file)
--- a/drivers/isdn/hardware/mISDN/hfcmulti.c
+++ b/drivers/isdn/hardware/mISDN/hfcmulti.c
@@ -1901,7 +1901,7 @@ hfcmulti_dtmf(struct hfc_multi *hc)
 static void
 hfcmulti_tx(struct hfc_multi *hc, int ch)
 {
-       int i, ii, temp, len = 0;
+       int i, ii, temp, tmp_len, len = 0;
        int Zspace, z1, z2; /* must be int for calculation */
        int Fspace, f1, f2;
        u_char *d;
@@ -2122,14 +2122,15 @@ next_frame:
                HFC_wait_nodebug(hc);
        }
 
+       tmp_len = (*sp)->len;
        dev_kfree_skb(*sp);
        /* check for next frame */
        if (bch && get_next_bframe(bch)) {
-               len = (*sp)->len;
+               len = tmp_len;
                goto next_frame;
        }
        if (dch && get_next_dframe(dch)) {
-               len = (*sp)->len;
+               len = tmp_len;
                goto next_frame;
        }