| .. | .. |
|---|
| 1253 | 1253 | skb_len = skb->len; |
|---|
| 1254 | 1254 | d_fnstart(4, dev, "(i2400m %p skb %p [size %u])\n", |
|---|
| 1255 | 1255 | i2400m, skb, skb_len); |
|---|
| 1256 | | - result = -EIO; |
|---|
| 1257 | 1256 | msg_hdr = (void *) skb->data; |
|---|
| 1258 | 1257 | result = i2400m_rx_msg_hdr_check(i2400m, msg_hdr, skb_len); |
|---|
| 1259 | 1258 | if (result < 0) |
|---|
| 1260 | 1259 | goto error_msg_hdr_check; |
|---|
| 1261 | 1260 | result = -EIO; |
|---|
| 1262 | 1261 | num_pls = le16_to_cpu(msg_hdr->num_pls); |
|---|
| 1263 | | - pl_itr = sizeof(*msg_hdr) + /* Check payload descriptor(s) */ |
|---|
| 1264 | | - num_pls * sizeof(msg_hdr->pld[0]); |
|---|
| 1262 | + /* Check payload descriptor(s) */ |
|---|
| 1263 | + pl_itr = struct_size(msg_hdr, pld, num_pls); |
|---|
| 1265 | 1264 | pl_itr = ALIGN(pl_itr, I2400M_PL_ALIGN); |
|---|
| 1266 | 1265 | if (pl_itr > skb_len) { /* got all the payload descriptors? */ |
|---|
| 1267 | 1266 | dev_err(dev, "RX: HW BUG? message too short (%u bytes) for " |
|---|