.. | .. |
---|
1253 | 1253 | skb_len = skb->len; |
---|
1254 | 1254 | d_fnstart(4, dev, "(i2400m %p skb %p [size %u])\n", |
---|
1255 | 1255 | i2400m, skb, skb_len); |
---|
1256 | | - result = -EIO; |
---|
1257 | 1256 | msg_hdr = (void *) skb->data; |
---|
1258 | 1257 | result = i2400m_rx_msg_hdr_check(i2400m, msg_hdr, skb_len); |
---|
1259 | 1258 | if (result < 0) |
---|
1260 | 1259 | goto error_msg_hdr_check; |
---|
1261 | 1260 | result = -EIO; |
---|
1262 | 1261 | num_pls = le16_to_cpu(msg_hdr->num_pls); |
---|
1263 | | - pl_itr = sizeof(*msg_hdr) + /* Check payload descriptor(s) */ |
---|
1264 | | - num_pls * sizeof(msg_hdr->pld[0]); |
---|
| 1262 | + /* Check payload descriptor(s) */ |
---|
| 1263 | + pl_itr = struct_size(msg_hdr, pld, num_pls); |
---|
1265 | 1264 | pl_itr = ALIGN(pl_itr, I2400M_PL_ALIGN); |
---|
1266 | 1265 | if (pl_itr > skb_len) { /* got all the payload descriptors? */ |
---|
1267 | 1266 | dev_err(dev, "RX: HW BUG? message too short (%u bytes) for " |
---|