forked from ~ljy/RK356X_SDK_RELEASE

hc
2024-01-31 f70575805708cabdedea7498aaa3f710fde4d920
kernel/drivers/net/wimax/i2400m/rx.c
....@@ -1253,15 +1253,14 @@
12531253 skb_len = skb->len;
12541254 d_fnstart(4, dev, "(i2400m %p skb %p [size %u])\n",
12551255 i2400m, skb, skb_len);
1256
- result = -EIO;
12571256 msg_hdr = (void *) skb->data;
12581257 result = i2400m_rx_msg_hdr_check(i2400m, msg_hdr, skb_len);
12591258 if (result < 0)
12601259 goto error_msg_hdr_check;
12611260 result = -EIO;
12621261 num_pls = le16_to_cpu(msg_hdr->num_pls);
1263
- pl_itr = sizeof(*msg_hdr) + /* Check payload descriptor(s) */
1264
- num_pls * sizeof(msg_hdr->pld[0]);
1262
+ /* Check payload descriptor(s) */
1263
+ pl_itr = struct_size(msg_hdr, pld, num_pls);
12651264 pl_itr = ALIGN(pl_itr, I2400M_PL_ALIGN);
12661265 if (pl_itr > skb_len) { /* got all the payload descriptors? */
12671266 dev_err(dev, "RX: HW BUG? message too short (%u bytes) for "