@@ -662,9 +662,9 @@ static void __wa_setup_isoc_packet_descr(
/* populate isoc packet descriptor. */
packet_desc->bPacketType = WA_XFER_ISO_PACKET_INFO;
- packet_desc->wLength = cpu_to_le16(sizeof(*packet_desc) +
- (sizeof(packet_desc->PacketLength[0]) *
- seg->isoc_frame_count));
+ packet_desc->wLength = cpu_to_le16(struct_size(packet_desc,
+ PacketLength,
+ seg->isoc_frame_count));
for (frame_index = 0; frame_index < seg->isoc_frame_count;
++frame_index) {
int offset_index = frame_index + seg->isoc_frame_offset;
@@ -2438,7 +2438,7 @@ static int wa_process_iso_packet_status(struct wahc *wa, struct urb *urb)
struct wa_rpipe *rpipe;
unsigned done = 0, dti_busy = 0, data_frame_count = 0, seg_index;
unsigned first_frame_index = 0, rpipe_ready = 0;
- int expected_size;
+ size_t expected_size;
/* We have a xfer result buffer; check it */
dev_dbg(dev, "DTI: isoc packet status %d bytes at %p\n",
@@ -2460,11 +2460,10 @@ static int wa_process_iso_packet_status(struct wahc *wa, struct urb *urb)
goto error_bad_seg;
seg = xfer->seg[wa->dti_isoc_xfer_seg];
rpipe = xfer->ep->hcpriv;
- expected_size = sizeof(*packet_status) +
- (sizeof(packet_status->PacketStatus[0]) *
- seg->isoc_frame_count);
+ expected_size = struct_size(packet_status, PacketStatus,
+ seg->isoc_frame_count);
if (urb->actual_length != expected_size) {
- dev_err(dev, "DTI Error: isoc packet status--bad urb length (%d bytes vs %d needed)\n",
+ dev_err(dev, "DTI Error: isoc packet status--bad urb length (%d bytes vs %zu needed)\n",
urb->actual_length, expected_size);
goto error_bad_seg;
}
Make use of the struct_size() helper instead of an open-coded version in order to avoid any potential type mistakes, in particular in the context in which this code is being used. So, change the following form: sizeof(*packet_desc) + (sizeof(packet_desc->PacketLength[0]) * seg->isoc_frame_count) to : struct_size(packet_status, PacketStatus, seg->isoc_frame_count); This code was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> --- drivers/usb/wusbcore/wa-xfer.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)