@@ -1707,7 +1707,7 @@ static struct ndis_80211_pmkid *get_device_pmkids(struct usbnet *usbdev)
int len, ret, max_pmkids;
max_pmkids = priv->wdev.wiphy->max_num_pmkids;
- len = sizeof(*pmkids) + max_pmkids * sizeof(pmkids->bssid_info[0]);
+ len = struct_size(pmkids, bssid_info, max_pmkids);
pmkids = kzalloc(len, GFP_KERNEL);
if (!pmkids)
@@ -1740,7 +1740,7 @@ static int set_device_pmkids(struct usbnet *usbdev,
int ret, len, num_pmkids;
num_pmkids = le32_to_cpu(pmkids->bssid_info_count);
- len = sizeof(*pmkids) + num_pmkids * sizeof(pmkids->bssid_info[0]);
+ len = struct_size(pmkids, bssid_info, num_pmkids);
pmkids->length = cpu_to_le32(len);
debug_print_pmkids(usbdev, pmkids, __func__);
@@ -1761,7 +1761,7 @@ static struct ndis_80211_pmkid *remove_pmkid(struct usbnet *usbdev,
struct cfg80211_pmksa *pmksa,
int max_pmkids)
{
- int i, newlen, err;
+ int i, err;
unsigned int count;
count = le32_to_cpu(pmkids->bssid_info_count);
@@ -1786,9 +1786,7 @@ static struct ndis_80211_pmkid *remove_pmkid(struct usbnet *usbdev,
pmkids->bssid_info[i] = pmkids->bssid_info[i + 1];
count--;
- newlen = sizeof(*pmkids) + count * sizeof(pmkids->bssid_info[0]);
-
- pmkids->length = cpu_to_le32(newlen);
+ pmkids->length = cpu_to_le32(struct_size(pmkids, bssid_info, count));
pmkids->bssid_info_count = cpu_to_le32(count);
return pmkids;
@@ -1831,7 +1829,7 @@ static struct ndis_80211_pmkid *update_pmkid(struct usbnet *usbdev,
}
/* add new pmkid */
- newlen = sizeof(*pmkids) + (count + 1) * sizeof(pmkids->bssid_info[0]);
+ newlen = struct_size(pmkids, bssid_info, count + 1);
new_pmkids = krealloc(pmkids, newlen, GFP_KERNEL);
if (!new_pmkids) {
Make use of the struct_size() helper instead of an open-coded version in order to avoid any potential type mistakes, in particular in the context in which this code is being used. So, replace code of the following form: sizeof(*pmkids) + max_pmkids * sizeof(pmkids->bssid_info[0]) with: struct_size(pmkids, bssid_info, num_pmkids) This code was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> --- drivers/net/wireless/rndis_wlan.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)