Make use of the struct_size() helper instead of an open-coded version
in order to avoid any potential type mistakes, in particular in the
context in which this code is being used.

So, change the following form:

sizeof(*packet_desc) + (sizeof(packet_desc->PacketLength[0]) * 
seg->isoc_frame_count)

to :

struct_size(packet_status, PacketStatus, seg->isoc_frame_count);

This code was detected with the help of Coccinelle.

Signed-off-by: Gustavo A. R. Silva <gust...@embeddedor.com>
---
 drivers/usb/wusbcore/wa-xfer.c | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c
index 01f2f21830c0..abf88cea37bb 100644
--- a/drivers/usb/wusbcore/wa-xfer.c
+++ b/drivers/usb/wusbcore/wa-xfer.c
@@ -662,9 +662,9 @@ static void __wa_setup_isoc_packet_descr(
 
        /* populate isoc packet descriptor. */
        packet_desc->bPacketType = WA_XFER_ISO_PACKET_INFO;
-       packet_desc->wLength = cpu_to_le16(sizeof(*packet_desc) +
-               (sizeof(packet_desc->PacketLength[0]) *
-                       seg->isoc_frame_count));
+       packet_desc->wLength = cpu_to_le16(struct_size(packet_desc,
+                                          PacketLength,
+                                          seg->isoc_frame_count));
        for (frame_index = 0; frame_index < seg->isoc_frame_count;
                ++frame_index) {
                int offset_index = frame_index + seg->isoc_frame_offset;
@@ -2438,7 +2438,7 @@ static int wa_process_iso_packet_status(struct wahc *wa, 
struct urb *urb)
        struct wa_rpipe *rpipe;
        unsigned done = 0, dti_busy = 0, data_frame_count = 0, seg_index;
        unsigned first_frame_index = 0, rpipe_ready = 0;
-       int expected_size;
+       size_t expected_size;
 
        /* We have a xfer result buffer; check it */
        dev_dbg(dev, "DTI: isoc packet status %d bytes at %p\n",
@@ -2460,11 +2460,10 @@ static int wa_process_iso_packet_status(struct wahc 
*wa, struct urb *urb)
                goto error_bad_seg;
        seg = xfer->seg[wa->dti_isoc_xfer_seg];
        rpipe = xfer->ep->hcpriv;
-       expected_size = sizeof(*packet_status) +
-                       (sizeof(packet_status->PacketStatus[0]) *
-                       seg->isoc_frame_count);
+       expected_size = struct_size(packet_status, PacketStatus,
+                                   seg->isoc_frame_count);
        if (urb->actual_length != expected_size) {
-               dev_err(dev, "DTI Error: isoc packet status--bad urb length (%d 
bytes vs %d needed)\n",
+               dev_err(dev, "DTI Error: isoc packet status--bad urb length (%d 
bytes vs %zu needed)\n",
                        urb->actual_length, expected_size);
                goto error_bad_seg;
        }
-- 
2.20.1

Reply via email to