Make use of the struct_size() helper instead of an open-coded version in order to avoid any potential type mistakes, in particular in the context in which this code is being used. So, replace code of the following form: sizeof(*pmkids) + max_pmkids * sizeof(pmkids->bssid_info[0]) with: struct_size(pmkids, bssid_info, num_pmkids) This code was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva <gustavo@xxxxxxxxxxxxxx> --- drivers/net/wireless/rndis_wlan.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c index 51e4e92d95a0..e07a1152cec1 100644 --- a/drivers/net/wireless/rndis_wlan.c +++ b/drivers/net/wireless/rndis_wlan.c @@ -1707,7 +1707,7 @@ static struct ndis_80211_pmkid *get_device_pmkids(struct usbnet *usbdev) int len, ret, max_pmkids; max_pmkids = priv->wdev.wiphy->max_num_pmkids; - len = sizeof(*pmkids) + max_pmkids * sizeof(pmkids->bssid_info[0]); + len = struct_size(pmkids, bssid_info, max_pmkids); pmkids = kzalloc(len, GFP_KERNEL); if (!pmkids) @@ -1740,7 +1740,7 @@ static int set_device_pmkids(struct usbnet *usbdev, int ret, len, num_pmkids; num_pmkids = le32_to_cpu(pmkids->bssid_info_count); - len = sizeof(*pmkids) + num_pmkids * sizeof(pmkids->bssid_info[0]); + len = struct_size(pmkids, bssid_info, num_pmkids); pmkids->length = cpu_to_le32(len); debug_print_pmkids(usbdev, pmkids, __func__); @@ -1761,7 +1761,7 @@ static struct ndis_80211_pmkid *remove_pmkid(struct usbnet *usbdev, struct cfg80211_pmksa *pmksa, int max_pmkids) { - int i, newlen, err; + int i, err; unsigned int count; count = le32_to_cpu(pmkids->bssid_info_count); @@ -1786,9 +1786,7 @@ static struct ndis_80211_pmkid *remove_pmkid(struct usbnet *usbdev, pmkids->bssid_info[i] = pmkids->bssid_info[i + 1]; count--; - newlen = sizeof(*pmkids) + count * sizeof(pmkids->bssid_info[0]); - - pmkids->length = cpu_to_le32(newlen); + pmkids->length = cpu_to_le32(struct_size(pmkids, bssid_info, count)); pmkids->bssid_info_count = cpu_to_le32(count); return pmkids; @@ -1831,7 +1829,7 @@ static struct ndis_80211_pmkid *update_pmkid(struct usbnet *usbdev, } /* add new pmkid */ - newlen = sizeof(*pmkids) + (count + 1) * sizeof(pmkids->bssid_info[0]); + newlen = struct_size(pmkids, bssid_info, count + 1); new_pmkids = krealloc(pmkids, newlen, GFP_KERNEL); if (!new_pmkids) { -- 2.21.0