[IB] Fix RMPP receive length calculation

Based on simplification idea from Sean Hefty <sean.hefty@intel.com>

Signed-off-by: Hal Rosenstock <halr@voltaire.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

1 files changed, 2 insertions, 2 deletions

diff --git a/drivers/infiniband/core/mad_rmpp.c b/drivers/infiniband/core/mad_rmpp.c
index 8f7cef0812f6..e23836d0e21b 100644
--- a/drivers/infiniband/core/mad_rmpp.c
+++ b/drivers/infiniband/core/mad_rmpp.c
@@ -412,8 +412,8 @@ static inline int get_mad_len(struct mad_rmpp_recv *rmpp_recv)
 
         hdr_size = data_offset(rmpp_mad->mad_hdr.mgmt_class);
         data_size = sizeof(struct ib_rmpp_mad) - hdr_size;
-        pad = data_size - be32_to_cpu(rmpp_mad->rmpp_hdr.paylen_newwin);
-        if (pad > data_size || pad < 0)
+        pad = IB_MGMT_RMPP_DATA - be32_to_cpu(rmpp_mad->rmpp_hdr.paylen_newwin);
+        if (pad > IB_MGMT_RMPP_DATA || pad < 0)
                 pad = 0;
 
         return hdr_size + rmpp_recv->seg_num * data_size - pad;