620 	lnkid->ie_len = sizeof(struct ieee80211_tdls_lnkie) -  in mwifiex_tdls_add_link_ie()
952 		u8 ie_len = pos[1];  in mwifiex_process_tdls_action_frame()  local
954 		if (pos + 2 + ie_len > end)  in mwifiex_process_tdls_action_frame()
959 			if (ie_len > sizeof(sta_ptr->tdls_cap.rates))  in mwifiex_process_tdls_action_frame()
961 			sta_ptr->tdls_cap.rates_len = ie_len;  in mwifiex_process_tdls_action_frame()
962 			for (i = 0; i < ie_len; i++)  in mwifiex_process_tdls_action_frame()
967 			if (ie_len > sizeof(sta_ptr->tdls_cap.rates))  in mwifiex_process_tdls_action_frame()
970 			if (ie_len > sizeof(sta_ptr->tdls_cap.rates) - basic)  in mwifiex_process_tdls_action_frame()
972 			for (i = 0; i < ie_len; i++)  in mwifiex_process_tdls_action_frame()
974 			sta_ptr->tdls_cap.rates_len += ie_len;  in mwifiex_process_tdls_action_frame()
977 			if (ie_len != sizeof(struct ieee80211_ht_cap))  in mwifiex_process_tdls_action_frame()
985 			if (ie_len != sizeof(struct ieee80211_ht_operation))  in mwifiex_process_tdls_action_frame()
992 			if (ie_len != sizeof(pos[2]))  in mwifiex_process_tdls_action_frame()
997 			if (ie_len < sizeof(struct ieee_types_header))  in mwifiex_process_tdls_action_frame()
999 			if (ie_len > 8)  in mwifiex_process_tdls_action_frame()
1003 			       min_t(u8, ie_len, 8));  in mwifiex_process_tdls_action_frame()
1006 			if (ie_len < sizeof(struct ieee_types_header))  in mwifiex_process_tdls_action_frame()
1008 			if (ie_len > IEEE_MAX_IE_SIZE -  in mwifiex_process_tdls_action_frame()
1013 			       min_t(u8, ie_len, IEEE_MAX_IE_SIZE -  in mwifiex_process_tdls_action_frame()
1017 			if (ie_len != sizeof(pos[2]))  in mwifiex_process_tdls_action_frame()
1023 				if (ie_len !=  in mwifiex_process_tdls_action_frame()
1033 				if (ie_len != sizeof(struct ieee80211_vht_cap))  in mwifiex_process_tdls_action_frame()
1043 				if (ie_len != sizeof(u16))  in mwifiex_process_tdls_action_frame()