From: Ivo van Doorn Date: Sat, 6 Oct 2007 12:18:22 +0000 (+0200) Subject: [PATCH] rt2x00: Allways memset memory obtained from skb_push() X-Git-Tag: v2.6.24-rc1~1454^2~100 X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c22eb87b5723b3d66665ca2ffa87428e0e489b16;p=linux-2.6 [PATCH] rt2x00: Allways memset memory obtained from skb_push() When skb_push() is used we should memset the memory before usage. This will prevent bugs which could occur when the data is treated as TX descriptor. Signed-off-by: Ivo van Doorn Signed-off-by: John W. Linville --- diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c index 45f8f744a1..7cdc80a122 100644 --- a/drivers/net/wireless/rt2x00/rt2500usb.c +++ b/drivers/net/wireless/rt2x00/rt2500usb.c @@ -1665,6 +1665,8 @@ static int rt2500usb_beacon_update(struct ieee80211_hw *hw, * First we create the beacon. */ skb_push(skb, ring->desc_size); + memset(skb->data, 0, ring->desc_size); + rt2x00lib_write_tx_desc(rt2x00dev, (struct data_desc *)skb->data, (struct ieee80211_hdr *)(skb->data + ring->desc_size), diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c index 1a869a5cbe..01dbef19d6 100644 --- a/drivers/net/wireless/rt2x00/rt61pci.c +++ b/drivers/net/wireless/rt2x00/rt61pci.c @@ -2437,6 +2437,8 @@ static int rt61pci_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb, * First we create the beacon. */ skb_push(skb, TXD_DESC_SIZE); + memset(skb->data, 0, TXD_DESC_SIZE); + rt2x00lib_write_tx_desc(rt2x00dev, (struct data_desc *)skb->data, (struct ieee80211_hdr *)(skb->data + TXD_DESC_SIZE), diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c index 67a1e3750d..3e42759473 100644 --- a/drivers/net/wireless/rt2x00/rt73usb.c +++ b/drivers/net/wireless/rt2x00/rt73usb.c @@ -1939,6 +1939,8 @@ static int rt73usb_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb, * First we create the beacon. */ skb_push(skb, TXD_DESC_SIZE); + memset(skb->data, 0, TXD_DESC_SIZE); + rt2x00lib_write_tx_desc(rt2x00dev, (struct data_desc *)skb->data, (struct ieee80211_hdr *)(skb->data + TXD_DESC_SIZE),