From: Jesper Juhl Date: Thu, 3 May 2012 07:25:51 +0000 (+0300) Subject: wlcore: fix size of two memset's in wl1271_cmd_build_arp_rsp() X-Git-Tag: v3.5-rc1~35^2~3^2~18^2~86 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=161f17b5307ecf56484c1d0e0ae433506394651c;p=profile%2Fivi%2Fkernel-x86-ivi.git wlcore: fix size of two memset's in wl1271_cmd_build_arp_rsp() We currently do this: int wl1271_cmd_build_arp_rsp(struct wl1271 *wl, struct wl12xx_vif *wlvif) ... struct wl12xx_arp_rsp_template *tmpl; struct ieee80211_hdr_3addr *hdr; ... tmpl = (struct wl12xx_arp_rsp_template *)skb_put(skb, sizeof(*tmpl)); memset(tmpl, 0, sizeof(tmpl)); ... hdr = (struct ieee80211_hdr_3addr *)skb_push(skb, sizeof(*hdr)); memset(hdr, 0, sizeof(hdr)); ... I believe we want to set the entire structures to 0 with those memset() calls, not just zero the initial part of them (size of the pointer bytes). Signed-off-by: Jesper Juhl Signed-off-by: Luciano Coelho --- diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c index 7ea10e1..5b128a9 100644 --- a/drivers/net/wireless/ti/wlcore/cmd.c +++ b/drivers/net/wireless/ti/wlcore/cmd.c @@ -1036,7 +1036,7 @@ int wl1271_cmd_build_arp_rsp(struct wl1271 *wl, struct wl12xx_vif *wlvif) skb_reserve(skb, sizeof(*hdr) + WL1271_EXTRA_SPACE_MAX); tmpl = (struct wl12xx_arp_rsp_template *)skb_put(skb, sizeof(*tmpl)); - memset(tmpl, 0, sizeof(tmpl)); + memset(tmpl, 0, sizeof(*tmpl)); /* llc layer */ memcpy(tmpl->llc_hdr, rfc1042_header, sizeof(rfc1042_header)); @@ -1085,7 +1085,7 @@ int wl1271_cmd_build_arp_rsp(struct wl1271 *wl, struct wl12xx_vif *wlvif) /* mac80211 header */ hdr = (struct ieee80211_hdr_3addr *)skb_push(skb, sizeof(*hdr)); - memset(hdr, 0, sizeof(hdr)); + memset(hdr, 0, sizeof(*hdr)); fc = IEEE80211_FTYPE_DATA | IEEE80211_FCTL_TODS; if (wlvif->sta.qos) fc |= IEEE80211_STYPE_QOS_DATA;