wifi: mt76: replace skb_put with skb_put_zero

Avoid potentially reusing uninitialized data

Signed-off-by: Felix Fietkau <nbd@nbd.name>

diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
index af0c2b2aacb00ceb72680a8a03ae27d6cbd252b5..b8927714d7e0ed017ad7463d06c764556d280824 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
@@ -257,7 +257,7 @@ mt76_connac_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len,
        };
        u16 ntlv;
 
-       ptlv = skb_put(skb, len);
+       ptlv = skb_put_zero(skb, len);
        memcpy(ptlv, &tlv, sizeof(tlv));
 
        ntlv = le16_to_cpu(ntlv_hdr->tlv_num);
@@ -1670,7 +1670,7 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
        set_bit(MT76_HW_SCANNING, &phy->state);
        mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
 
-       req = (struct mt76_connac_hw_scan_req *)skb_put(skb, sizeof(*req));
+       req = (struct mt76_connac_hw_scan_req *)skb_put_zero(skb, sizeof(*req));
 
        req->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
        req->bss_idx = mvif->idx;
@@ -1798,7 +1798,7 @@ int mt76_connac_mcu_sched_scan_req(struct mt76_phy *phy,
 
        mvif->scan_seq_num = (mvif->scan_seq_num + 1) & 0x7f;
 
-       req = (struct mt76_connac_sched_scan_req *)skb_put(skb, sizeof(*req));
+       req = (struct mt76_connac_sched_scan_req *)skb_put_zero(skb, sizeof(*req));
        req->version = 1;
        req->seq_num = mvif->scan_seq_num | mvif->band_idx << 7;
 
@@ -2321,7 +2321,7 @@ int mt76_connac_mcu_update_gtk_rekey(struct ieee80211_hw *hw,
                return -ENOMEM;
 
        skb_put_data(skb, &hdr, sizeof(hdr));
-       gtk_tlv = (struct mt76_connac_gtk_rekey_tlv *)skb_put(skb,
+       gtk_tlv = (struct mt76_connac_gtk_rekey_tlv *)skb_put_zero(skb,
                                                         sizeof(*gtk_tlv));
        gtk_tlv->tag = cpu_to_le16(UNI_OFFLOAD_OFFLOAD_GTK_REKEY);
        gtk_tlv->len = cpu_to_le16(sizeof(*gtk_tlv));
@@ -2446,7 +2446,7 @@ mt76_connac_mcu_set_wow_pattern(struct mt76_dev *dev,
                return -ENOMEM;
 
        skb_put_data(skb, &hdr, sizeof(hdr));
-       ptlv = (struct mt76_connac_wow_pattern_tlv *)skb_put(skb, sizeof(*ptlv));
+       ptlv = (struct mt76_connac_wow_pattern_tlv *)skb_put_zero(skb, sizeof(*ptlv));
        ptlv->tag = cpu_to_le16(UNI_SUSPEND_WOW_PATTERN);
        ptlv->len = cpu_to_le16(sizeof(*ptlv));
        ptlv->data_len = pattern->pattern_len;

diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
index d90f98c5003994735d2dcb201acbde9bb4bd6a95..b7157bdb3103f30b78b042324ea95c969d248e36 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
@@ -424,7 +424,7 @@ mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len,
                .len = cpu_to_le16(sub_len),
        };
 
-       ptlv = skb_put(skb, sub_len);
+       ptlv = skb_put_zero(skb, sub_len);
        memcpy(ptlv, &tlv, sizeof(tlv));
 
        le16_add_cpu(sub_ntlv, 1);