bcmgenet_add_tsb() pushes 64 bytes of headroom onto the skb to form the
Transmit Status Block (TSB) but only assigns status->tx_csum_info when
skb->ip_summed == CHECKSUM_PARTIAL. For packets without checksum offload,
or for other fields within struct status_64, the status block contains
uninitialized stack/heap memory from previous skb operations.
Zero-initialize the status block with memset() after pushing headroom.
Fixes: 9a9ba2a4aaaa ("net: bcmgenet: always enable status blocks")
Assisted-by: LLM
Co-authored-by: Cursor [off-list ref]
Change-Id: I6935e24408ea10f68eb61dce4cced9b0ead5c005
---
drivers/net/ethernet/broadcom/genet/bcmgenet.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index 90ca4f220cc7..3a6a2f075959 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -2084,6 +2084,7 @@ static struct sk_buff *bcmgenet_add_tsb(struct net_device *dev,
skb_push(skb, sizeof(*status));
status = (struct status_64 *)skb->data;
+ memset(status, 0, sizeof(*status));
if (skb->ip_summed == CHECKSUM_PARTIAL) {
ip_ver = skb->protocol;--
2.34.1