bcmgenet_add_tsb() pushes 64 bytes of headroom onto the skb to form the Transmit Status Block (TSB) but only assigns status->tx_csum_info when skb->ip_summed == CHECKSUM_PARTIAL. For packets without checksum offload, or for other fields within struct status_64, the status block contains uninitialized stack/heap memory from previous skb operations. Zero-initialize the status block with memset() after pushing headroom. Fixes: 9a9ba2a4aaaa ("net: bcmgenet: always enable status blocks") Assisted-by: LLM Co-authored-by: Cursor Change-Id: I6935e24408ea10f68eb61dce4cced9b0ead5c005 --- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c index 90ca4f220cc7..3a6a2f075959 100644 --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c @@ -2084,6 +2084,7 @@ static struct sk_buff *bcmgenet_add_tsb(struct net_device *dev, skb_push(skb, sizeof(*status)); status = (struct status_64 *)skb->data; + memset(status, 0, sizeof(*status)); if (skb->ip_summed == CHECKSUM_PARTIAL) { ip_ver = skb->protocol; -- 2.34.1