3 files changed, 12 insertions, 3 deletions

diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 2aa8a1aa1184..8a61dbd320e6 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -1347,9 +1347,14 @@ static void hw_scan_work(struct work_struct *work)
                                                        hwsim->hw_scan_vif,
                                                        req->ssids[i].ssid,
                                                        req->ssids[i].ssid_len,
-                                                       req->ie, req->ie_len);
+                                                       req->ie_len);
                         if (!probe)
                                 continue;
+
+                        if (req->ie_len)
+                                memcpy(skb_put(probe, req->ie_len), req->ie,
+                                       req->ie_len);
+
                         local_bh_disable();
                         mac80211_hwsim_tx_frame(hwsim->hw, probe,
                                                 hwsim->tmp_chan);
diff --git a/drivers/net/wireless/ti/wl1251/main.c b/drivers/net/wireless/ti/wl1251/main.c
index 441cbccbd381..f47e8b0482ad 100644
--- a/drivers/net/wireless/ti/wl1251/main.c
+++ b/drivers/net/wireless/ti/wl1251/main.c
@@ -896,11 +896,13 @@ static int wl1251_op_hw_scan(struct ieee80211_hw *hw,
                 goto out;
 
         skb = ieee80211_probereq_get(wl->hw, wl->vif, ssid, ssid_len,
-                                     req->ie, req->ie_len);
+                                     req->ie_len);
         if (!skb) {
                 ret = -ENOMEM;
                 goto out;
         }
+        if (req->ie_len)
+                memcpy(skb_put(skb, req->ie_len), req->ie, req->ie_len);
 
         ret = wl1251_cmd_template_set(wl, CMD_PROBE_REQ, skb->data,
                                       skb->len);
diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c
index eaef3f41b252..27f83f72a93b 100644
--- a/drivers/net/wireless/ti/wlcore/cmd.c
+++ b/drivers/net/wireless/ti/wlcore/cmd.c
@@ -1038,11 +1038,13 @@ int wl12xx_cmd_build_probe_req(struct wl1271 *wl, struct wl12xx_vif *wlvif,
         u16 template_id_5 = CMD_TEMPL_CFG_PROBE_REQ_5;
 
         skb = ieee80211_probereq_get(wl->hw, vif, ssid, ssid_len,
-                                     ie, ie_len);
+                                     ie_len);
         if (!skb) {
                 ret = -ENOMEM;
                 goto out;
         }
+        if (ie_len)
+                memcpy(skb_put(skb, ie_len), ie, ie_len);
 
         wl1271_dump(DEBUG_SCAN, "PROBE REQ: ", skb->data, skb->len);