[PATCH 1/3] wifi: mt76: mt7925: zero the whole testmode command buffer

From: Tony-TC Lee <[email protected]>

pcmd is declared char *, so sizeof(*pcmd) is 1 and the memset clears a
single byte rather than struct mt7925_rftest_cmd. Everything the memcpy
that follows does not overwrite - padding[1..3] - reaches the firmware
as uninitialised stack content.

Use a correctly typed pointer, as mt7925_tm_set() already does, so
sizeof(*pcmd) covers the whole command. Addressing ctrl by name rather
than by a hand-computed +4 offset comes with it and is not optional:
pcmd + 4 on a struct pointer would advance by four whole structures.

Fixes: 0a41b6751e4f ("wifi: mt76: mt7925: add test mode support")
Signed-off-by: Tony-TC Lee <[email protected]>
---
 drivers/net/wireless/mediatek/mt76/mt7925/testmode.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/testmode.c b/drivers/net/wireless/mediatek/mt76/mt7925/testmode.c
index 22a8f1ddc321..6ff261dfeedd 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/testmode.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/testmode.c
@@ -88,12 +88,12 @@ mt7925_tm_query(struct mt792x_dev *dev, struct mt7925_tm_cmd *req,
 		char *evt_resp)
 {
 	struct mt7925_rftest_cmd cmd;
-	char *pcmd = (char *)&cmd;
+	struct mt7925_rftest_cmd *pcmd = &cmd;
 	struct sk_buff *skb = NULL;
 	int ret = 1;
 
 	memset(pcmd, 0, sizeof(*pcmd));
-	memcpy(pcmd + 4, (char *)&req->c, sizeof(struct uni_cmd_testmode_ctrl));
+	memcpy(&pcmd->ctrl, &req->c, sizeof(struct uni_cmd_testmode_ctrl));
 
 	if (*((uint16_t *)req->padding) == MCU_UNI_CMD_TESTMODE_CTRL)
 		ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_UNI_QUERY(TESTMODE_CTRL),
-- 
2.45.2