Date:   Fri, 7 Jan 2022 10:36:09 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Felix Fietkau <nbd@nbd.name>
Cc:     Lorenzo Bianconi <lorenzo.bianconi83@gmail.com>,
        Ryder Lee <ryder.lee@mediatek.com>,
        Shayne Chen <shayne.chen@mediatek.com>,
        Sean Wang <sean.wang@mediatek.com>,
        Kalle Valo <kvalo@kernel.org>,
        Matthias Brugger <matthias.bgg@gmail.com>,
        MeiChia Chiu <meichia.chiu@mediatek.com>,
        Money Wang <Money.Wang@mediatek.com>,
        linux-wireless@vger.kernel.org, linux-mediatek@lists.infradead.org,
        kernel-janitors@vger.kernel.org
Subject: [PATCH] mt76: mt7915: fix a couple information leaks
Message-ID: <20220107073609.GH22086@kili>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.10.1 (2018-07-13)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?1irlz6rk/FxvDwkSmayBtGuRBHCGNPZsjRu2hXXqCVVTH97+psEeHiXEc/cx?=
 =?us-ascii?Q?7z/wlx2c8YkEPS30BmPpQf34lNE4vFovs6vjs00kRePGQKtmj9EA0YRaMyjT?=
 =?us-ascii?Q?B34J2gvF9CMVmwhb8WIyFKDpfW31mJ0YN6aDUT/V60SiUEv0jESTz6gRXdkF?=
 =?us-ascii?Q?byHlgGca25lWMbVY9yEYl1K0PHE4NZ/l1Yu8OWu8huA9a6yfzBZ6hrh40iPy?=
 =?us-ascii?Q?SWJrp421OhoxK4P6ZtjcnJFfss05MpEA8QnrRvWY4OocWnn1ElmVOGUz9KjJ?=
 =?us-ascii?Q?IslMSwE3IK+lNNrd14+W7Uue839tTpf2QyTn5QAAOL1KCr5LtcFV6XXKxhSy?=
 =?us-ascii?Q?d2fzDH1h13N860nf1zIEjTiNBlTvwjfVcQBm1AEgziwcnJBGk1chZomyO5Qt?=
 =?us-ascii?Q?rsq8d41r7up4MW+bwVQVA3QFaXYZ0NGd4UXIaRnzpaTH8NF7K4L6Pm1PU5zm?=
 =?us-ascii?Q?T16r1J8clTTWVBgDbds9IRtJSsCIGK3G6tPGHhkjLycQD54oYEutVHEtXB4z?=
 =?us-ascii?Q?8EH2ePcY5eqJT3ITsjrJtBdRzHU9n7pcgaxrCgKvHYr7pncAW5eRvgYqKCno?=
 =?us-ascii?Q?Nhhy1VCTwGd0uXi/KGIK5SwYdbXekJCffvffzMkx+Gt6d4ELTcthEfQnU8SW?=
 =?us-ascii?Q?Db91p+4eSeu5kvROsDcuuBR0OfyXdl8bfkEhmW8XOpqJbzcluxDTsv1fQlGI?=
 =?us-ascii?Q?fJZs8OU7iWF4LXQWnIGpSKPxDxZgJ38o/KE650Gg1J4f5dgiyezYSpwo4nCf?=
 =?us-ascii?Q?dR8G1xR56pRkxu96H7shtmUNYMFthW+jXwfUhl65g27xFtevbfYKtbSojzaq?=
 =?us-ascii?Q?zrFN2nFX/kPbZfxOg6FDML4pMewJy05kVHpIvUVnKEsjjgyVxML7vmubFC8s?=
 =?us-ascii?Q?MaNi3LGuTkseMZf5NYnS0sFXYQWoQl+tE92UM5IDPM16y9FAw5gZ8Sxc1Zg2?=
 =?us-ascii?Q?sQBl5Ir8+eUj0Ogx40HyAQRjiheeoiSZxSLPqHYsgFqDk39mt4Injj4ln3k0?=
 =?us-ascii?Q?CgcxfnHErcxDrKXT9ISATw63utxdQ9YSyPZLdekdLBFK96FfFzZD20vrNT/c?=
 =?us-ascii?Q?8kFwPmWEvrxnXCcUUvgkAr1NYEuRE0HmMjqWu5MHD/Kz13V4PV3RN/QnTeen?=
 =?us-ascii?Q?7PDW17qbx/8NYrIv0QJxffnXo/e8RdfWF8ocH/JyYuz2vE1tYawL3QAr1w0O?=
 =?us-ascii?Q?VHkHk/iDR5PxfXRGVZFrCV0tQwBUBLFkZN8x3FVz0zO8WcGBmwyjkxPip10x?=
 =?us-ascii?Q?k/htRetqi4ESQ0ZybWS6+9praeiCGTvLrH/WTDXGer93HC7cVl5P9jyfCw7g?=
 =?us-ascii?Q?1DhbTrDJbiCIloaK2XGxbS/ogAlxFLn7W2nPXOnUffsy5yQGEyCuGIPxdo3+?=
 =?us-ascii?Q?3rGvQKOt7Irr5GIX5d3+Autg9S7x5GRA2BnkTio7Qc9EyFB4SNmNOY41hauz?=
 =?us-ascii?Q?Wmzbs258jexKkMdTng/tXFK6gjo0pbGVGqZuL9nK2NSPvjJY5e4Vz58XiK4d?=
 =?us-ascii?Q?McxbWR12LvZtrqwhGbI7KzDX+olLtxpklCDjPB5qEbSvH4ZMkUy+/MSoF8e8?=
 =?us-ascii?Q?IO2AmjiTALEuAuxAnGh1TUJLK7LayVJXMd3Xsg7SlGII4VbKj9/rRPs1bLVw?=
 =?us-ascii?Q?fa1Xb4JrBjBdkDjUOKvbd7DN7csscsAzknicjn2Wwg4g1t1rMOUpJ2rI8kyQ?=
 =?us-ascii?Q?CetWPZm1eQT1YicQ1I+LbDW7AhM=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 7d416287-513b-434c-2c16-08d9d1b06704
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Jan 2022 07:36:22.5067
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: jhcMVHb9w60nTv/fP3vM3qKavqBW1/HRS7X04akIZ83kiJPPkHKhBdzbkKJIA9G7Mvq78sZVJktdNTp7Ata++/yeC1TC978N6D76R4T1SUs=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR10MB5752
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10219 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0
 mlxlogscore=999 adultscore=0 phishscore=0 mlxscore=0 spamscore=0
 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2110150000 definitions=main-2201070053
X-Proofpoint-ORIG-GUID: xce09MwIYd2QMjqQ1wlrdNxo9H4WtWZC
X-Proofpoint-GUID: xce09MwIYd2QMjqQ1wlrdNxo9H4WtWZC
Precedence: bulk
List-ID: <linux-wireless.vger.kernel.org>
X-Mailing-List: linux-wireless@vger.kernel.org

Unfortunately this code has stumbled into some deep C standards
nonsense.  These two structs have a 3 byte struct hole at the end.  If
you partially initialize a struct then the C standard specifies that
all the struct holes are zeroed out.  But when you initialize all the
members of the struct, as this code does, then struct holes may be left
with uninitialized stack data.  This is from C11 section 6.7.9 and how
it is implemented in GCC.

Anyway, add some memsets to prevent exposing uninitialized stack data
with the user.  Debugfs is root only so the real life impact of these
leaks is very small.

Fixes: 1966a5078f2d ("mt76: mt7915: add mu-mimo and ofdma debugfs knobs")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 .../net/wireless/mediatek/mt76/mt7915/mcu.c   | 21 ++++++++++---------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
index 0911b6f973b5..19c340c65465 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
@@ -2999,10 +2999,11 @@ int mt7915_mcu_muru_debug_set(struct mt7915_dev *dev, bool enabled)
 	struct {
 		__le32 cmd;
 		u8 enable;
-	} data = {
-		.cmd = cpu_to_le32(MURU_SET_TXC_TX_STATS_EN),
-		.enable = enabled,
-	};
+	} data;
+
+	memset(&data, 0, sizeof(data));
+	data.cmd = cpu_to_le32(MURU_SET_TXC_TX_STATS_EN);
+	data.enable = enabled;
 
 	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL), &data,
 				sizeof(data), false);
@@ -3014,15 +3015,15 @@ int mt7915_mcu_muru_debug_get(struct mt7915_phy *phy, void *ms)
 	struct sk_buff *skb;
 	struct mt7915_mcu_muru_stats *mu_stats =
 				(struct mt7915_mcu_muru_stats *)ms;
-	int ret;
-
 	struct {
 		__le32 cmd;
 		u8 band_idx;
-	} req = {
-		.cmd = cpu_to_le32(MURU_GET_TXC_TX_STATS),
-		.band_idx = phy != &dev->phy,
-	};
+	} req;
+	int ret;
+
+	memset(&req, 0, sizeof(req));
+	req.cmd = cpu_to_le32(MURU_GET_TXC_TX_STATS);
+	req.band_idx = phy != &dev->phy;
 
 	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(MURU_CTRL),
 					&req, sizeof(req), true, &skb);
-- 
2.20.1