qcacmn: Fix field-spanning kernel warning during driver load

Currently, driver passes void pointer to wmsg as source buffer
in memcpy API to copy the local log_msg to nlmsg data buffer
in ptt_sock_send_msg_to_app(). This leads to kernel warn as
kernel is unable to calculate the size of variable length source
buffer.

To fix this issue, pass the data buffer of nlmsg in memcpy API
so that kernel is able to calculate the size of source buffer
and verify for buffer overflow before copy.

Change-Id: I91e2e1b0b8e58428ed5ba20c7caf4ec3b45a6428
CRs-Fixed: 3749523

utils/ptt/src/wlan_ptt_sock_svc.c

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -126,7 +126,6 @@ int ptt_sock_send_msg_to_app(tAniHdr *wmsg, int radio, int src_mod, int pid)
 	struct nlmsghdr *nlh;
 	int wmsg_length = be16_to_cpu(wmsg->length);
 	static int nlmsg_seq;
-	void *out;
 
 	if (radio < 0 || radio > ANI_MAX_RADIOS) {
 		PTT_TRACE(QDF_TRACE_LEVEL_ERROR, "%s: invalid radio id [%d]\n",
@@ -154,12 +153,9 @@ int ptt_sock_send_msg_to_app(tAniHdr *wmsg, int radio, int src_mod, int pid)
 	}
 	wnl = (tAniNlHdr *) nlh;
 	wnl->radio = radio;
-	/* kernel FORTIFY_SOURCE may warn when multiple struct are copied
-	 * using memcpy. So, to avoid, assign a void pointer to the struct
-	 * and copy using memcpy
-	 */
-	out = &wnl->wmsg;
-	memcpy(out, wmsg, wmsg_length);
+
+	/* Offset of data buffer from nlmsg_hdr + sizeof(int) radio */
+	memcpy(nlmsg_data(nlh) + sizeof(wnl->radio), wmsg, wmsg_length);
 #ifdef PTT_SOCK_DEBUG_VERBOSE
 	ptt_sock_dump_buf((const unsigned char *)skb->data, skb->len);
 #endif