From a542f25e770e7fb4ccdea62936c5939056213d09 Mon Sep 17 00:00:00 2001 From: Gleb Mazovetskiy Date: Mon, 25 Jan 2021 04:54:05 +0000 Subject: [PATCH] odroidgoa kernel gcc-10 patches Also sent upstream https://github.com/hardkernel/linux/pull/410 The kernel builds with these patches and aarch64 linux-tools perf also builds Signed-off-by: Gleb Mazovetskiy --- ...on-t-zero-in-__copy_from_user-_inato.patch | 55 + ...tm-fix-duplicate-def-of-traceid_list.patch | 44 + ...-some-global-variables-to-fix-build-.patch | 134 + ...erf-able-to-build-with-latest-libbfd.patch | 51 + ...-Fix-gcc9-stringop-truncation-compil.patch | 63 + ...w-GCC-9-Wmissing-attributes-warnings.patch | 57 + ...onntrack_core-Fix-gcc-10-compilation.patch | 49 + ...e-debugfs-Remove-unused-variable-res.patch | 44 + ...id-gcc-10-zero-length-bounds-warning.patch | 55 + ...cc-10-warnings-fix-low-hanging-fruit.patch | 56 + ...ck-analog.c-GCC-10-Wrestrict-warning.patch | 40 + ...et-phy-mdio_bus-Fix-gcc-10-Wrestrict.patch | 45 + ...rs-net-wireless-Fix-gcc-10-Wrestrict.patch | 5406 +++++++++++++++++ 13 files changed, 6099 insertions(+) create mode 100644 board/batocera/rockchip/odroidgoa/linux_patches/0001-BACKPORT-arm64-don-t-zero-in-__copy_from_user-_inato.patch create mode 100644 board/batocera/rockchip/odroidgoa/linux_patches/0001-perf-cs-etm-fix-duplicate-def-of-traceid_list.patch create mode 100644 board/batocera/rockchip/odroidgoa/linux_patches/0002-perf-bench-Share-some-global-variables-to-fix-build-.patch create mode 100644 board/batocera/rockchip/odroidgoa/linux_patches/0003-perf-Make-perf-able-to-build-with-latest-libbfd.patch create mode 100644 board/batocera/rockchip/odroidgoa/linux_patches/0004-tools-lib-api-fs-Fix-gcc9-stringop-truncation-compil.patch create mode 100644 board/batocera/rockchip/odroidgoa/linux_patches/0005-Clean-the-new-GCC-9-Wmissing-attributes-warnings.patch create mode 100644 board/batocera/rockchip/odroidgoa/linux_patches/0006-nf_conntrack_core-Fix-gcc-10-compilation.patch create mode 100644 board/batocera/rockchip/odroidgoa/linux_patches/0007-wlcore-debugfs-Remove-unused-variable-res.patch create mode 100644 board/batocera/rockchip/odroidgoa/linux_patches/0008-usb-ehci-avoid-gcc-10-zero-length-bounds-warning.patch create mode 100644 board/batocera/rockchip/odroidgoa/linux_patches/0009-gcc-10-warnings-fix-low-hanging-fruit.patch create mode 100644 board/batocera/rockchip/odroidgoa/linux_patches/0010-Fix-joystick-analog.c-GCC-10-Wrestrict-warning.patch create mode 100644 board/batocera/rockchip/odroidgoa/linux_patches/0011-drivers-net-phy-mdio_bus-Fix-gcc-10-Wrestrict.patch create mode 100644 board/batocera/rockchip/odroidgoa/linux_patches/0012-drivers-net-wireless-Fix-gcc-10-Wrestrict.patch diff --git a/board/batocera/rockchip/odroidgoa/linux_patches/0001-BACKPORT-arm64-don-t-zero-in-__copy_from_user-_inato.patch b/board/batocera/rockchip/odroidgoa/linux_patches/0001-BACKPORT-arm64-don-t-zero-in-__copy_from_user-_inato.patch new file mode 100644 index 00000000000..b1c795de4ad --- /dev/null +++ b/board/batocera/rockchip/odroidgoa/linux_patches/0001-BACKPORT-arm64-don-t-zero-in-__copy_from_user-_inato.patch @@ -0,0 +1,55 @@ +From 02bcb5a7a3dc63346c14fc7aaae3102db548542d Mon Sep 17 00:00:00 2001 +From: Al Viro +Date: Sat, 10 Sep 2016 16:50:00 -0400 +Subject: [PATCH] BACKPORT: arm64: don't zero in __copy_from_user{,_inatomic} + +Signed-off-by: Al Viro +--- + arch/arm64/include/asm/uaccess.h | 11 +++++++---- + arch/arm64/lib/copy_from_user.S | 7 +------ + 2 files changed, 8 insertions(+), 10 deletions(-) + +diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h +index d0919bcb1953..b26ad8507e93 100644 +--- a/arch/arm64/include/asm/uaccess.h ++++ b/arch/arm64/include/asm/uaccess.h +@@ -410,12 +410,15 @@ static inline unsigned long __must_check __copy_to_user(void __user *to, const v + + static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n) + { ++ unsigned long res = n; ++ + if (access_ok(VERIFY_READ, from, n)) { + check_object_size(to, n, false); +- n = __arch_copy_from_user(to, from, n); +- } else /* security hole - plug it */ +- memset(to, 0, n); +- return n; ++ res = __arch_copy_from_user(to, from, n); ++ } ++ if (unlikely(res)) ++ memset(to + (n - res), 0, res); ++ return res; + } + + static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n) +diff --git a/arch/arm64/lib/copy_from_user.S b/arch/arm64/lib/copy_from_user.S +index 683adc358be7..c7a7d9689e8f 100644 +--- a/arch/arm64/lib/copy_from_user.S ++++ b/arch/arm64/lib/copy_from_user.S +@@ -74,11 +74,6 @@ ENDPROC(__arch_copy_from_user) + + .section .fixup,"ax" + .align 2 +-9998: +- sub x0, end, dst +-9999: +- strb wzr, [dst], #1 // zero remaining buffer space +- cmp dst, end +- b.lo 9999b ++9998: sub x0, end, dst // bytes not copied + ret + .previous +-- +2.27.0 + diff --git a/board/batocera/rockchip/odroidgoa/linux_patches/0001-perf-cs-etm-fix-duplicate-def-of-traceid_list.patch b/board/batocera/rockchip/odroidgoa/linux_patches/0001-perf-cs-etm-fix-duplicate-def-of-traceid_list.patch new file mode 100644 index 00000000000..2ac63996eac --- /dev/null +++ b/board/batocera/rockchip/odroidgoa/linux_patches/0001-perf-cs-etm-fix-duplicate-def-of-traceid_list.patch @@ -0,0 +1,44 @@ +From 7cdd201761fea40d7467b97fb9f2e2bcd5ec63c4 Mon Sep 17 00:00:00 2001 +From: Gleb Mazovetskiy +Date: Mon, 25 Jan 2021 00:41:55 +0000 +Subject: [PATCH 01/12] perf: cs-etm: fix duplicate def of traceid_list + +Backport of 168200b6d6ea0cb5765943ec5da5b8149701f36a upstream + +Signed-off-by: Gleb Mazovetskiy +--- + tools/perf/util/cs-etm.c | 3 +++ + tools/perf/util/cs-etm.h | 3 --- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c +index ca93257a6cb7..ee23fd37f241 100644 +--- a/tools/perf/util/cs-etm.c ++++ b/tools/perf/util/cs-etm.c +@@ -91,6 +91,9 @@ struct cs_etm_queue { + bool kernel_mapped; + }; + ++/* RB tree for quick conversion between traceID and metadata pointers */ ++static struct intlist *traceid_list; ++ + static int cs_etm__get_trace(struct cs_etm_buffer *buff, struct cs_etm_queue *etmq); + static int cs_etm__update_queues(struct cs_etm_auxtrace *); + static int cs_etm__process_queues(struct cs_etm_auxtrace *, u64); +diff --git a/tools/perf/util/cs-etm.h b/tools/perf/util/cs-etm.h +index ec6ff78f1905..1f785a92fb20 100644 +--- a/tools/perf/util/cs-etm.h ++++ b/tools/perf/util/cs-etm.h +@@ -65,9 +65,6 @@ enum { + CS_ETMV4_PRIV_MAX, + }; + +-/* RB tree for quick conversion between traceID and CPUs */ +-struct intlist *traceid_list; +- + #define KiB(x) ((x) * 1024) + #define MiB(x) ((x) * 1024 * 1024) + +-- +2.27.0 + diff --git a/board/batocera/rockchip/odroidgoa/linux_patches/0002-perf-bench-Share-some-global-variables-to-fix-build-.patch b/board/batocera/rockchip/odroidgoa/linux_patches/0002-perf-bench-Share-some-global-variables-to-fix-build-.patch new file mode 100644 index 00000000000..57c98cdf0f9 --- /dev/null +++ b/board/batocera/rockchip/odroidgoa/linux_patches/0002-perf-bench-Share-some-global-variables-to-fix-build-.patch @@ -0,0 +1,134 @@ +From 62b75df5f013d9f7b5b47ff5369dd4b3143ab965 Mon Sep 17 00:00:00 2001 +From: Gleb Mazovetskiy +Date: Mon, 25 Jan 2021 00:52:10 +0000 +Subject: [PATCH 02/12] perf bench: Share some global variables to fix build + with gcc 10 + +Based on https://git.yoctoproject.org/cgit/cgit.cgi/meta-arm/tree/meta-arm-bsp/recipes-kernel/linux/linux-yocto-5.3/0003-perf-bench-Share-some-global-variables-to-fix-build-.patch + +Signed-off-by: Gleb Mazovetskiy +--- + tools/perf/bench/bench.h | 4 ++++ + tools/perf/bench/futex-hash.c | 12 ++++++------ + tools/perf/bench/futex-lock-pi.c | 11 +++++------ + 3 files changed, 15 insertions(+), 12 deletions(-) + +diff --git a/tools/perf/bench/bench.h b/tools/perf/bench/bench.h +index a50df86f2b9b..e758896f4995 100644 +--- a/tools/perf/bench/bench.h ++++ b/tools/perf/bench/bench.h +@@ -1,6 +1,10 @@ + #ifndef BENCH_H + #define BENCH_H + ++#include ++ ++extern struct timeval bench__start, bench__end, bench__runtime; ++ + /* + * The madvise transparent hugepage constants were added in glibc + * 2.13. For compatibility with older versions of glibc, define these +diff --git a/tools/perf/bench/futex-hash.c b/tools/perf/bench/futex-hash.c +index fc9bebd2cca0..80313b40d324 100644 +--- a/tools/perf/bench/futex-hash.c ++++ b/tools/perf/bench/futex-hash.c +@@ -28,7 +28,7 @@ static unsigned int nfutexes = 1024; + static bool fshared = false, done = false, silent = false; + static int futex_flag = 0; + +-struct timeval start, end, runtime; ++struct timeval bench__start, bench__end, bench__runtime; + static pthread_mutex_t thread_lock; + static unsigned int threads_starting; + static struct stats throughput_stats; +@@ -92,8 +92,8 @@ static void toggle_done(int sig __maybe_unused, + { + /* inform all threads that we're done for the day */ + done = true; +- gettimeofday(&end, NULL); +- timersub(&end, &start, &runtime); ++ gettimeofday(&bench__end, NULL); ++ timersub(&bench__end, &bench__start, &bench__runtime); + } + + static void print_summary(void) +@@ -103,7 +103,7 @@ static void print_summary(void) + + printf("%sAveraged %ld operations/sec (+- %.2f%%), total secs = %d\n", + !silent ? "\n" : "", avg, rel_stddev_stats(stddev, avg), +- (int) runtime.tv_sec); ++ (int) bench__runtime.tv_sec); + } + + int bench_futex_hash(int argc, const char **argv, +@@ -148,7 +148,7 @@ int bench_futex_hash(int argc, const char **argv, + + threads_starting = nthreads; + pthread_attr_init(&thread_attr); +- gettimeofday(&start, NULL); ++ gettimeofday(&bench__start, NULL); + for (i = 0; i < nthreads; i++) { + worker[i].tid = i; + worker[i].futex = calloc(nfutexes, sizeof(*worker[i].futex)); +@@ -191,7 +191,7 @@ int bench_futex_hash(int argc, const char **argv, + pthread_mutex_destroy(&thread_lock); + + for (i = 0; i < nthreads; i++) { +- unsigned long t = worker[i].ops/runtime.tv_sec; ++ unsigned long t = worker[i].ops/bench__runtime.tv_sec; + update_stats(&throughput_stats, t); + if (!silent) { + if (nfutexes == 1) +diff --git a/tools/perf/bench/futex-lock-pi.c b/tools/perf/bench/futex-lock-pi.c +index bc6a16adbca8..8d0f60456a95 100644 +--- a/tools/perf/bench/futex-lock-pi.c ++++ b/tools/perf/bench/futex-lock-pi.c +@@ -29,7 +29,6 @@ static bool silent = false, multi = false; + static bool done = false, fshared = false; + static unsigned int ncpus, nthreads = 0; + static int futex_flag = 0; +-struct timeval start, end, runtime; + static pthread_mutex_t thread_lock; + static unsigned int threads_starting; + static struct stats throughput_stats; +@@ -56,7 +55,7 @@ static void print_summary(void) + + printf("%sAveraged %ld operations/sec (+- %.2f%%), total secs = %d\n", + !silent ? "\n" : "", avg, rel_stddev_stats(stddev, avg), +- (int) runtime.tv_sec); ++ (int) bench__runtime.tv_sec); + } + + static void toggle_done(int sig __maybe_unused, +@@ -65,8 +64,8 @@ static void toggle_done(int sig __maybe_unused, + { + /* inform all threads that we're done for the day */ + done = true; +- gettimeofday(&end, NULL); +- timersub(&end, &start, &runtime); ++ gettimeofday(&bench__end, NULL); ++ timersub(&bench__end, &bench__start, &bench__runtime); + } + + static void *workerfn(void *arg) +@@ -172,7 +171,7 @@ int bench_futex_lock_pi(int argc, const char **argv, + + threads_starting = nthreads; + pthread_attr_init(&thread_attr); +- gettimeofday(&start, NULL); ++ gettimeofday(&bench__start, NULL); + + create_threads(worker, thread_attr); + pthread_attr_destroy(&thread_attr); +@@ -198,7 +197,7 @@ int bench_futex_lock_pi(int argc, const char **argv, + pthread_mutex_destroy(&thread_lock); + + for (i = 0; i < nthreads; i++) { +- unsigned long t = worker[i].ops/runtime.tv_sec; ++ unsigned long t = worker[i].ops/bench__runtime.tv_sec; + + update_stats(&throughput_stats, t); + if (!silent) +-- +2.27.0 + diff --git a/board/batocera/rockchip/odroidgoa/linux_patches/0003-perf-Make-perf-able-to-build-with-latest-libbfd.patch b/board/batocera/rockchip/odroidgoa/linux_patches/0003-perf-Make-perf-able-to-build-with-latest-libbfd.patch new file mode 100644 index 00000000000..8503f452ce8 --- /dev/null +++ b/board/batocera/rockchip/odroidgoa/linux_patches/0003-perf-Make-perf-able-to-build-with-latest-libbfd.patch @@ -0,0 +1,51 @@ +From 89b28cc5ae940970fa4530722c1419dd728a6e15 Mon Sep 17 00:00:00 2001 +From: Gleb Mazovetskiy +Date: Mon, 25 Jan 2021 00:57:06 +0000 +Subject: [PATCH 03/12] perf: Make perf able to build with latest libbfd + +Based on http://lore.kernel.org/lkml/20200128152938.31413-1-changbin.du@gmail.com + +Signed-off-by: Gleb Mazovetskiy +--- + tools/perf/util/srcline.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/srcline.c b/tools/perf/util/srcline.c +index b4db3f48e3b0..2853d4728ab9 100644 +--- a/tools/perf/util/srcline.c ++++ b/tools/perf/util/srcline.c +@@ -86,16 +86,30 @@ static void find_address_in_section(bfd *abfd, asection *section, void *data) + bfd_vma pc, vma; + bfd_size_type size; + struct a2l_data *a2l = data; ++ flagword flags; + + if (a2l->found) + return; + +- if ((bfd_get_section_flags(abfd, section) & SEC_ALLOC) == 0) ++#ifdef bfd_get_section_flags ++ flags = bfd_get_section_flags(abfd, section); ++#else ++ flags = bfd_section_flags(section); ++#endif ++ if ((flags & SEC_ALLOC) == 0) + return; + + pc = a2l->addr; ++#ifdef bfd_get_section_vma + vma = bfd_get_section_vma(abfd, section); ++#else ++ vma = bfd_section_vma(section); ++#endif ++#ifdef bfd_get_section_size + size = bfd_get_section_size(section); ++#else ++ size = bfd_section_size(section); ++#endif + + if (pc < vma || pc >= vma + size) + return; +-- +2.27.0 + diff --git a/board/batocera/rockchip/odroidgoa/linux_patches/0004-tools-lib-api-fs-Fix-gcc9-stringop-truncation-compil.patch b/board/batocera/rockchip/odroidgoa/linux_patches/0004-tools-lib-api-fs-Fix-gcc9-stringop-truncation-compil.patch new file mode 100644 index 00000000000..b72e31dd41c --- /dev/null +++ b/board/batocera/rockchip/odroidgoa/linux_patches/0004-tools-lib-api-fs-Fix-gcc9-stringop-truncation-compil.patch @@ -0,0 +1,63 @@ +From 186f5ff69e29e0b1add523bb03462a690b2348c0 Mon Sep 17 00:00:00 2001 +From: Andrey Zhizhikin +Date: Wed, 11 Dec 2019 08:01:09 +0000 +Subject: [PATCH 04/12] tools lib api fs: Fix gcc9 stringop-truncation + compilation error + +GCC9 introduced string hardening mechanisms, which exhibits the error +during fs api compilation: + +error: '__builtin_strncpy' specified bound 4096 equals destination size +[-Werror=stringop-truncation] + +This comes when the length of copy passed to strncpy is is equal to +destination size, which could potentially lead to buffer overflow. + +There is a need to mitigate this potential issue by limiting the size of +destination by 1 and explicitly terminate the destination with NULL. + +Signed-off-by: Andrey Zhizhikin +Reviewed-by: Petr Mladek +Acked-by: Jiri Olsa +Cc: Alexei Starovoitov +Cc: Andrii Nakryiko +Cc: Daniel Borkmann +Cc: Kefeng Wang +Cc: Martin KaFai Lau +Cc: Petr Mladek +Cc: Sergey Senozhatsky +Cc: Song Liu +Cc: Yonghong Song +Cc: bpf@vger.kernel.org +Cc: netdev@vger.kernel.org +Link: http://lore.kernel.org/lkml/20191211080109.18765-1-andrey.zhizhikin@leica-geosystems.com +Signed-off-by: Arnaldo Carvalho de Melo +--- + tools/lib/api/fs/fs.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/tools/lib/api/fs/fs.c b/tools/lib/api/fs/fs.c +index 459599d1b6c4..58f05748dd39 100644 +--- a/tools/lib/api/fs/fs.c ++++ b/tools/lib/api/fs/fs.c +@@ -179,6 +179,7 @@ static bool fs__env_override(struct fs *fs) + size_t name_len = strlen(fs->name); + /* name + "_PATH" + '\0' */ + char upper_name[name_len + 5 + 1]; ++ + memcpy(upper_name, fs->name, name_len); + mem_toupper(upper_name, name_len); + strcpy(&upper_name[name_len], "_PATH"); +@@ -188,7 +189,8 @@ static bool fs__env_override(struct fs *fs) + return false; + + fs->found = true; +- strncpy(fs->path, override_path, sizeof(fs->path)); ++ strncpy(fs->path, override_path, sizeof(fs->path) - 1); ++ fs->path[sizeof(fs->path) - 1] = '\0'; + return true; + } + +-- +2.27.0 + diff --git a/board/batocera/rockchip/odroidgoa/linux_patches/0005-Clean-the-new-GCC-9-Wmissing-attributes-warnings.patch b/board/batocera/rockchip/odroidgoa/linux_patches/0005-Clean-the-new-GCC-9-Wmissing-attributes-warnings.patch new file mode 100644 index 00000000000..ec137dedc6b --- /dev/null +++ b/board/batocera/rockchip/odroidgoa/linux_patches/0005-Clean-the-new-GCC-9-Wmissing-attributes-warnings.patch @@ -0,0 +1,57 @@ +From 29d83afefdcd388e342ef73ecd7c9afaf4b30186 Mon Sep 17 00:00:00 2001 +From: Gleb Mazovetskiy +Date: Mon, 25 Jan 2021 01:06:04 +0000 +Subject: [PATCH 05/12] Clean the new GCC 9 -Wmissing-attributes warnings + +Backport https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0b999ae3614d09d97a1575936bcee884f912b10e + +Signed-off-by: Gleb Mazovetskiy +--- + include/linux/compiler.h | 10 ++++++++++ + include/linux/module.h | 4 ++-- + 2 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/include/linux/compiler.h b/include/linux/compiler.h +index ed772311ec1f..798f1fac3961 100644 +--- a/include/linux/compiler.h ++++ b/include/linux/compiler.h +@@ -422,6 +422,16 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s + #define __visible + #endif + ++#if defined __has_attribute ++# if __has_attribute (__copy__) ++# define __copy(symbol) __attribute__((__copy__(symbol))) ++# else ++# define __copy(symbol) ++# endif ++#else ++# define __copy(symbol) ++#endif ++ + /* + * Assume alignment of return value. + */ +diff --git a/include/linux/module.h b/include/linux/module.h +index d79e1e55c1d4..4b29f51443f8 100644 +--- a/include/linux/module.h ++++ b/include/linux/module.h +@@ -127,13 +127,13 @@ extern void cleanup_module(void); + #define module_init(initfn) \ + static inline initcall_t __maybe_unused __inittest(void) \ + { return initfn; } \ +- int init_module(void) __attribute__((alias(#initfn))); ++ int init_module(void) __copy(initfn) __attribute__((alias(#initfn))); + + /* This is only required if you want to be unloadable. */ + #define module_exit(exitfn) \ + static inline exitcall_t __maybe_unused __exittest(void) \ + { return exitfn; } \ +- void cleanup_module(void) __attribute__((alias(#exitfn))); ++ void cleanup_module(void) __copy(exitfn) __attribute__((alias(#exitfn))); + + #endif + +-- +2.27.0 + diff --git a/board/batocera/rockchip/odroidgoa/linux_patches/0006-nf_conntrack_core-Fix-gcc-10-compilation.patch b/board/batocera/rockchip/odroidgoa/linux_patches/0006-nf_conntrack_core-Fix-gcc-10-compilation.patch new file mode 100644 index 00000000000..512f6006034 --- /dev/null +++ b/board/batocera/rockchip/odroidgoa/linux_patches/0006-nf_conntrack_core-Fix-gcc-10-compilation.patch @@ -0,0 +1,49 @@ +From 0ce5411261e152c74a83fba2e29dfc34b6b53480 Mon Sep 17 00:00:00 2001 +From: Gleb Mazovetskiy +Date: Mon, 25 Jan 2021 01:13:14 +0000 +Subject: [PATCH 06/12] nf_conntrack_core: Fix gcc-10 compilation + +gcc-10 emits the following error: + +> warning: array subscript 0 is outside the bounds of an interior zero-length array 'u8[0]' {aka 'unsigned char[0]'} [-Wzero-length-bounds] + +Based on https://lkml.org/lkml/2020/4/30/1476 + +Signed-off-by: Gleb Mazovetskiy +--- + include/net/netfilter/nf_conntrack.h | 2 +- + net/netfilter/nf_conntrack_core.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h +index fde4068eec0b..c818597b71e6 100644 +--- a/include/net/netfilter/nf_conntrack.h ++++ b/include/net/netfilter/nf_conntrack.h +@@ -98,7 +98,7 @@ struct nf_conn { + possible_net_t ct_net; + + /* all members below initialized via memset */ +- u8 __nfct_init_offset[0]; ++ struct { } __nfct_init_offset; + + /* If we were expected by an expectation, this will be it */ + struct nf_conn *master; +diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c +index 5f747089024f..3a290456507f 100644 +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -863,9 +863,9 @@ __nf_conntrack_alloc(struct net *net, + /* Don't set timer yet: wait for confirmation */ + setup_timer(&ct->timeout, death_by_timeout, (unsigned long)ct); + write_pnet(&ct->ct_net, net); +- memset(&ct->__nfct_init_offset[0], 0, ++ memset(&ct->__nfct_init_offset, 0, + offsetof(struct nf_conn, proto) - +- offsetof(struct nf_conn, __nfct_init_offset[0])); ++ offsetof(struct nf_conn, __nfct_init_offset)); + + if (zone && nf_ct_zone_add(ct, GFP_ATOMIC, zone) < 0) + goto out_free; +-- +2.27.0 + diff --git a/board/batocera/rockchip/odroidgoa/linux_patches/0007-wlcore-debugfs-Remove-unused-variable-res.patch b/board/batocera/rockchip/odroidgoa/linux_patches/0007-wlcore-debugfs-Remove-unused-variable-res.patch new file mode 100644 index 00000000000..463604c9347 --- /dev/null +++ b/board/batocera/rockchip/odroidgoa/linux_patches/0007-wlcore-debugfs-Remove-unused-variable-res.patch @@ -0,0 +1,44 @@ +From 4e2bc2d535a5257c96bb95ab5f20f1169ea5f0f5 Mon Sep 17 00:00:00 2001 +From: Lee Jones +Date: Wed, 26 Aug 2020 10:33:46 +0100 +Subject: [PATCH 07/12] wlcore: debugfs: Remove unused variable 'res' + +Fixes the following W=1 kernel build warning(s): + +Cc: Kalle Valo +Cc: "David S. Miller" +Cc: Jakub Kicinski +Cc: Luciano Coelho +Cc: linux-wireless@vger.kernel.org +Cc: netdev@vger.kernel.org +Signed-off-by: Lee Jones +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200826093401.1458456-16-lee.jones@linaro.org +--- + drivers/net/wireless/ti/wlcore/debugfs.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/ti/wlcore/debugfs.h b/drivers/net/wireless/ti/wlcore/debugfs.h +index bf14676e6515..bfb79399d40f 100644 +--- a/drivers/net/wireless/ti/wlcore/debugfs.h ++++ b/drivers/net/wireless/ti/wlcore/debugfs.h +@@ -96,13 +96,13 @@ static ssize_t sub## _ ##name## _read(struct file *file, \ + struct wl1271 *wl = file->private_data; \ + struct struct_type *stats = wl->stats.fw_stats; \ + char buf[DEBUGFS_FORMAT_BUFFER_SIZE] = ""; \ +- int res, i; \ ++ int i; \ + \ + wl1271_debugfs_update_stats(wl); \ + \ + for (i = 0; i < len; i++) \ +- res = snprintf(buf, sizeof(buf), "%s[%d] = %d\n", \ +- buf, i, stats->sub.name[i]); \ ++ snprintf(buf, sizeof(buf), "%s[%d] = %d\n", \ ++ buf, i, stats->sub.name[i]); \ + \ + return wl1271_format_buffer(userbuf, count, ppos, "%s", buf); \ + } \ +-- +2.27.0 + diff --git a/board/batocera/rockchip/odroidgoa/linux_patches/0008-usb-ehci-avoid-gcc-10-zero-length-bounds-warning.patch b/board/batocera/rockchip/odroidgoa/linux_patches/0008-usb-ehci-avoid-gcc-10-zero-length-bounds-warning.patch new file mode 100644 index 00000000000..7a4134a5e2d --- /dev/null +++ b/board/batocera/rockchip/odroidgoa/linux_patches/0008-usb-ehci-avoid-gcc-10-zero-length-bounds-warning.patch @@ -0,0 +1,55 @@ +From 7eae4ba5981e9aa787b1fb6580f6cd4682b383de Mon Sep 17 00:00:00 2001 +From: Gleb Mazovetskiy +Date: Mon, 25 Jan 2021 01:29:37 +0000 +Subject: [PATCH 08/12] usb: ehci: avoid gcc-10 zero-length-bounds warning + +Backport of https://lkml.org/lkml/2020/4/30/1475 + +Signed-off-by: Gleb Mazovetskiy +--- + include/linux/usb/ehci_def.h | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/include/linux/usb/ehci_def.h b/include/linux/usb/ehci_def.h +index e479033bd782..311e37cf7bb5 100644 +--- a/include/linux/usb/ehci_def.h ++++ b/include/linux/usb/ehci_def.h +@@ -126,7 +126,8 @@ struct ehci_regs { + #define FLAG_CF (1<<0) /* true: we'll support "high speed" */ + + /* PORTSC: offset 0x44 */ +- u32 port_status[0]; /* up to N_PORTS */ ++ union { ++ u32 port_status[9]; /* up to N_PORTS */ + /* EHCI 1.1 addendum */ + #define PORTSC_SUSPEND_STS_ACK 0 + #define PORTSC_SUSPEND_STS_NYET 1 +@@ -164,7 +165,8 @@ struct ehci_regs { + #define PORT_CONNECT (1<<0) /* device connected */ + #define PORT_RWC_BITS (PORT_CSC | PORT_PEC | PORT_OCC) + +- u32 reserved3[9]; ++ u32 reserved3[9]; ++ }; + + /* USBMODE: offset 0x68 */ + u32 usbmode; /* USB Device mode */ +@@ -180,11 +182,13 @@ struct ehci_regs { + * PORTSCx + */ + /* HOSTPC: offset 0x84 */ +- u32 hostpc[0]; /* HOSTPC extension */ ++ union { ++ u32 hostpc[17]; /* HOSTPC extension */ + #define HOSTPC_PHCD (1<<22) /* Phy clock disable */ + #define HOSTPC_PSPD (3<<25) /* Port speed detection */ + +- u32 reserved5[17]; ++ u32 reserved5[17]; ++ }; + + /* USBMODE_EX: offset 0xc8 */ + u32 usbmode_ex; /* USB Device mode extension */ +-- +2.27.0 + diff --git a/board/batocera/rockchip/odroidgoa/linux_patches/0009-gcc-10-warnings-fix-low-hanging-fruit.patch b/board/batocera/rockchip/odroidgoa/linux_patches/0009-gcc-10-warnings-fix-low-hanging-fruit.patch new file mode 100644 index 00000000000..ae1991a0928 --- /dev/null +++ b/board/batocera/rockchip/odroidgoa/linux_patches/0009-gcc-10-warnings-fix-low-hanging-fruit.patch @@ -0,0 +1,56 @@ +From 6fb2704ccabaede891301b7cae81054d63b09a52 Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Mon, 4 May 2020 09:16:37 -0700 +Subject: [PATCH 09/12] gcc-10 warnings: fix low-hanging fruit + +Backport of 9d82973e032e246ff5663c9805fbb5407ae932e3 + +Original description below +--- + +Due to a bug-report that was compiler-dependent, I updated one of my +machines to gcc-10. That shows a lot of new warnings. Happily they +seem to be mostly the valid kind, but it's going to cause a round of +churn for getting rid of them.. + +This is the really low-hanging fruit of removing a couple of zero-sized +arrays in some core code. We have had a round of these patches before, +and we'll have many more coming, and there is nothing special about +these except that they were particularly trivial, and triggered more +warnings than most. + +Signed-off-by: Linus Torvalds +--- + include/linux/fs.h | 2 +- + include/linux/tty.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/linux/fs.h b/include/linux/fs.h +index c0f76c97359c..d036da45899f 100644 +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -938,7 +938,7 @@ struct file_handle { + __u32 handle_bytes; + int handle_type; + /* file identifier */ +- unsigned char f_handle[0]; ++ unsigned char f_handle[]; + }; + + static inline struct file *get_file(struct file *f) +diff --git a/include/linux/tty.h b/include/linux/tty.h +index bac8e6dc8689..f1e422acfda8 100644 +--- a/include/linux/tty.h ++++ b/include/linux/tty.h +@@ -64,7 +64,7 @@ struct tty_buffer { + int read; + int flags; + /* Data points here */ +- unsigned long data[0]; ++ unsigned long data[]; + }; + + /* Values for .flags field of tty_buffer */ +-- +2.27.0 + diff --git a/board/batocera/rockchip/odroidgoa/linux_patches/0010-Fix-joystick-analog.c-GCC-10-Wrestrict-warning.patch b/board/batocera/rockchip/odroidgoa/linux_patches/0010-Fix-joystick-analog.c-GCC-10-Wrestrict-warning.patch new file mode 100644 index 00000000000..460719f198a --- /dev/null +++ b/board/batocera/rockchip/odroidgoa/linux_patches/0010-Fix-joystick-analog.c-GCC-10-Wrestrict-warning.patch @@ -0,0 +1,40 @@ +From e76f457cdfe034aa6618e445381e4a9f77807a8d Mon Sep 17 00:00:00 2001 +From: Gleb Mazovetskiy +Date: Mon, 25 Jan 2021 02:30:53 +0000 +Subject: [PATCH 10/12] Fix joystick/analog.c GCC-10 -Wrestrict warning + +drivers/input/joystick/analog.c: In function 'analog_connect': +drivers/input/joystick/analog.c:444:3: warning: 'snprintf' argument 4 overlaps destination object '' [-Wrestrict] +error, forbidden warning:analog.c:444 + 444 | snprintf(analog->name, sizeof(analog->name), "%s %d-hat", + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + 445 | analog->name, hweight16(analog->mask & ANALOG_HATS_ALL)); + | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Signed-off-by: Gleb Mazovetskiy +--- + drivers/input/joystick/analog.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/input/joystick/analog.c b/drivers/input/joystick/analog.c +index 6f8b084e13d0..1e7e29fa47c5 100644 +--- a/drivers/input/joystick/analog.c ++++ b/drivers/input/joystick/analog.c +@@ -440,9 +440,11 @@ static void analog_name(struct analog *analog) + hweight8(analog->mask & ANALOG_BTNS_STD) + !!(analog->mask & ANALOG_BTNS_CHF) * 2 + + hweight16(analog->mask & ANALOG_BTNS_GAMEPAD) + !!(analog->mask & ANALOG_HBTN_CHF) * 4); + +- if (analog->mask & ANALOG_HATS_ALL) +- snprintf(analog->name, sizeof(analog->name), "%s %d-hat", +- analog->name, hweight16(analog->mask & ANALOG_HATS_ALL)); ++ if (analog->mask & ANALOG_HATS_ALL) { ++ size_t len = strnlen(analog->name, sizeof(analog->name)); ++ snprintf(analog->name + len, sizeof(analog->name) - len, " %d-hat", ++ hweight16(analog->mask & ANALOG_HATS_ALL)); ++ } + + if (analog->mask & ANALOG_HAT_FCS) + strlcat(analog->name, " FCS", sizeof(analog->name)); +-- +2.27.0 + diff --git a/board/batocera/rockchip/odroidgoa/linux_patches/0011-drivers-net-phy-mdio_bus-Fix-gcc-10-Wrestrict.patch b/board/batocera/rockchip/odroidgoa/linux_patches/0011-drivers-net-phy-mdio_bus-Fix-gcc-10-Wrestrict.patch new file mode 100644 index 00000000000..044b8d71ca5 --- /dev/null +++ b/board/batocera/rockchip/odroidgoa/linux_patches/0011-drivers-net-phy-mdio_bus-Fix-gcc-10-Wrestrict.patch @@ -0,0 +1,45 @@ +From c7c2392bf7c16ed73b043ba9726ac905845eebfb Mon Sep 17 00:00:00 2001 +From: Gleb Mazovetskiy +Date: Mon, 25 Jan 2021 02:36:54 +0000 +Subject: [PATCH 11/12] drivers/net/phy/mdio_bus: Fix gcc-10 -Wrestrict + +Fixes + +drivers/net/phy/mdio_bus.c: In function 'phy_registers_show': +drivers/net/phy/mdio_bus.c:665:3: warning: 'sprintf' argument 3 overlaps destination object 'buf' [-Wrestrict] +error, forbidden warning:mdio_bus.c:665 + 665 | sprintf(buf, "%s%2d: 0x%x\n", buf, index, + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + 666 | phy_read(phydev, index)); + | ~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/net/phy/mdio_bus.c:659:77: note: destination object referenced by 'restrict'-qualified argument 1 was declared here + 659 | phy_registers_show(struct device *dev, struct device_attribute *attr, char *buf) + | ~~~~~~^~~ + +Signed-off-by: Gleb Mazovetskiy +--- + drivers/net/phy/mdio_bus.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c +index d079ac58c7da..f20c0e31cb45 100644 +--- a/drivers/net/phy/mdio_bus.c ++++ b/drivers/net/phy/mdio_bus.c +@@ -661,9 +661,12 @@ phy_registers_show(struct device *dev, struct device_attribute *attr, char *buf) + struct phy_device *phydev = to_phy_device(dev); + int index; + +- for (index = 0; index < 32; index++) +- sprintf(buf, "%s%2d: 0x%x\n", buf, index, ++ char tmp[50]; ++ for (index = 0; index < 32; index++) { ++ snprintf(tmp, sizeof(tmp), "%2d: 0x%x\n", index, + phy_read(phydev, index)); ++ strcat(buf, tmp); ++ } + + return strlen(buf); + } +-- +2.27.0 + diff --git a/board/batocera/rockchip/odroidgoa/linux_patches/0012-drivers-net-wireless-Fix-gcc-10-Wrestrict.patch b/board/batocera/rockchip/odroidgoa/linux_patches/0012-drivers-net-wireless-Fix-gcc-10-Wrestrict.patch new file mode 100644 index 00000000000..86c687607a9 --- /dev/null +++ b/board/batocera/rockchip/odroidgoa/linux_patches/0012-drivers-net-wireless-Fix-gcc-10-Wrestrict.patch @@ -0,0 +1,5406 @@ +From e14af2d999d873c32d922fe39c72ba4b6e86b3f0 Mon Sep 17 00:00:00 2001 +From: Gleb Mazovetskiy +Date: Mon, 25 Jan 2021 02:45:24 +0000 +Subject: [PATCH 12/12] drivers/net/wireless: Fix gcc-10 -Wrestrict + +Fixes errors such as: + +drivers/net/wireless/rtl8821cu/os_dep/linux/ioctl_mp.c: In function 'rtw_mp_txpower_index': +drivers/net/wireless/rtl8821cu/os_dep/linux/ioctl_mp.c:573:4: warning: 'sprintf' argument 3 overlaps destination object 'extra' [-Wrestrict] +error, forbidden warning:ioctl_mp.c:573 + 573 | sprintf(extra, "%s,pathb=%d", extra, txpower_inx); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/net/wireless/rtl8821cu/os_dep/linux/ioctl_mp.c:546:34: note: destination object referenced by 'restrict'-qualified argument 1 was declared here + 546 | struct iw_point *wrqu, char *extra) + | ~~~~~~^~~~~ + +Signed-off-by: Gleb Mazovetskiy +--- + drivers/net/wireless/ew-7611ulb/core/rtw_mp.c | 19 ++- + .../ew-7611ulb/os_dep/linux/ioctl_mp.c | 14 +- + .../rockchip_wlan/rtl8188eu/core/rtw_mp.c | 19 ++- + .../rtl8188eu/os_dep/linux/ioctl_linux.c | 145 +++++++++--------- + .../rtl8188eu/os_dep/linux/ioctl_mp.c | 127 +++++++-------- + .../rockchip_wlan/rtl8188fu/core/rtw_mp.c | 4 +- + .../rtl8188fu/os_dep/linux/ioctl_linux.c | 131 ++++++++-------- + .../rtl8188fu/os_dep/linux/ioctl_mp.c | 126 +++++++-------- + .../rockchip_wlan/rtl8189es/core/rtw_mp.c | 4 +- + .../rtl8189es/os_dep/linux/ioctl_linux.c | 133 ++++++++-------- + .../rtl8189es/os_dep/linux/ioctl_mp.c | 126 +++++++-------- + .../rockchip_wlan/rtl8189fs/core/rtw_mp.c | 19 ++- + .../rtl8189fs/os_dep/linux/ioctl_mp.c | 17 +- + .../rockchip_wlan/rtl8723bs/core/rtw_mp.c | 19 ++- + .../rtl8723bs/os_dep/linux/ioctl_mp.c | 17 +- + .../rockchip_wlan/rtl8723bu/core/rtw_mp.c | 4 +- + .../rtl8723bu/os_dep/linux/ioctl_linux.c | 129 ++++++++-------- + .../rtl8723bu/os_dep/linux/ioctl_mp.c | 128 ++++++++-------- + .../rockchip_wlan/rtl8723cs/core/rtw_mp.c | 19 ++- + .../rtl8723cs/os_dep/linux/ioctl_linux.c | 145 +++++++++--------- + .../rtl8723cs/os_dep/linux/ioctl_mp.c | 127 +++++++-------- + .../rockchip_wlan/rtl8723ds/core/rtw_mp.c | 19 ++- + .../rtl8723ds/os_dep/linux/ioctl_mp.c | 24 +-- + .../rockchip_wlan/rtl8822be/core/rtw_mp.c | 19 ++- + .../rtl8822be/os_dep/linux/ioctl_linux.c | 139 +++++++++-------- + .../rtl8822be/os_dep/linux/ioctl_mp.c | 122 ++++++++------- + drivers/net/wireless/rtl8192cu/core/rtw_mp.c | 4 +- + .../rtl8192cu/os_dep/linux/ioctl_linux.c | 67 ++++---- + drivers/net/wireless/rtl8812au/core/rtw_mp.c | 4 +- + .../rtl8812au/os_dep/linux/ioctl_linux.c | 138 +++++++++-------- + drivers/net/wireless/rtl8821cu/core/rtw_mp.c | 19 ++- + .../rtl8821cu/os_dep/linux/ioctl_mp.c | 27 ++-- + drivers/net/wireless/rtl88x2bu/core/rtw_mp.c | 19 ++- + .../rtl88x2bu/os_dep/linux/ioctl_mp.c | 14 +- + drivers/net/wireless/ti/wlcore/boot.c | 9 +- + drivers/net/wireless/ti/wlcore/debugfs.h | 5 +- + 36 files changed, 1129 insertions(+), 972 deletions(-) + +diff --git a/drivers/net/wireless/ew-7611ulb/core/rtw_mp.c b/drivers/net/wireless/ew-7611ulb/core/rtw_mp.c +index a16da9b60103..39384d584f38 100644 +--- a/drivers/net/wireless/ew-7611ulb/core/rtw_mp.c ++++ b/drivers/net/wireless/ew-7611ulb/core/rtw_mp.c +@@ -2093,14 +2093,17 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data) + + data[0] = '\0'; + +- i = psd_start; +- while (i < psd_stop) { +- if (i >= psd_pts) +- psd_data = rtw_GetPSDData(pAdapter, i - psd_pts); +- else +- psd_data = rtw_GetPSDData(pAdapter, i); +- sprintf(data, "%s%x ", data, psd_data); +- i++; ++ { ++ size_t extra_len = strlen(data); ++ i = psd_start; ++ while (i < psd_stop) { ++ if (i >= psd_pts) ++ psd_data = rtw_GetPSDData(pAdapter, i - psd_pts); ++ else ++ psd_data = rtw_GetPSDData(pAdapter, i); ++ extra_len += sprintf(data + extra_len, "%x ", psd_data); ++ i++; ++ } + } + + #ifdef CONFIG_LONG_DELAY_ISSUE +diff --git a/drivers/net/wireless/ew-7611ulb/os_dep/linux/ioctl_mp.c b/drivers/net/wireless/ew-7611ulb/os_dep/linux/ioctl_mp.c +index ad2bb026739a..179d08d72e7f 100644 +--- a/drivers/net/wireless/ew-7611ulb/os_dep/linux/ioctl_mp.c ++++ b/drivers/net/wireless/ew-7611ulb/os_dep/linux/ioctl_mp.c +@@ -1719,7 +1719,7 @@ int rtw_mp_tx(struct net_device *dev, + char *pextra = extra; + RTW_INFO("Got format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); ++ pextra += sprintf(pextra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); + padapter->mppriv.channel = channel; + SetChannel(padapter); + pHalData->current_channel = channel; +@@ -2074,6 +2074,7 @@ int rtw_efuse_mask_file(struct net_device *dev, + u8 count = 0; + u8 i = 0; + u32 datalen = 0; ++ size_t extra_len; + + ptmp = extra; + pch = strsep(&ptmp, ","); +@@ -2099,12 +2100,13 @@ int rtw_efuse_mask_file(struct net_device *dev, + + } while (count < 64); + ++ extra_len = strlen(extra); + for (i = 0; i < count; i++) +- sprintf(extra, "%s:%02x", extra, maskfileBuffer[i]); ++ extra_len += sprintf(extra + extra_len, ":%02x", maskfileBuffer[i]); + + padapter->registrypriv.bFileMaskEfuse = _TRUE; + +- sprintf(extra, "%s\nLoad Efuse Mask data %d hex ok\n", extra, count); ++ extra_len += sprintf(extra + extra_len, "\nLoad Efuse Mask data %d hex ok\n", count); + wrqu->data.length = strlen(extra); + return 0; + } +@@ -2522,16 +2524,18 @@ todo: + mptbt_BtControlProcess(padapter, &BtReq); + + if (readtherm == 0) { ++ size_t extra_len; + sprintf(extra, "BT thermal="); + for (i = 4; i < pMptCtx->mptOutLen; i++) { + if ((pMptCtx->mptOutBuf[i] == 0x00) && (pMptCtx->mptOutBuf[i + 1] == 0x00)) + goto exit; + +- sprintf(extra, "%s %d ", extra, (pMptCtx->mptOutBuf[i] & 0x1f)); ++ extra_len += sprintf(extra + extra_len, " %d ", (pMptCtx->mptOutBuf[i] & 0x1f)); + } + } else { ++ size_t extra_len; + for (i = 4; i < pMptCtx->mptOutLen; i++) +- sprintf(extra, "%s 0x%x ", extra, pMptCtx->mptOutBuf[i]); ++ extra_len += sprintf(extra + extra_len, " 0x%x ", pMptCtx->mptOutBuf[i]); + } + + exit: +diff --git a/drivers/net/wireless/rockchip_wlan/rtl8188eu/core/rtw_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8188eu/core/rtw_mp.c +index ec39412959b0..a7658d4e8e76 100644 +--- a/drivers/net/wireless/rockchip_wlan/rtl8188eu/core/rtw_mp.c ++++ b/drivers/net/wireless/rockchip_wlan/rtl8188eu/core/rtw_mp.c +@@ -2119,14 +2119,17 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data) + + data[0] = '\0'; + +- i = psd_start; +- while (i < psd_stop) { +- if (i >= psd_pts) +- psd_data = rtw_GetPSDData(pAdapter, i - psd_pts); +- else +- psd_data = rtw_GetPSDData(pAdapter, i); +- sprintf(data, "%s%x ", data, psd_data); +- i++; ++ { ++ size_t extra_len = strlen(data); ++ i = psd_start; ++ while (i < psd_stop) { ++ if (i >= psd_pts) ++ psd_data = rtw_GetPSDData(pAdapter, i - psd_pts); ++ else ++ psd_data = rtw_GetPSDData(pAdapter, i); ++ extra_len += sprintf(data + extra_len, "%x ", psd_data); ++ i++; ++ } + } + + #ifdef CONFIG_LONG_DELAY_ISSUE +diff --git a/drivers/net/wireless/rockchip_wlan/rtl8188eu/os_dep/linux/ioctl_linux.c b/drivers/net/wireless/rockchip_wlan/rtl8188eu/os_dep/linux/ioctl_linux.c +index 5537ead019c2..99ef17400999 100644 +--- a/drivers/net/wireless/rockchip_wlan/rtl8188eu/os_dep/linux/ioctl_linux.c ++++ b/drivers/net/wireless/rockchip_wlan/rtl8188eu/os_dep/linux/ioctl_linux.c +@@ -9034,6 +9034,7 @@ static int rtw_mp_efuse_get(struct net_device *dev, + u16 mask_len; + u8 mask_buf[64] = ""; + int err; ++ size_t extra_len; + #ifdef CONFIG_IOL + u8 org_fw_iol = padapter->registrypriv.fw_iol;/* 0:Disable, 1:enable, 2:by usb speed */ + #endif +@@ -9108,18 +9109,18 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } else + drvmaporder = 0; + +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < cnt; i += 16) { +- sprintf(extra, "%s0x%02x\t", extra, shift + i); ++ extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i); + for (j = 0; j < 8; j++) +- sprintf(extra, "%s%02X ", extra, efuse[i + j]); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j < 16; j++) +- sprintf(extra, "%s%02X ", extra, efuse[i + j]); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + if ((shift + cnt) < mapLen) +- sprintf(extra, "%s\t...more (left:%d/%d)\n", extra, mapLen-(shift + cnt), mapLen); ++ extra_len += sprintf(extra + extra_len, "\t...more (left:%d/%d)\n", mapLen-(shift + cnt), mapLen); + + } else if (strcmp(tmp[0], "realmap") == 0) { + static u8 order = 0; +@@ -9158,18 +9159,18 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } else + order = 0; + +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < cnt; i += 16) { +- sprintf(extra, "%s0x%02x\t", extra, shift + i); ++ extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i); + for (j = 0; j < 8; j++) +- sprintf(extra, "%s%02X ", extra, efuse[i + j]); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j < 16; j++) +- sprintf(extra, "%s%02X ", extra, efuse[i + j]); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + if ((shift + cnt) < mapLen) +- sprintf(extra, "%s\t...more (left:%d/%d)\n", extra, mapLen-(shift + cnt), mapLen); ++ extra_len += sprintf(extra + extra_len, "\t...more (left:%d/%d)\n", mapLen-(shift + cnt), mapLen); + } else if (strcmp(tmp[0], "rmap") == 0) { + if ((tmp[1] == NULL) || (tmp[2] == NULL)) { + RTW_INFO("%s: rmap Fail!! Parameters error!\n", __FUNCTION__); +@@ -9204,9 +9205,10 @@ static int rtw_mp_efuse_get(struct net_device *dev, + + /* RTW_INFO("%s: data={", __FUNCTION__); */ + *extra = 0; ++ extra_len = 0; + for (i = 0; i < cnts; i++) { + /* RTW_INFO("0x%02x ", data[i]); */ +- sprintf(extra, "%s0x%02X ", extra, data[i]); ++ extra_len += sprintf(extra + extra_len, "0x%02X ", data[i]); + } + /* RTW_INFO("}\n"); */ + } else if (strcmp(tmp[0], "realraw") == 0) { +@@ -9235,18 +9237,18 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } else + raw_order = 0; + +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < cnt; i += 16) { +- sprintf(extra, "%s0x%02x\t", extra, shift + i); ++ extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i); + for (j = 0; j < 8; j++) +- sprintf(extra, "%s%02X ", extra, rawdata[i + j]); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", rawdata[i + j]); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j < 16; j++) +- sprintf(extra, "%s%02X ", extra, rawdata[i + j]); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", rawdata[i + j]); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + if ((shift + cnt) < mapLen) +- sprintf(extra, "%s\t...more (left:%d/%d)\n", extra, mapLen-(shift + cnt), mapLen); ++ extra_len += sprintf(extra + extra_len, "\t...more (left:%d/%d)\n", mapLen-(shift + cnt), mapLen); + + } else if (strcmp(tmp[0], "btrealraw") == 0) { + static u8 bt_raw_order = 0; +@@ -9282,18 +9284,18 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } else + bt_raw_order = 0; + +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < cnt; i += 16) { +- sprintf(extra, "%s0x%02x\t", extra, shift + i); ++ extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i); + for (j = 0; j < 8; j++) +- sprintf(extra, "%s%02X ", extra, rawdata[i + j]); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", rawdata[i + j]); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j < 16; j++) +- sprintf(extra, "%s%02X ", extra, rawdata[i + j]); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", rawdata[i + j]); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + if ((shift + cnt) < mapLen) +- sprintf(extra, "%s\t...more (left:%d/%d)\n", extra, mapLen-(shift + cnt), mapLen); ++ extra_len += sprintf(extra + extra_len, "\t...more (left:%d/%d)\n", mapLen-(shift + cnt), mapLen); + + } else if (strcmp(tmp[0], "mac") == 0) { + if (hal_efuse_macaddr_offset(padapter) == -1) { +@@ -9319,12 +9321,13 @@ static int rtw_mp_efuse_get(struct net_device *dev, + + /* RTW_INFO("%s: MAC address={", __FUNCTION__); */ + *extra = 0; ++ extra_len = 0; + for (i = 0; i < cnts; i++) { + /* RTW_INFO("%02X", data[i]); */ +- sprintf(extra, "%s%02X", extra, data[i]); ++ extra_len += sprintf(extra + extra_len, "%02X", data[i]); + if (i != (cnts - 1)) { + /* RTW_INFO(":"); */ +- sprintf(extra, "%s:", extra); ++ extra_len += sprintf(extra + extra_len, ":"); + } + } + /* RTW_INFO("}\n"); */ +@@ -9382,12 +9385,13 @@ static int rtw_mp_efuse_get(struct net_device *dev, + + /* RTW_INFO("%s: {VID,PID}={", __FUNCTION__); */ + *extra = 0; ++ extra_len = 0; + for (i = 0; i < cnts; i++) { + /* RTW_INFO("0x%02x", data[i]); */ +- sprintf(extra, "%s0x%02X", extra, data[i]); ++ extra_len += sprintf(extra + extra_len, "0x%02X", data[i]); + if (i != (cnts - 1)) { + /* RTW_INFO(","); */ +- sprintf(extra, "%s,", extra); ++ extra_len += sprintf(extra + extra_len, ","); + } + } + /* RTW_INFO("}\n"); */ +@@ -9415,22 +9419,22 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } + + /* RTW_INFO("OFFSET\tVALUE(hex)\n"); */ +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < 512; i += 16) { /* set 512 because the iwpriv's extra size have limit 0x7FF */ + /* RTW_INFO("0x%03x\t", i); */ +- sprintf(extra, "%s0x%03x\t", extra, i); ++ extra_len += sprintf(extra + extra_len, "0x%03x\t", i); + for (j = 0; j < 8; j++) { + /* RTW_INFO("%02X ", pEfuseHal->BTEfuseInitMap[i+j]); */ +- sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i + j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i + j]); + } + /* RTW_INFO("\t"); */ +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j < 16; j++) { + /* RTW_INFO("%02X ", pEfuseHal->BTEfuseInitMap[i+j]); */ +- sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i + j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i + j]); + } + /* RTW_INFO("\n"); */ +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + /* RTW_INFO("\n"); */ + } else if (strcmp(tmp[0], "btbmap") == 0) { +@@ -9444,22 +9448,22 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } + + /* RTW_INFO("OFFSET\tVALUE(hex)\n"); */ +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 512; i < 1024 ; i += 16) { + /* RTW_INFO("0x%03x\t", i); */ +- sprintf(extra, "%s0x%03x\t", extra, i); ++ extra_len += sprintf(extra + extra_len, "0x%03x\t", i); + for (j = 0; j < 8; j++) { + /* RTW_INFO("%02X ", data[i+j]); */ +- sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i + j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i + j]); + } + /* RTW_INFO("\t"); */ +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j < 16; j++) { + /* RTW_INFO("%02X ", data[i+j]); */ +- sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i + j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i + j]); + } + /* RTW_INFO("\n"); */ +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + /* RTW_INFO("\n"); */ + } else if (strcmp(tmp[0], "btrmap") == 0) { +@@ -9507,51 +9511,52 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } + + *extra = 0; ++ extra_len = 0; + /* RTW_INFO("%s: bt efuse data={", __FUNCTION__); */ + for (i = 0; i < cnts; i++) { + /* RTW_INFO("0x%02x ", data[i]); */ +- sprintf(extra, "%s 0x%02X ", extra, data[i]); ++ extra_len += sprintf(extra + extra_len, " 0x%02X ", data[i]); + } + /* RTW_INFO("}\n"); */ + RTW_INFO(FUNC_ADPT_FMT ": BT MAC=[%s]\n", FUNC_ADPT_ARG(padapter), extra); + } else if (strcmp(tmp[0], "btffake") == 0) { + /* RTW_INFO("OFFSET\tVALUE(hex)\n"); */ +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < 512; i += 16) { + /* RTW_INFO("0x%03x\t", i); */ +- sprintf(extra, "%s0x%03x\t", extra, i); ++ extra_len += sprintf(extra + extra_len, "0x%03x\t", i); + for (j = 0; j < 8; j++) { + /* RTW_INFO("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); */ +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i + j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i + j]); + } + /* RTW_INFO("\t"); */ +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j < 16; j++) { + /* RTW_INFO("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); */ +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i + j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i + j]); + } + /* RTW_INFO("\n"); */ +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + /* RTW_INFO("\n"); */ + } else if (strcmp(tmp[0], "btbfake") == 0) { + /* RTW_INFO("OFFSET\tVALUE(hex)\n"); */ +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 512; i < 1024; i += 16) { + /* RTW_INFO("0x%03x\t", i); */ +- sprintf(extra, "%s0x%03x\t", extra, i); ++ extra_len += sprintf(extra + extra_len, "0x%03x\t", i); + for (j = 0; j < 8; j++) { + /* RTW_INFO("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); */ +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i + j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i + j]); + } + /* RTW_INFO("\t"); */ +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j < 16; j++) { + /* RTW_INFO("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); */ +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i + j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i + j]); + } + /* RTW_INFO("\n"); */ +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + /* RTW_INFO("\n"); */ + } else if (strcmp(tmp[0], "wlrfkmap") == 0) { +@@ -9572,18 +9577,18 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } else + fk_order = 0; + +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < cnt; i += 16) { +- sprintf(extra, "%s0x%02x\t", extra, shift + i); ++ extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i); + for (j = 0; j < 8; j++) +- sprintf(extra, "%s%02X ", extra, efuse[i + j]); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j < 16; j++) +- sprintf(extra, "%s%02X ", extra, efuse[i + j]); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + if ((shift + cnt) < mapLen) +- sprintf(extra, "%s\t...more\n", extra); ++ extra_len += sprintf(extra + extra_len, "\t...more\n"); + + } else if (strcmp(tmp[0], "wlrfkrmap") == 0) { + if ((tmp[1] == NULL) || (tmp[2] == NULL)) { +@@ -9605,9 +9610,10 @@ static int rtw_mp_efuse_get(struct net_device *dev, + + /* RTW_INFO("%s: data={", __FUNCTION__); */ + *extra = 0; ++ extra_len = 0; + for (i = 0; i < cnts; i++) { + RTW_INFO("wlrfkrmap = 0x%02x\n", pEfuseHal->fakeEfuseModifiedMap[addr + i]); +- sprintf(extra, "%s0x%02X ", extra, pEfuseHal->fakeEfuseModifiedMap[addr + i]); ++ extra_len += sprintf(extra + extra_len, "0x%02X ", pEfuseHal->fakeEfuseModifiedMap[addr + i]); + } + } else if (strcmp(tmp[0], "btrfkrmap") == 0) { + if ((tmp[1] == NULL) || (tmp[2] == NULL)) { +@@ -9629,9 +9635,10 @@ static int rtw_mp_efuse_get(struct net_device *dev, + + /* RTW_INFO("%s: data={", __FUNCTION__); */ + *extra = 0; ++ extra_len = 0; + for (i = 0; i < cnts; i++) { + RTW_INFO("wlrfkrmap = 0x%02x\n", pEfuseHal->fakeBTEfuseModifiedMap[addr + i]); +- sprintf(extra, "%s0x%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[addr + i]); ++ extra_len += sprintf(extra + extra_len, "0x%02X ", pEfuseHal->fakeBTEfuseModifiedMap[addr + i]); + } + } else if (strcmp(tmp[0], "mask") == 0) { + *extra = 0; +@@ -9641,9 +9648,9 @@ static int rtw_mp_efuse_get(struct net_device *dev, + if (padapter->registrypriv.bFileMaskEfuse == _TRUE) + _rtw_memcpy(mask_buf, maskfileBuffer, mask_len); + +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < mask_len; i++) +- sprintf(extra, "%s0x%02X\n", extra, mask_buf[i]); ++ extra_len += sprintf(extra + extra_len, "0x%02X\n", mask_buf[i]); + + } else + sprintf(extra, "Command not found!"); +diff --git a/drivers/net/wireless/rockchip_wlan/rtl8188eu/os_dep/linux/ioctl_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8188eu/os_dep/linux/ioctl_mp.c +index b7109f9a81d1..b0c108e574b7 100644 +--- a/drivers/net/wireless/rockchip_wlan/rtl8188eu/os_dep/linux/ioctl_mp.c ++++ b/drivers/net/wireless/rockchip_wlan/rtl8188eu/os_dep/linux/ioctl_mp.c +@@ -198,7 +198,7 @@ int rtw_mp_read_reg(struct net_device *dev, + if (*pnext != '\0') { + /*strtout = simple_strtoul(pnext , &ptmp, 16);*/ + ret = sscanf(pnext, "%x", &strtout); +- sprintf(extra, "%s %d" , extra , strtout); ++ sprintf(extra + strlen(extra), " %d", strtout); + } else + break; + pch = pnext; +@@ -230,7 +230,7 @@ int rtw_mp_read_reg(struct net_device *dev, + pnext++; + if (*pnext != '\0') { + ret = sscanf(pnext, "%x", &strtout); +- sprintf(extra, "%s %d" , extra , strtout); ++ sprintf(extra + strlen(extra), " %d", strtout); + } else + break; + pch = pnext; +@@ -341,20 +341,23 @@ int rtw_mp_read_rf(struct net_device *dev, + pch = tmp; + RTW_INFO("pch=%s", pch); + +- while (*pch != '\0') { +- pnext = strpbrk(pch, " "); +- if (!pnext) +- break; +- pnext++; +- if (*pnext != '\0') { +- /*strtou =simple_strtoul(pnext , &ptmp, 16);*/ +- ret = sscanf(pnext, "%x", &strtou); +- sprintf(extra, "%s %d" , extra , strtou); +- } else +- break; +- pch = pnext; ++ { ++ size_t extra_len = strlen(extra); ++ while (*pch != '\0') { ++ pnext = strpbrk(pch, " "); ++ if (!pnext) ++ break; ++ pnext++; ++ if (*pnext != '\0') { ++ /*strtou =simple_strtoul(pnext , &ptmp, 16);*/ ++ ret = sscanf(pnext, "%x", &strtou); ++ extra_len += sprintf(extra + extra_len, " %d", strtou); ++ } else ++ break; ++ pch = pnext; ++ } ++ wrqu->length = extra_len; + } +- wrqu->length = strlen(extra); + + return 0; + } +@@ -1417,7 +1420,7 @@ int rtw_mp_pretx_proc(PADAPTER padapter, u8 bStartTest, char *extra) + pmp_priv->mode = MP_ON; + sprintf(extra, "Stop continuous Tx"); + } else if (pmp_priv->tx.stop == 1) { +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500 count=%u\n", extra, pmp_priv->tx.count); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500 count=%u\n", pmp_priv->tx.count); + pmp_priv->tx.stop = 0; + SetPacketTx(padapter); + } else +@@ -1425,26 +1428,26 @@ int rtw_mp_pretx_proc(PADAPTER padapter, u8 bStartTest, char *extra) + return 0; + case MP_SINGLE_TONE_TX: + if (bStartTest != 0) +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes."); + SetSingleToneTx(padapter, (u8)bStartTest); + break; + case MP_CONTINUOUS_TX: + if (bStartTest != 0) +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes."); + SetContinuousTx(padapter, (u8)bStartTest); + break; + case MP_CARRIER_SUPPRISSION_TX: + if (bStartTest != 0) { + if (HwRateToMPTRate(pmp_priv->rateidx) <= MPT_RATE_11M) +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes."); + else +- sprintf(extra, "%s\nSpecify carrier suppression but not CCK rate", extra); ++ sprintf(extra + strlen(extra), "\nSpecify carrier suppression but not CCK rate"); + } + SetCarrierSuppressionTx(padapter, (u8)bStartTest); + break; + case MP_SINGLE_CARRIER_TX: + if (bStartTest != 0) +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes."); + SetSingleCarrierTx(padapter, (u8)bStartTest); + break; + +@@ -1496,6 +1499,7 @@ int rtw_mp_tx(struct net_device *dev, + u32 bandwidth = 0, sg = 0, channel = 6, txpower = 40, rate = 108, ant = 0, txmode = 1, count = 0; + u8 i = 0, j = 0, bStartTest = 1, status = 0, Idx = 0, tmpU1B = 0; + u16 antenna = 0; ++ size_t extra_len; + + if (copy_from_user(extra, wrqu->data.pointer, wrqu->data.length)) + return -EFAULT; +@@ -1522,13 +1526,13 @@ int rtw_mp_tx(struct net_device *dev, + return 0; + } else if (strncmp(extra, "setting", 7) == 0) { + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "Current Setting :\n Channel:%d", pmp_priv->channel); +- sprintf(extra, "%s\n Bandwidth:%d", extra, pmp_priv->bandwidth); +- sprintf(extra, "%s\n Rate index:%d", extra, pmp_priv->rateidx); +- sprintf(extra, "%s\n TxPower index:%d", extra, pmp_priv->txpoweridx); +- sprintf(extra, "%s\n Antenna TxPath:%d", extra, pmp_priv->antenna_tx); +- sprintf(extra, "%s\n Antenna RxPath:%d", extra, pmp_priv->antenna_rx); +- sprintf(extra, "%s\n MP Mode:%d", extra, pmp_priv->mode); ++ extra_len = sprintf(extra, "Current Setting :\n Channel:%d", pmp_priv->channel); ++ extra_len += sprintf(extra + extra_len, "\n Bandwidth:%d", pmp_priv->bandwidth); ++ extra_len += sprintf(extra + extra_len, "\n Rate index:%d", pmp_priv->rateidx); ++ extra_len += sprintf(extra + extra_len, "\n TxPower index:%d", pmp_priv->txpoweridx); ++ extra_len += sprintf(extra + extra_len, "\n Antenna TxPath:%d", pmp_priv->antenna_tx); ++ extra_len += sprintf(extra + extra_len, "\n Antenna RxPath:%d", pmp_priv->antenna_rx); ++ extra_len += sprintf(extra + extra_len, "\n MP Mode:%d", pmp_priv->mode); + wrqu->data.length = strlen(extra); + return 0; + #ifdef CONFIG_MP_VHT_HW_TX_MODE +@@ -1666,25 +1670,25 @@ int rtw_mp_tx(struct net_device *dev, + if (sscanf(extra, "ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d", &channel, &bandwidth, &rate, &txpower, &ant, &txmode) < 6) { + RTW_INFO("Invalid format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "\n Please input correct format as bleow:\n"); +- sprintf(extra, "%s\t ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d\n", extra, channel, bandwidth, rate, txpower, ant, txmode); +- sprintf(extra, "%s\n [ ch : BGN = <1~14> , A or AC = <36~165> ]", extra); +- sprintf(extra, "%s\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]", extra); +- sprintf(extra, "%s\n [ rate : CCK: 1 2 5.5 11M X 2 = < 2 4 11 22 >]", extra); +- sprintf(extra, "%s\n [ OFDM: 6 9 12 18 24 36 48 54M X 2 = < 12 18 24 36 48 72 96 108>", extra); +- sprintf(extra, "%s\n [ HT 1S2SS MCS0 ~ MCS15 : < [MCS0]=128 ~ [MCS7]=135 ~ [MCS15]=143 >", extra); +- sprintf(extra, "%s\n [ HT 3SS MCS16 ~ MCS32 : < [MCS16]=144 ~ [MCS23]=151 ~ [MCS32]=159 >", extra); +- sprintf(extra, "%s\n [ VHT 1SS MCS0 ~ MCS9 : < [MCS0]=160 ~ [MCS9]=169 >", extra); +- sprintf(extra, "%s\n [ txpower : 1~63 power index", extra); +- sprintf(extra, "%s\n [ ant : ,2T ex: AB=3 BC=6 CD=12", extra); +- sprintf(extra, "%s\n [ txmode : < 0 = CONTINUOUS_TX, 1 = PACKET_TX, 2 = SINGLE_TONE_TX, 3 = CARRIER_SUPPRISSION_TX, 4 = SINGLE_CARRIER_TX>\n", extra); ++ extra_len = sprintf(extra, "\n Please input correct format as bleow:\n"); ++ extra_len += sprintf(extra + extra_len, "\t ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d\n", channel, bandwidth, rate, txpower, ant, txmode); ++ extra_len += sprintf(extra + extra_len, "\n [ ch : BGN = <1~14> , A or AC = <36~165> ]"); ++ extra_len += sprintf(extra + extra_len, "\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]"); ++ extra_len += sprintf(extra + extra_len, "\n [ rate : CCK: 1 2 5.5 11M X 2 = < 2 4 11 22 >]"); ++ extra_len += sprintf(extra + extra_len, "\n [ OFDM: 6 9 12 18 24 36 48 54M X 2 = < 12 18 24 36 48 72 96 108>"); ++ extra_len += sprintf(extra + extra_len, "\n [ HT 1S2SS MCS0 ~ MCS15 : < [MCS0]=128 ~ [MCS7]=135 ~ [MCS15]=143 >"); ++ extra_len += sprintf(extra + extra_len, "\n [ HT 3SS MCS16 ~ MCS32 : < [MCS16]=144 ~ [MCS23]=151 ~ [MCS32]=159 >"); ++ extra_len += sprintf(extra + extra_len, "\n [ VHT 1SS MCS0 ~ MCS9 : < [MCS0]=160 ~ [MCS9]=169 >"); ++ extra_len += sprintf(extra + extra_len, "\n [ txpower : 1~63 power index"); ++ extra_len += sprintf(extra + extra_len, "\n [ ant : ,2T ex: AB=3 BC=6 CD=12"); ++ extra_len += sprintf(extra + extra_len, "\n [ txmode : < 0 = CONTINUOUS_TX, 1 = PACKET_TX, 2 = SINGLE_TONE_TX, 3 = CARRIER_SUPPRISSION_TX, 4 = SINGLE_CARRIER_TX>\n"); + wrqu->data.length = strlen(extra); + return status; + + } else { + RTW_INFO("Got format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); ++ extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); + padapter->mppriv.channel = channel; + SetChannel(padapter); + pHalData->current_channel = channel; +@@ -1693,13 +1697,13 @@ int rtw_mp_tx(struct net_device *dev, + bandwidth = CHANNEL_WIDTH_40; + else if (bandwidth == 2) + bandwidth = CHANNEL_WIDTH_80; +- sprintf(extra, "%s\nChange Current Bandwidth %d to Bandwidth %d", extra, padapter->mppriv.bandwidth , bandwidth); ++ extra_len += sprintf(extra + extra_len, "\nChange Current Bandwidth %d to Bandwidth %d", padapter->mppriv.bandwidth , bandwidth); + padapter->mppriv.bandwidth = (u8)bandwidth; + padapter->mppriv.preamble = sg; + SetBandwidth(padapter); + pHalData->current_channel_bw = bandwidth; + +- sprintf(extra, "%s\nSet power level :%d", extra, txpower); ++ extra_len += sprintf(extra + extra_len, "\nSet power level :%d", txpower); + padapter->mppriv.txpoweridx = (u8)txpower; + pMptCtx->TxPwrLevel[ODM_RF_PATH_A] = (u8)txpower; + pMptCtx->TxPwrLevel[ODM_RF_PATH_B] = (u8)txpower; +@@ -1722,13 +1726,13 @@ int rtw_mp_tx(struct net_device *dev, + RTW_INFO("%s: rate index=%d\n", __func__, rate); + if (rate >= MPT_RATE_LAST) + return -EINVAL; +- sprintf(extra, "%s\nSet data rate to %d index %d", extra, padapter->mppriv.rateidx, rate); ++ extra_len += sprintf(extra + extra_len, "\nSet data rate to %d index %d", padapter->mppriv.rateidx, rate); + + padapter->mppriv.rateidx = rate; + pMptCtx->mpt_rate_index = rate; + SetDataRate(padapter); + +- sprintf(extra, "%s\nSet Antenna Path :%d", extra, ant); ++ extra_len += sprintf(extra + extra_len, "\nSet Antenna Path :%d", ant); + switch (ant) { + case 1: + antenna = ANTENNA_A; +@@ -1805,6 +1809,7 @@ int rtw_mp_rx(struct net_device *dev, + struct iw_request_info *info, + union iwreq_data *wrqu, char *extra) + { ++ size_t extra_len; + PADAPTER padapter = rtw_netdev_priv(dev); + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(padapter); + struct mp_priv *pmp_priv = &padapter->mppriv; +@@ -1836,19 +1841,19 @@ int rtw_mp_rx(struct net_device *dev, + } else if (sscanf(extra, "ch=%d,bw=%d,ant=%d", &channel, &bandwidth, &ant) < 3) { + RTW_INFO("Invalid format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "\n Please input correct format as bleow:\n"); +- sprintf(extra, "%s\t ch=%d,bw=%d,ant=%d\n", extra, channel, bandwidth, ant); +- sprintf(extra, "%s\n [ ch : BGN = <1~14> , A or AC = <36~165> ]", extra); +- sprintf(extra, "%s\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]", extra); +- sprintf(extra, "%s\n [ ant : ,2T ex: AB=3 BC=6 CD=12", extra); +- wrqu->data.length = strlen(extra); ++ extra_len = sprintf(extra, "\n Please input correct format as bleow:\n"); ++ extra_len += sprintf(extra + extra_len, "\t ch=%d,bw=%d,ant=%d\n", channel, bandwidth, ant); ++ extra_len += sprintf(extra + extra_len, "\n [ ch : BGN = <1~14> , A or AC = <36~165> ]"); ++ extra_len += sprintf(extra + extra_len, "\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]"); ++ extra_len += sprintf(extra + extra_len, "\n [ ant : ,2T ex: AB=3 BC=6 CD=12"); ++ wrqu->data.length = extra_len; + return 0; + + } else { + bStartRx = 1; + RTW_INFO("Got format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); ++ extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); + padapter->mppriv.channel = channel; + SetChannel(padapter); + pHalData->current_channel = channel; +@@ -1857,13 +1862,13 @@ int rtw_mp_rx(struct net_device *dev, + bandwidth = CHANNEL_WIDTH_40; + else if (bandwidth == 2) + bandwidth = CHANNEL_WIDTH_80; +- sprintf(extra, "%s\nChange Current Bandwidth %d to Bandwidth %d", extra, padapter->mppriv.bandwidth , bandwidth); ++ extra_len += sprintf(extra + extra_len, "\nChange Current Bandwidth %d to Bandwidth %d", padapter->mppriv.bandwidth , bandwidth); + padapter->mppriv.bandwidth = (u8)bandwidth; + padapter->mppriv.preamble = sg; + SetBandwidth(padapter); + pHalData->current_channel_bw = bandwidth; + +- sprintf(extra, "%s\nSet Antenna Path :%d", extra, ant); ++ extra_len += sprintf(extra + extra_len, "\nSet Antenna Path :%d", ant); + switch (ant) { + case 1: + antenna = ANTENNA_A; +@@ -1914,7 +1919,7 @@ int rtw_mp_rx(struct net_device *dev, + pHalData->antenna_tx_path = antenna; + SetAntenna(padapter); + +- sprintf(extra, "%s\nstart Rx", extra); ++ extra_len += sprintf(extra + extra_len, "\nstart Rx"); + SetPacketRx(padapter, bStartRx, _FALSE); + } + wrqu->data.length = strlen(extra); +@@ -1956,6 +1961,7 @@ int rtw_efuse_mask_file(struct net_device *dev, + char *rtw_efuse_mask_file_path; + u8 Status; + PADAPTER padapter = rtw_netdev_priv(dev); ++ size_t extra_len; + + _rtw_memset(maskfileBuffer, 0x00, sizeof(maskfileBuffer)); + +@@ -2006,11 +2012,11 @@ int rtw_efuse_mask_file(struct net_device *dev, + } while (count < 64); + + for (i = 0; i < count; i++) +- sprintf(extra, "%s:%02x", extra, maskfileBuffer[i]); ++ extra_len += sprintf(extra + extra_len, ":%02x", maskfileBuffer[i]); + + padapter->registrypriv.bFileMaskEfuse = _TRUE; + +- sprintf(extra, "%s\nLoad Efuse Mask data %d hex ok\n", extra, count); ++ extra_len += sprintf(extra + extra_len, "\nLoad Efuse Mask data %d hex ok\n", count); + wrqu->data.length = strlen(extra); + return 0; + } +@@ -2388,16 +2394,17 @@ todo: + mptbt_BtControlProcess(padapter, &BtReq); + + if (readtherm == 0) { +- sprintf(extra, "BT thermal="); ++ size_t extra_len = sprintf(extra, "BT thermal="); + for (i = 4; i < pMptCtx->mptOutLen; i++) { + if ((pMptCtx->mptOutBuf[i] == 0x00) && (pMptCtx->mptOutBuf[i + 1] == 0x00)) + goto exit; + +- sprintf(extra, "%s %d ", extra, (pMptCtx->mptOutBuf[i] & 0x1f)); ++ extra_len += sprintf(extra + extra_len, " %d ", (pMptCtx->mptOutBuf[i] & 0x1f)); + } + } else { ++ size_t extra_len = strlen(extra); + for (i = 4; i < pMptCtx->mptOutLen; i++) +- sprintf(extra, "%s 0x%x ", extra, pMptCtx->mptOutBuf[i]); ++ extra_len += sprintf(extra + extra_len, " 0x%x ", pMptCtx->mptOutBuf[i]); + } + + exit: +diff --git a/drivers/net/wireless/rockchip_wlan/rtl8188fu/core/rtw_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8188fu/core/rtw_mp.c +index e1a91cf8be4a..2d0d22790a5d 100644 +--- a/drivers/net/wireless/rockchip_wlan/rtl8188fu/core/rtw_mp.c ++++ b/drivers/net/wireless/rockchip_wlan/rtl8188fu/core/rtw_mp.c +@@ -1906,7 +1906,7 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data) + { + u32 i, psd_pts=0, psd_start=0, psd_stop=0; + u32 psd_data=0; +- ++ size_t data_len = 0; + + #ifdef PLATFORM_LINUX + if (!netif_running(pAdapter->pnetdev)) { +@@ -1938,7 +1938,7 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data) + } else { + psd_data = rtw_GetPSDData(pAdapter, i); + } +- sprintf(data, "%s%x ", data, psd_data); ++ data_len += sprintf(data + data_len, "%x ", psd_data); + i++; + } + +diff --git a/drivers/net/wireless/rockchip_wlan/rtl8188fu/os_dep/linux/ioctl_linux.c b/drivers/net/wireless/rockchip_wlan/rtl8188fu/os_dep/linux/ioctl_linux.c +index fa829ba161f5..dbd1a64f0654 100644 +--- a/drivers/net/wireless/rockchip_wlan/rtl8188fu/os_dep/linux/ioctl_linux.c ++++ b/drivers/net/wireless/rockchip_wlan/rtl8188fu/os_dep/linux/ioctl_linux.c +@@ -9778,6 +9778,7 @@ static int rtw_mp_efuse_get(struct net_device *dev, + #ifdef CONFIG_IOL + u8 org_fw_iol = padapter->registrypriv.fw_iol;// 0:Disable, 1:enable, 2:by usb speed + #endif ++ size_t extra_len; + + wrqu = (struct iw_point*)wdata; + pwrctrlpriv = adapter_to_pwrctl(padapter); +@@ -9838,23 +9839,23 @@ static int rtw_mp_efuse_get(struct net_device *dev, + { + mapLen = EFUSE_MAP_SIZE; + +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < EFUSE_MAP_SIZE; i += 16) + { + // DBG_871X("0x%02x\t", i); +- sprintf(extra, "%s0x%02x\t", extra, i); ++ extra_len += sprintf(extra + extra_len, "0x%02x\t", i); + for (j=0; j<8; j++) { + // DBG_871X("%02X ", data[i+j]); +- sprintf(extra, "%s%02X ", extra, PROMContent[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", PROMContent[i+j]); + } + // DBG_871X("\t"); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j<16; j++) { + // DBG_871X("%02X ", data[i+j]); +- sprintf(extra, "%s%02X ", extra, PROMContent[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", PROMContent[i+j]); + } + // DBG_871X("\n"); +- sprintf(extra,"%s\n",extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + // DBG_871X("\n"); + } +@@ -9869,23 +9870,23 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } + + // DBG_871X("OFFSET\tVALUE(hex)\n"); +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < EFUSE_MAP_SIZE; i += 16) + { + // DBG_871X("0x%02x\t", i); +- sprintf(extra, "%s0x%02x\t", extra, i); ++ extra_len += sprintf(extra + extra_len, "0x%02x\t", i); + for (j=0; j<8; j++) { + // DBG_871X("%02X ", data[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeEfuseInitMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeEfuseInitMap[i+j]); + } + // DBG_871X("\t"); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j<16; j++) { + // DBG_871X("%02X ", data[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeEfuseInitMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeEfuseInitMap[i+j]); + } + // DBG_871X("\n"); +- sprintf(extra,"%s\n",extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + // DBG_871X("\n"); + } +@@ -9928,9 +9929,10 @@ static int rtw_mp_efuse_get(struct net_device *dev, + + // DBG_871X("%s: data={", __FUNCTION__); + *extra = 0; ++ extra_len = 0; + for (i=0; iBTEfuseInitMap[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]); + } + // DBG_871X("\t"); +- sprintf(extra,"%s\t",extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j<16; j++) { + // DBG_871X("%02X ", pEfuseHal->BTEfuseInitMap[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]); + } + // DBG_871X("\n"); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + // DBG_871X("\n"); + } +@@ -10150,24 +10154,24 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } + + // DBG_871X("OFFSET\tVALUE(hex)\n"); +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i=512; i<1024 ; i+=16) + { + // DBG_871X("0x%03x\t", i); +- sprintf(extra, "%s0x%03x\t", extra, i); ++ extra_len += sprintf(extra + extra_len, "0x%03x\t", i); + for (j=0; j<8; j++) + { + // DBG_871X("%02X ", data[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]); + } + // DBG_871X("\t"); +- sprintf(extra,"%s\t",extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j<16; j++) { + // DBG_871X("%02X ", data[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]); + } + // DBG_871X("\n"); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + // DBG_871X("\n"); + } +@@ -10209,11 +10213,12 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } + + *extra = 0; ++ extra_len = 0; + // DBG_871X("%s: bt efuse data={", __FUNCTION__); + for (i=0; ifakeBTEfuseModifiedMap[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); + } + // DBG_871X("\t"); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j<16; j++) { + // DBG_871X("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); + } + // DBG_871X("\n"); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + // DBG_871X("\n"); + } + else if (strcmp(tmp[0],"btbfake") == 0) + { + // DBG_871X("OFFSET\tVALUE(hex)\n"); +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i=512; i<1024; i+=16) + { + // DBG_871X("0x%03x\t", i); +- sprintf(extra, "%s0x%03x\t", extra, i); ++ extra_len += sprintf(extra + extra_len, "0x%03x\t", i); + for (j=0; j<8; j++) { + // DBG_871X("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); + } + // DBG_871X("\t"); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j<16; j++) { + // DBG_871X("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); + } + // DBG_871X("\n"); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + // DBG_871X("\n"); + } + else if (strcmp(tmp[0],"wlrfkmap")== 0) + { + // DBG_871X("OFFSET\tVALUE(hex)\n"); +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i=0; ifakeEfuseModifiedMap[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeEfuseModifiedMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeEfuseModifiedMap[i+j]); + } + // DBG_871X("\t"); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j<16; j++) { + // DBG_871X("%02X ", pEfuseHal->fakeEfuseModifiedMap[i+j]); +- sprintf(extra, "%s %02X", extra, pEfuseHal->fakeEfuseModifiedMap[i+j]); ++ extra_len += sprintf(extra + extra_len, " %02X", pEfuseHal->fakeEfuseModifiedMap[i+j]); + } + // DBG_871X("\n"); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + // DBG_871X("\n"); + +@@ -10311,9 +10316,10 @@ static int rtw_mp_efuse_get(struct net_device *dev, + + // DBG_871X("%s: data={", __FUNCTION__); + *extra = 0; ++ extra_len = 0; + for (i=0; ifakeEfuseModifiedMap[addr+i]); +- sprintf(extra, "%s0x%02X ", extra, pEfuseHal->fakeEfuseModifiedMap[addr+i]); ++ extra_len += sprintf(extra + extra_len, "0x%02X ", pEfuseHal->fakeEfuseModifiedMap[addr+i]); + } + } + else if (strcmp(tmp[0],"btrfkrmap")== 0) +@@ -10339,9 +10345,10 @@ static int rtw_mp_efuse_get(struct net_device *dev, + + // DBG_871X("%s: data={", __FUNCTION__); + *extra = 0; ++ extra_len = 0; + for (i=0; ifakeBTEfuseModifiedMap[addr+i]); +- sprintf(extra, "%s0x%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[addr+i]); ++ extra_len += sprintf(extra + extra_len, "0x%02X ", pEfuseHal->fakeBTEfuseModifiedMap[addr+i]); + } + } + else +diff --git a/drivers/net/wireless/rockchip_wlan/rtl8188fu/os_dep/linux/ioctl_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8188fu/os_dep/linux/ioctl_mp.c +index a3997958572a..11b61af4e8e7 100644 +--- a/drivers/net/wireless/rockchip_wlan/rtl8188fu/os_dep/linux/ioctl_mp.c ++++ b/drivers/net/wireless/rockchip_wlan/rtl8188fu/os_dep/linux/ioctl_mp.c +@@ -198,7 +198,7 @@ int rtw_mp_read_reg(struct net_device *dev, + if (*pnext != '\0') { + /*strtout = simple_strtoul(pnext , &ptmp, 16);*/ + ret = sscanf(pnext, "%x", &strtout); +- sprintf(extra, "%s %d" , extra , strtout); ++ sprintf(extra + strlen(extra), " %d", strtout); + } else + break; + pch = pnext; +@@ -230,7 +230,7 @@ int rtw_mp_read_reg(struct net_device *dev, + pnext++; + if (*pnext != '\0') { + ret = sscanf(pnext, "%x", &strtout); +- sprintf(extra, "%s %d" , extra , strtout); ++ sprintf(extra + strlen(extra), " %d", strtout); + } else + break; + pch = pnext; +@@ -341,20 +341,23 @@ int rtw_mp_read_rf(struct net_device *dev, + pch = tmp; + DBG_871X("pch=%s", pch); + +- while (*pch != '\0') { +- pnext = strpbrk(pch, " "); +- if (!pnext) +- break; +- pnext++; +- if (*pnext != '\0') { +- /*strtou =simple_strtoul(pnext , &ptmp, 16);*/ +- ret = sscanf(pnext, "%x", &strtou); +- sprintf(extra, "%s %d" , extra , strtou); +- } else +- break; +- pch = pnext; ++ { ++ size_t extra_len = strlen(extra); ++ while (*pch != '\0') { ++ pnext = strpbrk(pch, " "); ++ if (!pnext) ++ break; ++ pnext++; ++ if (*pnext != '\0') { ++ /*strtou =simple_strtoul(pnext , &ptmp, 16);*/ ++ ret = sscanf(pnext, "%x", &strtou); ++ extra_len += sprintf(extra + extra_len, " %d", strtou); ++ } else ++ break; ++ pch = pnext; ++ } ++ wrqu->length = extra_len; + } +- wrqu->length = strlen(extra); + + return 0; + } +@@ -1383,7 +1386,7 @@ int rtw_mp_pretx_proc(PADAPTER padapter, u8 bStartTest, char *extra) + pmp_priv->mode = MP_ON; + sprintf(extra, "Stop continuous Tx"); + } else if (pmp_priv->tx.stop == 1) { +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500 count=%u\n", extra, pmp_priv->tx.count); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500 count=%u\n", pmp_priv->tx.count); + pmp_priv->tx.stop = 0; + SetPacketTx(padapter); + } else { +@@ -1392,26 +1395,26 @@ int rtw_mp_pretx_proc(PADAPTER padapter, u8 bStartTest, char *extra) + return 0; + case MP_SINGLE_TONE_TX: + if (bStartTest != 0) +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes."); + SetSingleToneTx(padapter, (u8)bStartTest); + break; + case MP_CONTINUOUS_TX: + if (bStartTest != 0) +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes."); + SetContinuousTx(padapter, (u8)bStartTest); + break; + case MP_CARRIER_SUPPRISSION_TX: + if (bStartTest != 0) { + if (HwRateToMPTRate(pmp_priv->rateidx) <= MPT_RATE_11M) +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes."); + else +- sprintf(extra, "%s\nSpecify carrier suppression but not CCK rate", extra); ++ sprintf(extra + strlen(extra), "\nSpecify carrier suppression but not CCK rate"); + } + SetCarrierSuppressionTx(padapter, (u8)bStartTest); + break; + case MP_SINGLE_CARRIER_TX: + if (bStartTest != 0) +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes."); + SetSingleCarrierTx(padapter, (u8)bStartTest); + break; + +@@ -1463,6 +1466,7 @@ int rtw_mp_tx(struct net_device *dev, + u32 bandwidth = 0, sg = 0, channel = 6, txpower = 40, rate = 108, ant = 0, txmode = 1, count = 0; + u8 i = 0, j = 0, bStartTest = 1, status = 0, Idx = 0, tmpU1B = 0; + u16 antenna = 0; ++ size_t extra_len; + + if (copy_from_user(extra, wrqu->data.pointer, wrqu->data.length)) + return -EFAULT; +@@ -1489,14 +1493,14 @@ int rtw_mp_tx(struct net_device *dev, + return 0; + } else if (strncmp(extra, "setting", 7) == 0) { + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "Current Setting :\n Channel:%d", pmp_priv->channel); +- sprintf(extra, "%s\n Bandwidth:%d", extra, pmp_priv->bandwidth); +- sprintf(extra, "%s\n Rate index:%d", extra, pmp_priv->rateidx); +- sprintf(extra, "%s\n TxPower index:%d", extra, pmp_priv->txpoweridx); +- sprintf(extra, "%s\n Antenna TxPath:%d", extra, pmp_priv->antenna_tx); +- sprintf(extra, "%s\n Antenna RxPath:%d", extra, pmp_priv->antenna_rx); +- sprintf(extra, "%s\n MP Mode:%d", extra, pmp_priv->mode); +- wrqu->data.length = strlen(extra); ++ extra_len = sprintf(extra, "Current Setting :\n Channel:%d", pmp_priv->channel); ++ extra_len += sprintf(extra + extra_len, "\n Bandwidth:%d", pmp_priv->bandwidth); ++ extra_len += sprintf(extra + extra_len, "\n Rate index:%d", pmp_priv->rateidx); ++ extra_len += sprintf(extra + extra_len, "\n TxPower index:%d", pmp_priv->txpoweridx); ++ extra_len += sprintf(extra + extra_len, "\n Antenna TxPath:%d", pmp_priv->antenna_tx); ++ extra_len += sprintf(extra + extra_len, "\n Antenna RxPath:%d", pmp_priv->antenna_rx); ++ extra_len += sprintf(extra + extra_len, "\n MP Mode:%d", pmp_priv->mode); ++ wrqu->data.length = extra_len; + return 0; + #ifdef CONFIG_MP_VHT_HW_TX_MODE + } else if (strncmp(extra, "pmact", 5) == 0) { +@@ -1633,25 +1637,25 @@ int rtw_mp_tx(struct net_device *dev, + if (sscanf(extra, "ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d", &channel, &bandwidth, &rate, &txpower, &ant, &txmode) < 6) { + DBG_871X("Invalid format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "\n Please input correct format as bleow:\n"); +- sprintf(extra, "%s\t ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d\n", extra, channel, bandwidth, rate, txpower, ant, txmode); +- sprintf(extra, "%s\n [ ch : BGN = <1~14> , A or AC = <36~165> ]", extra); +- sprintf(extra, "%s\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]", extra); +- sprintf(extra, "%s\n [ rate : CCK: 1 2 5.5 11M X 2 = < 2 4 11 22 >]", extra); +- sprintf(extra, "%s\n [ OFDM: 6 9 12 18 24 36 48 54M X 2 = < 12 18 24 36 48 72 96 108>", extra); +- sprintf(extra, "%s\n [ HT 1S2SS MCS0 ~ MCS15 : < [MCS0]=128 ~ [MCS7]=135 ~ [MCS15]=143 >", extra); +- sprintf(extra, "%s\n [ HT 3SS MCS16 ~ MCS32 : < [MCS16]=144 ~ [MCS23]=151 ~ [MCS32]=159 >", extra); +- sprintf(extra, "%s\n [ VHT 1SS MCS0 ~ MCS9 : < [MCS0]=160 ~ [MCS9]=169 >", extra); +- sprintf(extra, "%s\n [ txpower : 1~63 power index", extra); +- sprintf(extra, "%s\n [ ant : ,2T ex: AB=3 BC=6 CD=12", extra); +- sprintf(extra, "%s\n [ txmode : < 0 = CONTINUOUS_TX, 1 = PACKET_TX, 2 = SINGLE_TONE_TX, 3 = CARRIER_SUPPRISSION_TX, 4 = SINGLE_CARRIER_TX>\n", extra); +- wrqu->data.length = strlen(extra); ++ extra_len = sprintf(extra, "\n Please input correct format as bleow:\n"); ++ extra_len += sprintf(extra + extra_len, "\t ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d\n", channel, bandwidth, rate, txpower, ant, txmode); ++ extra_len += sprintf(extra + extra_len, "\n [ ch : BGN = <1~14> , A or AC = <36~165> ]"); ++ extra_len += sprintf(extra + extra_len, "\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]"); ++ extra_len += sprintf(extra + extra_len, "\n [ rate : CCK: 1 2 5.5 11M X 2 = < 2 4 11 22 >]"); ++ extra_len += sprintf(extra + extra_len, "\n [ OFDM: 6 9 12 18 24 36 48 54M X 2 = < 12 18 24 36 48 72 96 108>"); ++ extra_len += sprintf(extra + extra_len, "\n [ HT 1S2SS MCS0 ~ MCS15 : < [MCS0]=128 ~ [MCS7]=135 ~ [MCS15]=143 >"); ++ extra_len += sprintf(extra + extra_len, "\n [ HT 3SS MCS16 ~ MCS32 : < [MCS16]=144 ~ [MCS23]=151 ~ [MCS32]=159 >"); ++ extra_len += sprintf(extra + extra_len, "\n [ VHT 1SS MCS0 ~ MCS9 : < [MCS0]=160 ~ [MCS9]=169 >"); ++ extra_len += sprintf(extra + extra_len, "\n [ txpower : 1~63 power index"); ++ extra_len += sprintf(extra + extra_len, "\n [ ant : ,2T ex: AB=3 BC=6 CD=12"); ++ extra_len += sprintf(extra + extra_len, "\n [ txmode : < 0 = CONTINUOUS_TX, 1 = PACKET_TX, 2 = SINGLE_TONE_TX, 3 = CARRIER_SUPPRISSION_TX, 4 = SINGLE_CARRIER_TX>\n"); ++ wrqu->data.length = extra_len; + return status; + + } else { + DBG_871X("Got format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); ++ extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); + padapter->mppriv.channel = channel; + SetChannel(padapter); + pHalData->CurrentChannel = channel; +@@ -1660,13 +1664,13 @@ int rtw_mp_tx(struct net_device *dev, + bandwidth = CHANNEL_WIDTH_40; + else if (bandwidth == 2) + bandwidth = CHANNEL_WIDTH_80; +- sprintf(extra, "%s\nChange Current Bandwidth %d to Bandwidth %d", extra, padapter->mppriv.bandwidth , bandwidth); ++ extra_len += sprintf(extra + extra_len, "\nChange Current Bandwidth %d to Bandwidth %d", padapter->mppriv.bandwidth , bandwidth); + padapter->mppriv.bandwidth = (u8)bandwidth; + padapter->mppriv.preamble = sg; + SetBandwidth(padapter); + pHalData->CurrentChannelBW = bandwidth; + +- sprintf(extra, "%s\nSet power level :%d", extra, txpower); ++ extra_len += sprintf(extra + extra_len, "\nSet power level :%d", txpower); + padapter->mppriv.txpoweridx = (u8)txpower; + pMptCtx->TxPwrLevel[ODM_RF_PATH_A] = (u8)txpower; + pMptCtx->TxPwrLevel[ODM_RF_PATH_B] = (u8)txpower; +@@ -1689,13 +1693,13 @@ int rtw_mp_tx(struct net_device *dev, + DBG_871X("%s: rate index=%d\n", __func__, rate); + if (rate >= MPT_RATE_LAST) + return -EINVAL; +- sprintf(extra, "%s\nSet data rate to %d index %d", extra, padapter->mppriv.rateidx, rate); ++ extra_len += sprintf(extra + extra_len, "\nSet data rate to %d index %d", padapter->mppriv.rateidx, rate); + + padapter->mppriv.rateidx = rate; + pMptCtx->MptRateIndex = rate; + SetDataRate(padapter); + +- sprintf(extra, "%s\nSet Antenna Path :%d", extra, ant); ++ extra_len += sprintf(extra + extra_len, "\nSet Antenna Path :%d", ant); + switch (ant) { + case 1: + antenna = ANTENNA_A; +@@ -1781,6 +1785,7 @@ int rtw_mp_rx(struct net_device *dev, + u32 bandwidth = 0, sg = 0, channel = 6, ant = 0; + u16 antenna = 0; + u8 bStartRx = 0; ++ size_t extra_len; + + if (copy_from_user(extra, wrqu->data.pointer, wrqu->data.length)) + return -EFAULT; +@@ -1804,19 +1809,19 @@ int rtw_mp_rx(struct net_device *dev, + } else if (sscanf(extra, "ch=%d,bw=%d,ant=%d", &channel, &bandwidth, &ant) < 3) { + DBG_871X("Invalid format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "\n Please input correct format as bleow:\n"); +- sprintf(extra, "%s\t ch=%d,bw=%d,ant=%d\n", extra, channel, bandwidth, ant); +- sprintf(extra, "%s\n [ ch : BGN = <1~14> , A or AC = <36~165> ]", extra); +- sprintf(extra, "%s\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]", extra); +- sprintf(extra, "%s\n [ ant : ,2T ex: AB=3 BC=6 CD=12", extra); +- wrqu->data.length = strlen(extra); ++ extra_len = sprintf(extra, "\n Please input correct format as bleow:\n"); ++ extra_len += sprintf(extra + extra_len, "\t ch=%d,bw=%d,ant=%d\n", channel, bandwidth, ant); ++ extra_len += sprintf(extra + extra_len, "\n [ ch : BGN = <1~14> , A or AC = <36~165> ]"); ++ extra_len += sprintf(extra + extra_len, "\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]"); ++ extra_len += sprintf(extra + extra_len, "\n [ ant : ,2T ex: AB=3 BC=6 CD=12"); ++ wrqu->data.length = extra_len; + return 0; + + } else { + bStartRx = 1; + DBG_871X("Got format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); ++ extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); + padapter->mppriv.channel = channel; + SetChannel(padapter); + pHalData->CurrentChannel = channel; +@@ -1825,13 +1830,13 @@ int rtw_mp_rx(struct net_device *dev, + bandwidth = CHANNEL_WIDTH_40; + else if (bandwidth == 2) + bandwidth = CHANNEL_WIDTH_80; +- sprintf(extra, "%s\nChange Current Bandwidth %d to Bandwidth %d", extra, padapter->mppriv.bandwidth , bandwidth); ++ extra_len += sprintf(extra + extra_len, "\nChange Current Bandwidth %d to Bandwidth %d", padapter->mppriv.bandwidth , bandwidth); + padapter->mppriv.bandwidth = (u8)bandwidth; + padapter->mppriv.preamble = sg; + SetBandwidth(padapter); + pHalData->CurrentChannelBW = bandwidth; + +- sprintf(extra, "%s\nSet Antenna Path :%d", extra, ant); ++ extra_len += sprintf(extra + extra_len, "\nSet Antenna Path :%d", ant); + switch (ant) { + case 1: + antenna = ANTENNA_A; +@@ -1882,7 +1887,7 @@ int rtw_mp_rx(struct net_device *dev, + pHalData->AntennaTxPath = antenna; + SetAntenna(padapter); + +- sprintf(extra, "%s\nstart Rx", extra); ++ extra_len += sprintf(extra + extra_len, "\nstart Rx"); + SetPacketRx(padapter, bStartRx, _FALSE); + } + wrqu->data.length = strlen(extra); +@@ -2310,16 +2315,17 @@ todo: + mptbt_BtControlProcess(padapter, &BtReq); + + if (readtherm == 0) { +- sprintf(extra, "BT thermal="); ++ size_t extra_len = sprintf(extra, "BT thermal="); + for (i = 4; i < pMptCtx->mptOutLen; i++) { + if ((pMptCtx->mptOutBuf[i] == 0x00) && (pMptCtx->mptOutBuf[i + 1] == 0x00)) + goto exit; + +- sprintf(extra, "%s %d ", extra, (pMptCtx->mptOutBuf[i] & 0x1f)); ++ extra_len += sprintf(extra + extra_len, " %d ", (pMptCtx->mptOutBuf[i] & 0x1f)); + } + } else { ++ size_t extra_len = strlen(extra); + for (i = 4; i < pMptCtx->mptOutLen; i++) +- sprintf(extra, "%s 0x%x ", extra, pMptCtx->mptOutBuf[i]); ++ extra_len += sprintf(extra + extra_len, " 0x%x ", pMptCtx->mptOutBuf[i]); + } + + exit: +diff --git a/drivers/net/wireless/rockchip_wlan/rtl8189es/core/rtw_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8189es/core/rtw_mp.c +index b7b7da5889e0..0fe9b0a1cdc0 100644 +--- a/drivers/net/wireless/rockchip_wlan/rtl8189es/core/rtw_mp.c ++++ b/drivers/net/wireless/rockchip_wlan/rtl8189es/core/rtw_mp.c +@@ -1912,7 +1912,7 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data) + { + u32 i, psd_pts=0, psd_start=0, psd_stop=0; + u32 psd_data=0; +- ++ size_t data_len = 0; + + #ifdef PLATFORM_LINUX + if (!netif_running(pAdapter->pnetdev)) { +@@ -1944,7 +1944,7 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data) + } else { + psd_data = rtw_GetPSDData(pAdapter, i); + } +- sprintf(data, "%s%x ", data, psd_data); ++ data_len += sprintf(data + data_len, "%x ", psd_data); + i++; + } + +diff --git a/drivers/net/wireless/rockchip_wlan/rtl8189es/os_dep/linux/ioctl_linux.c b/drivers/net/wireless/rockchip_wlan/rtl8189es/os_dep/linux/ioctl_linux.c +index b260fab148ea..7d1aff77979b 100644 +--- a/drivers/net/wireless/rockchip_wlan/rtl8189es/os_dep/linux/ioctl_linux.c ++++ b/drivers/net/wireless/rockchip_wlan/rtl8189es/os_dep/linux/ioctl_linux.c +@@ -9876,6 +9876,7 @@ static int rtw_mp_efuse_get(struct net_device *dev, + #ifdef CONFIG_IOL + u8 org_fw_iol = padapter->registrypriv.fw_iol;// 0:Disable, 1:enable, 2:by usb speed + #endif ++ size_t extra_len; + + wrqu = (struct iw_point*)wdata; + pwrctrlpriv = adapter_to_pwrctl(padapter); +@@ -9936,23 +9937,23 @@ static int rtw_mp_efuse_get(struct net_device *dev, + { + mapLen = EFUSE_MAP_SIZE; + +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < EFUSE_MAP_SIZE; i += 16) + { + // DBG_871X("0x%02x\t", i); +- sprintf(extra, "%s0x%02x\t", extra, i); ++ extra_len += sprintf(extra + extra_len, "0x%02x\t", i); + for (j=0; j<8; j++) { + // DBG_871X("%02X ", data[i+j]); +- sprintf(extra, "%s%02X ", extra, PROMContent[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", PROMContent[i+j]); + } + // DBG_871X("\t"); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j<16; j++) { + // DBG_871X("%02X ", data[i+j]); +- sprintf(extra, "%s%02X ", extra, PROMContent[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", PROMContent[i+j]); + } + // DBG_871X("\n"); +- sprintf(extra,"%s\n",extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + // DBG_871X("\n"); + } +@@ -9994,18 +9995,18 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } else + order = 0; + +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < cnt; i += 16) { +- sprintf(extra, "%s0x%02x\t", extra, shift + i); ++ extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i); + for (j = 0; j < 8; j++) +- sprintf(extra, "%s%02X ", extra, efuse[i+j]); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", efuse[i+j]); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j < 16; j++) +- sprintf(extra, "%s%02X ", extra, efuse[i+j]); +- sprintf(extra,"%s\n",extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", efuse[i+j]); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + if ((shift + cnt) < mapLen) +- sprintf(extra, "%s\t...more\n", extra); ++ extra_len += sprintf(extra + extra_len, "\t...more\n"); + } + else if (strcmp(tmp[0], "rmap") == 0) + { +@@ -10046,9 +10047,10 @@ static int rtw_mp_efuse_get(struct net_device *dev, + + // DBG_871X("%s: data={", __FUNCTION__); + *extra = 0; ++ extra_len = 0; + for (i=0; iBTEfuseInitMap[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]); + } + // DBG_871X("\t"); +- sprintf(extra,"%s\t",extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j<16; j++) { + // DBG_871X("%02X ", pEfuseHal->BTEfuseInitMap[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]); + } + // DBG_871X("\n"); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + // DBG_871X("\n"); + } +@@ -10259,24 +10263,24 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } + + // DBG_871X("OFFSET\tVALUE(hex)\n"); +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i=512; i<1024 ; i+=16) + { + // DBG_871X("0x%03x\t", i); +- sprintf(extra, "%s0x%03x\t", extra, i); ++ extra_len += sprintf(extra + extra_len, "0x%03x\t", i); + for (j=0; j<8; j++) + { + // DBG_871X("%02X ", data[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]); + } + // DBG_871X("\t"); +- sprintf(extra,"%s\t",extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j<16; j++) { + // DBG_871X("%02X ", data[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]); + } + // DBG_871X("\n"); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + // DBG_871X("\n"); + } +@@ -10318,11 +10322,12 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } + + *extra = 0; ++ extra_len = 0; + // DBG_871X("%s: bt efuse data={", __FUNCTION__); + for (i=0; ifakeBTEfuseModifiedMap[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); + } + // DBG_871X("\t"); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j<16; j++) { + // DBG_871X("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); + } + // DBG_871X("\n"); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + // DBG_871X("\n"); + } + else if (strcmp(tmp[0],"btbfake") == 0) + { + // DBG_871X("OFFSET\tVALUE(hex)\n"); +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i=512; i<1024; i+=16) + { + // DBG_871X("0x%03x\t", i); +- sprintf(extra, "%s0x%03x\t", extra, i); ++ extra_len += sprintf(extra + extra_len, "0x%03x\t", i); + for (j=0; j<8; j++) { + // DBG_871X("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); + } + // DBG_871X("\t"); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j<16; j++) { + // DBG_871X("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); + } + // DBG_871X("\n"); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + // DBG_871X("\n"); + } + else if (strcmp(tmp[0],"wlrfkmap")== 0) + { + // DBG_871X("OFFSET\tVALUE(hex)\n"); +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i=0; ifakeEfuseModifiedMap[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeEfuseModifiedMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeEfuseModifiedMap[i+j]); + } + // DBG_871X("\t"); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j<16; j++) { + // DBG_871X("%02X ", pEfuseHal->fakeEfuseModifiedMap[i+j]); +- sprintf(extra, "%s %02X", extra, pEfuseHal->fakeEfuseModifiedMap[i+j]); ++ extra_len += sprintf(extra + extra_len, " %02X", pEfuseHal->fakeEfuseModifiedMap[i+j]); + } + // DBG_871X("\n"); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + // DBG_871X("\n"); + +@@ -10420,9 +10425,10 @@ static int rtw_mp_efuse_get(struct net_device *dev, + + // DBG_871X("%s: data={", __FUNCTION__); + *extra = 0; ++ extra_len = 0; + for (i=0; ifakeEfuseModifiedMap[addr+i]); +- sprintf(extra, "%s0x%02X ", extra, pEfuseHal->fakeEfuseModifiedMap[addr+i]); ++ extra_len += sprintf(extra + extra_len, "0x%02X ", pEfuseHal->fakeEfuseModifiedMap[addr+i]); + } + } + else if (strcmp(tmp[0],"btrfkrmap")== 0) +@@ -10448,9 +10454,10 @@ static int rtw_mp_efuse_get(struct net_device *dev, + + // DBG_871X("%s: data={", __FUNCTION__); + *extra = 0; ++ extra_len = 0; + for (i=0; ifakeBTEfuseModifiedMap[addr+i]); +- sprintf(extra, "%s0x%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[addr+i]); ++ extra_len += sprintf(extra + extra_len, "0x%02X ", pEfuseHal->fakeBTEfuseModifiedMap[addr+i]); + } + } + else +diff --git a/drivers/net/wireless/rockchip_wlan/rtl8189es/os_dep/linux/ioctl_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8189es/os_dep/linux/ioctl_mp.c +index 08aa41a2525c..46442d16b0a7 100644 +--- a/drivers/net/wireless/rockchip_wlan/rtl8189es/os_dep/linux/ioctl_mp.c ++++ b/drivers/net/wireless/rockchip_wlan/rtl8189es/os_dep/linux/ioctl_mp.c +@@ -197,7 +197,7 @@ int rtw_mp_read_reg(struct net_device *dev, + if (*pnext != '\0') { + /*strtout = simple_strtoul(pnext , &ptmp, 16);*/ + ret = sscanf(pnext, "%x", &strtout); +- sprintf(extra, "%s %d" , extra , strtout); ++ sprintf(extra + strlen(extra), " %d", strtout); + } else + break; + pch = pnext; +@@ -229,7 +229,7 @@ int rtw_mp_read_reg(struct net_device *dev, + pnext++; + if (*pnext != '\0') { + ret = sscanf(pnext, "%x", &strtout); +- sprintf(extra, "%s %d" , extra , strtout); ++ sprintf(extra + strlen(extra), " %d", strtout); + } else + break; + pch = pnext; +@@ -340,20 +340,23 @@ int rtw_mp_read_rf(struct net_device *dev, + pch = tmp; + DBG_871X("pch=%s", pch); + +- while (*pch != '\0') { +- pnext = strpbrk(pch, " "); +- if (!pnext) +- break; +- pnext++; +- if (*pnext != '\0') { +- /*strtou =simple_strtoul(pnext , &ptmp, 16);*/ +- ret = sscanf(pnext, "%x", &strtou); +- sprintf(extra, "%s %d" , extra , strtou); +- } else +- break; +- pch = pnext; ++ { ++ size_t extra_len = strlen(extra); ++ while (*pch != '\0') { ++ pnext = strpbrk(pch, " "); ++ if (!pnext) ++ break; ++ pnext++; ++ if (*pnext != '\0') { ++ /*strtou =simple_strtoul(pnext , &ptmp, 16);*/ ++ ret = sscanf(pnext, "%x", &strtou); ++ extra_len += sprintf(extra + extra_len, " %d", strtou); ++ } else ++ break; ++ pch = pnext; ++ } ++ wrqu->length = extra_len; + } +- wrqu->length = strlen(extra); + + return 0; + } +@@ -1366,7 +1369,7 @@ int rtw_mp_pretx_proc(PADAPTER padapter, u8 bStartTest, char *extra) + pmp_priv->mode = MP_ON; + sprintf(extra, "Stop continuous Tx"); + } else if (pmp_priv->tx.stop == 1) { +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500 count=%u\n", extra, pmp_priv->tx.count); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500 count=%u\n", pmp_priv->tx.count); + pmp_priv->tx.stop = 0; + SetPacketTx(padapter); + } else { +@@ -1375,26 +1378,26 @@ int rtw_mp_pretx_proc(PADAPTER padapter, u8 bStartTest, char *extra) + return 0; + case MP_SINGLE_TONE_TX: + if (bStartTest != 0) +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes."); + SetSingleToneTx(padapter, (u8)bStartTest); + break; + case MP_CONTINUOUS_TX: + if (bStartTest != 0) +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes."); + SetContinuousTx(padapter, (u8)bStartTest); + break; + case MP_CARRIER_SUPPRISSION_TX: + if (bStartTest != 0) { + if (pmp_priv->rateidx <= MPT_RATE_11M) +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes."); + else +- sprintf(extra, "%s\nSpecify carrier suppression but not CCK rate", extra); ++ sprintf(extra + strlen(extra), "\nSpecify carrier suppression but not CCK rate"); + } + SetCarrierSuppressionTx(padapter, (u8)bStartTest); + break; + case MP_SINGLE_CARRIER_TX: + if (bStartTest != 0) +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes."); + SetSingleCarrierTx(padapter, (u8)bStartTest); + break; + +@@ -1445,6 +1448,7 @@ int rtw_mp_tx(struct net_device *dev, + u32 bandwidth = 0, sg = 0, channel = 6, txpower = 40, rate = 108, ant = 0, txmode = 1, count = 0; + u8 i = 0, j = 0, bStartTest = 1, status = 0; + u16 antenna = 0; ++ size_t extra_len; + + if (copy_from_user(extra, wrqu->data.pointer, wrqu->data.length)) + return -EFAULT; +@@ -1464,39 +1468,39 @@ int rtw_mp_tx(struct net_device *dev, + return 0; + } else if (strncmp(extra, "setting", 5) == 0) { + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "Current Setting :\n Channel:%d", pmp_priv->channel); +- sprintf(extra, "%s\n Bandwidth:%d", extra, pmp_priv->bandwidth); +- sprintf(extra, "%s\n Rate index:%d", extra, pmp_priv->rateidx); +- sprintf(extra, "%s\n TxPower index:%d", extra, pmp_priv->txpoweridx); +- sprintf(extra, "%s\n Antenna TxPath:%d", extra, pmp_priv->antenna_tx); +- sprintf(extra, "%s\n Antenna RxPath:%d", extra, pmp_priv->antenna_rx); +- sprintf(extra, "%s\n MP Mode:%d", extra, pmp_priv->mode); +- wrqu->data.length = strlen(extra); ++ extra_len = sprintf(extra, "Current Setting :\n Channel:%d", pmp_priv->channel); ++ extra_len += sprintf(extra + extra_len, "\n Bandwidth:%d", pmp_priv->bandwidth); ++ extra_len += sprintf(extra + extra_len, "\n Rate index:%d", pmp_priv->rateidx); ++ extra_len += sprintf(extra + extra_len, "\n TxPower index:%d", pmp_priv->txpoweridx); ++ extra_len += sprintf(extra + extra_len, "\n Antenna TxPath:%d", pmp_priv->antenna_tx); ++ extra_len += sprintf(extra + extra_len, "\n Antenna RxPath:%d", pmp_priv->antenna_rx); ++ extra_len += sprintf(extra + extra_len, "\n MP Mode:%d", pmp_priv->mode); ++ wrqu->data.length = extra_len; + return 0; + } else { + + if (sscanf(extra, "ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d", &channel, &bandwidth, &rate, &txpower, &ant, &txmode) < 6) { + DBG_871X("Invalid format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "\n Please input correct format as bleow:\n"); +- sprintf(extra, "%s\t ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d\n", extra, channel, bandwidth, rate, txpower, ant, txmode); +- sprintf(extra, "%s\n [ ch : BGN = <1~14> , A or AC = <36~165> ]", extra); +- sprintf(extra, "%s\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]", extra); +- sprintf(extra, "%s\n [ rate : CCK: 1 2 5.5 11M X 2 = < 2 4 11 22 >]", extra); +- sprintf(extra, "%s\n [ OFDM: 6 9 12 18 24 36 48 54M X 2 = < 12 18 24 36 48 72 96 108>", extra); +- sprintf(extra, "%s\n [ HT 1S2SS MCS0 ~ MCS15 : < [MCS0]=128 ~ [MCS7]=135 ~ [MCS15]=143 >", extra); +- sprintf(extra, "%s\n [ HT 3SS MCS16 ~ MCS32 : < [MCS16]=144 ~ [MCS23]=151 ~ [MCS32]=159 >", extra); +- sprintf(extra, "%s\n [ VHT 1SS MCS0 ~ MCS9 : < [MCS0]=160 ~ [MCS9]=169 >", extra); +- sprintf(extra, "%s\n [ txpower : 1~63 power index", extra); +- sprintf(extra, "%s\n [ ant : ,2T ex: AB=3 BC=6 CD=12", extra); +- sprintf(extra, "%s\n [ txmode : < 0 = CONTINUOUS_TX, 1 = PACKET_TX, 2 = SINGLE_TONE_TX, 3 = CARRIER_SUPPRISSION_TX, 4 = SINGLE_CARRIER_TX>\n", extra); +- wrqu->data.length = strlen(extra); ++ extra_len = sprintf(extra, "\n Please input correct format as bleow:\n"); ++ extra_len += sprintf(extra + extra_len, "\t ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d\n", channel, bandwidth, rate, txpower, ant, txmode); ++ extra_len += sprintf(extra + extra_len, "\n [ ch : BGN = <1~14> , A or AC = <36~165> ]"); ++ extra_len += sprintf(extra + extra_len, "\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]"); ++ extra_len += sprintf(extra + extra_len, "\n [ rate : CCK: 1 2 5.5 11M X 2 = < 2 4 11 22 >]"); ++ extra_len += sprintf(extra + extra_len, "\n [ OFDM: 6 9 12 18 24 36 48 54M X 2 = < 12 18 24 36 48 72 96 108>"); ++ extra_len += sprintf(extra + extra_len, "\n [ HT 1S2SS MCS0 ~ MCS15 : < [MCS0]=128 ~ [MCS7]=135 ~ [MCS15]=143 >"); ++ extra_len += sprintf(extra + extra_len, "\n [ HT 3SS MCS16 ~ MCS32 : < [MCS16]=144 ~ [MCS23]=151 ~ [MCS32]=159 >"); ++ extra_len += sprintf(extra + extra_len, "\n [ VHT 1SS MCS0 ~ MCS9 : < [MCS0]=160 ~ [MCS9]=169 >"); ++ extra_len += sprintf(extra + extra_len, "\n [ txpower : 1~63 power index"); ++ extra_len += sprintf(extra + extra_len, "\n [ ant : ,2T ex: AB=3 BC=6 CD=12"); ++ extra_len += sprintf(extra + extra_len, "\n [ txmode : < 0 = CONTINUOUS_TX, 1 = PACKET_TX, 2 = SINGLE_TONE_TX, 3 = CARRIER_SUPPRISSION_TX, 4 = SINGLE_CARRIER_TX>\n"); ++ wrqu->data.length = extra_len; + return status; + + } else { + DBG_871X("Got format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); ++ extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); + padapter->mppriv.channel = channel; + SetChannel(padapter); + pHalData->CurrentChannel = channel; +@@ -1505,13 +1509,13 @@ int rtw_mp_tx(struct net_device *dev, + bandwidth = CHANNEL_WIDTH_40; + else if (bandwidth == 2) + bandwidth = CHANNEL_WIDTH_80; +- sprintf(extra, "%s\nChange Current Bandwidth %d to Bandwidth %d", extra, padapter->mppriv.bandwidth , bandwidth); ++ extra_len += sprintf(extra + extra_len, "\nChange Current Bandwidth %d to Bandwidth %d", padapter->mppriv.bandwidth , bandwidth); + padapter->mppriv.bandwidth = (u8)bandwidth; + padapter->mppriv.preamble = sg; + SetBandwidth(padapter); + pHalData->CurrentChannelBW = bandwidth; + +- sprintf(extra, "%s\nSet power level :%d", extra, txpower); ++ extra_len += sprintf(extra + extra_len, "\nSet power level :%d", txpower); + padapter->mppriv.txpoweridx = (u8)txpower; + pMptCtx->TxPwrLevel[ODM_RF_PATH_A] = (u8)txpower; + pMptCtx->TxPwrLevel[ODM_RF_PATH_B] = (u8)txpower; +@@ -1534,13 +1538,13 @@ int rtw_mp_tx(struct net_device *dev, + DBG_871X("%s: rate index=%d\n", __func__, rate); + if (rate >= MPT_RATE_LAST) + return -EINVAL; +- sprintf(extra, "%s\nSet data rate to %d index %d", extra, padapter->mppriv.rateidx, rate); ++ extra_len += sprintf(extra + extra_len, "\nSet data rate to %d index %d", padapter->mppriv.rateidx, rate); + + padapter->mppriv.rateidx = rate; + pMptCtx->MptRateIndex = rate; + SetDataRate(padapter); + +- sprintf(extra, "%s\nSet Antenna Path :%d", extra, ant); ++ extra_len += sprintf(extra + extra_len, "\nSet Antenna Path :%d", ant); + switch (ant) { + case 1: + antenna = ANTENNA_A; +@@ -1626,6 +1630,7 @@ int rtw_mp_rx(struct net_device *dev, + u32 bandwidth = 0, sg = 0, channel = 6, ant = 0; + u16 antenna = 0; + u8 bStartRx = 0; ++ size_t extra_len; + + if (copy_from_user(extra, wrqu->data.pointer, wrqu->data.length)) + return -EFAULT; +@@ -1641,19 +1646,19 @@ int rtw_mp_rx(struct net_device *dev, + } else if (sscanf(extra, "ch=%d,bw=%d,ant=%d", &channel, &bandwidth, &ant) < 3) { + DBG_871X("Invalid format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "\n Please input correct format as bleow:\n"); +- sprintf(extra, "%s\t ch=%d,bw=%d,ant=%d\n", extra, channel, bandwidth, ant); +- sprintf(extra, "%s\n [ ch : BGN = <1~14> , A or AC = <36~165> ]", extra); +- sprintf(extra, "%s\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]", extra); +- sprintf(extra, "%s\n [ ant : ,2T ex: AB=3 BC=6 CD=12", extra); +- wrqu->data.length = strlen(extra); ++ extra_len = sprintf(extra, "\n Please input correct format as bleow:\n"); ++ extra_len += sprintf(extra + extra_len, "\t ch=%d,bw=%d,ant=%d\n", channel, bandwidth, ant); ++ extra_len += sprintf(extra + extra_len, "\n [ ch : BGN = <1~14> , A or AC = <36~165> ]"); ++ extra_len += sprintf(extra + extra_len, "\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]"); ++ extra_len += sprintf(extra + extra_len, "\n [ ant : ,2T ex: AB=3 BC=6 CD=12"); ++ wrqu->data.length = extra_len; + return 0; + + } else { + bStartRx = 1; + DBG_871X("Got format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); ++ extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); + padapter->mppriv.channel = channel; + SetChannel(padapter); + pHalData->CurrentChannel = channel; +@@ -1662,13 +1667,13 @@ int rtw_mp_rx(struct net_device *dev, + bandwidth = CHANNEL_WIDTH_40; + else if (bandwidth == 2) + bandwidth = CHANNEL_WIDTH_80; +- sprintf(extra, "%s\nChange Current Bandwidth %d to Bandwidth %d", extra, padapter->mppriv.bandwidth , bandwidth); ++ extra_len += sprintf(extra + extra_len, "\nChange Current Bandwidth %d to Bandwidth %d", padapter->mppriv.bandwidth , bandwidth); + padapter->mppriv.bandwidth = (u8)bandwidth; + padapter->mppriv.preamble = sg; + SetBandwidth(padapter); + pHalData->CurrentChannelBW = bandwidth; + +- sprintf(extra, "%s\nSet Antenna Path :%d", extra, ant); ++ extra_len += sprintf(extra + extra_len, "\nSet Antenna Path :%d", ant); + switch (ant) { + case 1: + antenna = ANTENNA_A; +@@ -1719,7 +1724,7 @@ int rtw_mp_rx(struct net_device *dev, + pHalData->AntennaTxPath = antenna; + SetAntenna(padapter); + +- sprintf(extra, "%s\nstart Rx", extra); ++ extra_len += sprintf(extra + extra_len, "\nstart Rx"); + SetPacketRx(padapter, bStartRx, _FALSE); + } + wrqu->data.length = strlen(extra); +@@ -2147,16 +2152,17 @@ todo: + mptbt_BtControlProcess(padapter, &BtReq); + + if (readtherm == 0) { +- sprintf(extra, "BT thermal="); ++ size_t extra_len = sprintf(extra, "BT thermal="); + for (i = 4; i < pMptCtx->mptOutLen; i++) { + if ((pMptCtx->mptOutBuf[i] == 0x00) && (pMptCtx->mptOutBuf[i + 1] == 0x00)) + goto exit; + +- sprintf(extra, "%s %d ", extra, (pMptCtx->mptOutBuf[i] & 0x1f)); ++ extra_len += sprintf(extra + extra_len, " %d ", (pMptCtx->mptOutBuf[i] & 0x1f)); + } + } else { ++ size_t extra_len = strlen(extra); + for (i = 4; i < pMptCtx->mptOutLen; i++) +- sprintf(extra, "%s 0x%x ", extra, pMptCtx->mptOutBuf[i]); ++ extra_len += sprintf(extra + extra_len, " 0x%x ", pMptCtx->mptOutBuf[i]); + } + + exit: +diff --git a/drivers/net/wireless/rockchip_wlan/rtl8189fs/core/rtw_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8189fs/core/rtw_mp.c +index ed3b7338f3bf..9c8d4509a2df 100644 +--- a/drivers/net/wireless/rockchip_wlan/rtl8189fs/core/rtw_mp.c ++++ b/drivers/net/wireless/rockchip_wlan/rtl8189fs/core/rtw_mp.c +@@ -2170,14 +2170,17 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data) + + data[0] = '\0'; + +- i = psd_start; +- while (i < psd_stop) { +- if (i >= psd_pts) +- psd_data = rtw_GetPSDData(pAdapter, i - psd_pts); +- else +- psd_data = rtw_GetPSDData(pAdapter, i); +- sprintf(data, "%s%x ", data, psd_data); +- i++; ++ { ++ size_t extra_len = strlen(data); ++ i = psd_start; ++ while (i < psd_stop) { ++ if (i >= psd_pts) ++ psd_data = rtw_GetPSDData(pAdapter, i - psd_pts); ++ else ++ psd_data = rtw_GetPSDData(pAdapter, i); ++ extra_len += sprintf(data + extra_len, "%x ", psd_data); ++ i++; ++ } + } + + #ifdef CONFIG_LONG_DELAY_ISSUE +diff --git a/drivers/net/wireless/rockchip_wlan/rtl8189fs/os_dep/linux/ioctl_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8189fs/os_dep/linux/ioctl_mp.c +index 0e482ebeda72..84404cb32b48 100644 +--- a/drivers/net/wireless/rockchip_wlan/rtl8189fs/os_dep/linux/ioctl_mp.c ++++ b/drivers/net/wireless/rockchip_wlan/rtl8189fs/os_dep/linux/ioctl_mp.c +@@ -1799,7 +1799,7 @@ int rtw_mp_tx(struct net_device *dev, + char *pextra = extra; + RTW_INFO("Got format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); ++ extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); + padapter->mppriv.channel = channel; + SetChannel(padapter); + pHalData->current_channel = channel; +@@ -1922,6 +1922,7 @@ int rtw_mp_rx(struct net_device *dev, + struct iw_request_info *info, + union iwreq_data *wrqu, char *extra) + { ++ size_t extra_len; + PADAPTER padapter = rtw_netdev_priv(dev); + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(padapter); + struct mp_priv *pmp_priv = &padapter->mppriv; +@@ -1966,7 +1967,7 @@ int rtw_mp_rx(struct net_device *dev, + bStartRx = 1; + RTW_INFO("Got format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); ++ extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); + padapter->mppriv.channel = channel; + SetChannel(padapter); + pHalData->current_channel = channel; +@@ -2138,6 +2139,7 @@ int rtw_efuse_mask_file(struct net_device *dev, + char *rtw_efuse_mask_file_path; + u8 Status; + PADAPTER padapter = rtw_netdev_priv(dev); ++ size_t extra_len; + + _rtw_memset(maskfileBuffer, 0x00, sizeof(maskfileBuffer)); + +@@ -2189,11 +2191,11 @@ int rtw_efuse_mask_file(struct net_device *dev, + } while (count < 64); + + for (i = 0; i < count; i++) +- sprintf(extra, "%s:%02x", extra, maskfileBuffer[i]); ++ extra_len += sprintf(extra + extra_len, ":%02x", maskfileBuffer[i]); + + padapter->registrypriv.bFileMaskEfuse = _TRUE; + +- sprintf(extra, "%s\nLoad Efuse Mask data %d hex ok\n", extra, count); ++ extra_len += sprintf(extra + extra_len, "\nLoad Efuse Mask data %d hex ok\n", count); + wrqu->data.length = strlen(extra); + return 0; + } +@@ -2616,16 +2618,17 @@ todo: + mptbt_BtControlProcess(padapter, &BtReq); + + if (readtherm == 0) { +- sprintf(extra, "BT thermal="); ++ size_t extra_len = sprintf(extra, "BT thermal="); + for (i = 4; i < pMptCtx->mptOutLen; i++) { + if ((pMptCtx->mptOutBuf[i] == 0x00) && (pMptCtx->mptOutBuf[i + 1] == 0x00)) + goto exit; + +- sprintf(extra, "%s %d ", extra, (pMptCtx->mptOutBuf[i] & 0x1f)); ++ extra_len += sprintf(extra + extra_len, " %d ", (pMptCtx->mptOutBuf[i] & 0x1f)); + } + } else { ++ size_t extra_len = strlen(extra); + for (i = 4; i < pMptCtx->mptOutLen; i++) +- sprintf(extra, "%s 0x%x ", extra, pMptCtx->mptOutBuf[i]); ++ extra_len += sprintf(extra + extra_len, " 0x%x ", pMptCtx->mptOutBuf[i]); + } + + exit: +diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723bs/core/rtw_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8723bs/core/rtw_mp.c +index a16da9b60103..39384d584f38 100644 +--- a/drivers/net/wireless/rockchip_wlan/rtl8723bs/core/rtw_mp.c ++++ b/drivers/net/wireless/rockchip_wlan/rtl8723bs/core/rtw_mp.c +@@ -2093,14 +2093,17 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data) + + data[0] = '\0'; + +- i = psd_start; +- while (i < psd_stop) { +- if (i >= psd_pts) +- psd_data = rtw_GetPSDData(pAdapter, i - psd_pts); +- else +- psd_data = rtw_GetPSDData(pAdapter, i); +- sprintf(data, "%s%x ", data, psd_data); +- i++; ++ { ++ size_t extra_len = strlen(data); ++ i = psd_start; ++ while (i < psd_stop) { ++ if (i >= psd_pts) ++ psd_data = rtw_GetPSDData(pAdapter, i - psd_pts); ++ else ++ psd_data = rtw_GetPSDData(pAdapter, i); ++ extra_len += sprintf(data + extra_len, "%x ", psd_data); ++ i++; ++ } + } + + #ifdef CONFIG_LONG_DELAY_ISSUE +diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723bs/os_dep/linux/ioctl_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8723bs/os_dep/linux/ioctl_mp.c +index ad2bb026739a..4f098330fcde 100644 +--- a/drivers/net/wireless/rockchip_wlan/rtl8723bs/os_dep/linux/ioctl_mp.c ++++ b/drivers/net/wireless/rockchip_wlan/rtl8723bs/os_dep/linux/ioctl_mp.c +@@ -1719,7 +1719,7 @@ int rtw_mp_tx(struct net_device *dev, + char *pextra = extra; + RTW_INFO("Got format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); ++ extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); + padapter->mppriv.channel = channel; + SetChannel(padapter); + pHalData->current_channel = channel; +@@ -1842,6 +1842,7 @@ int rtw_mp_rx(struct net_device *dev, + struct iw_request_info *info, + union iwreq_data *wrqu, char *extra) + { ++ size_t extra_len; + PADAPTER padapter = rtw_netdev_priv(dev); + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(padapter); + struct mp_priv *pmp_priv = &padapter->mppriv; +@@ -1886,7 +1887,7 @@ int rtw_mp_rx(struct net_device *dev, + bStartRx = 1; + RTW_INFO("Got format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); ++ extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); + padapter->mppriv.channel = channel; + SetChannel(padapter); + pHalData->current_channel = channel; +@@ -2049,6 +2050,7 @@ int rtw_efuse_mask_file(struct net_device *dev, + char *rtw_efuse_mask_file_path; + u8 Status; + PADAPTER padapter = rtw_netdev_priv(dev); ++ size_t extra_len; + + _rtw_memset(maskfileBuffer, 0x00, sizeof(maskfileBuffer)); + +@@ -2100,11 +2102,11 @@ int rtw_efuse_mask_file(struct net_device *dev, + } while (count < 64); + + for (i = 0; i < count; i++) +- sprintf(extra, "%s:%02x", extra, maskfileBuffer[i]); ++ extra_len += sprintf(extra + extra_len, ":%02x", maskfileBuffer[i]); + + padapter->registrypriv.bFileMaskEfuse = _TRUE; + +- sprintf(extra, "%s\nLoad Efuse Mask data %d hex ok\n", extra, count); ++ extra_len += sprintf(extra + extra_len, "\nLoad Efuse Mask data %d hex ok\n", count); + wrqu->data.length = strlen(extra); + return 0; + } +@@ -2522,16 +2524,17 @@ todo: + mptbt_BtControlProcess(padapter, &BtReq); + + if (readtherm == 0) { +- sprintf(extra, "BT thermal="); ++ size_t extra_len = sprintf(extra, "BT thermal="); + for (i = 4; i < pMptCtx->mptOutLen; i++) { + if ((pMptCtx->mptOutBuf[i] == 0x00) && (pMptCtx->mptOutBuf[i + 1] == 0x00)) + goto exit; + +- sprintf(extra, "%s %d ", extra, (pMptCtx->mptOutBuf[i] & 0x1f)); ++ extra_len += sprintf(extra + extra_len, " %d ", (pMptCtx->mptOutBuf[i] & 0x1f)); + } + } else { ++ size_t extra_len = strlen(extra); + for (i = 4; i < pMptCtx->mptOutLen; i++) +- sprintf(extra, "%s 0x%x ", extra, pMptCtx->mptOutBuf[i]); ++ extra_len += sprintf(extra + extra_len, " 0x%x ", pMptCtx->mptOutBuf[i]); + } + + exit: +diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723bu/core/rtw_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8723bu/core/rtw_mp.c +index 970ad98bb5f7..357c15ddb446 100755 +--- a/drivers/net/wireless/rockchip_wlan/rtl8723bu/core/rtw_mp.c ++++ b/drivers/net/wireless/rockchip_wlan/rtl8723bu/core/rtw_mp.c +@@ -1909,7 +1909,7 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data) + { + u32 i, psd_pts=0, psd_start=0, psd_stop=0; + u32 psd_data=0; +- ++ size_t data_len = 0; + + #ifdef PLATFORM_LINUX + if (!netif_running(pAdapter->pnetdev)) { +@@ -1941,7 +1941,7 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data) + } else { + psd_data = rtw_GetPSDData(pAdapter, i); + } +- sprintf(data, "%s%x ", data, psd_data); ++ data_len += sprintf(data + data_len, "%x ", psd_data); + i++; + } + +diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723bu/os_dep/linux/ioctl_linux.c b/drivers/net/wireless/rockchip_wlan/rtl8723bu/os_dep/linux/ioctl_linux.c +index 22bb5c2439b8..785cf61bfe18 100755 +--- a/drivers/net/wireless/rockchip_wlan/rtl8723bu/os_dep/linux/ioctl_linux.c ++++ b/drivers/net/wireless/rockchip_wlan/rtl8723bu/os_dep/linux/ioctl_linux.c +@@ -9776,6 +9776,7 @@ static int rtw_mp_efuse_get(struct net_device *dev, + u16 i=0, j=0, mapLen=0, addr=0, cnts=0; + u16 max_available_len = 0, raw_cursize = 0, raw_maxsize = 0; + int err; ++ size_t extra_len; + #ifdef CONFIG_IOL + u8 org_fw_iol = padapter->registrypriv.fw_iol;// 0:Disable, 1:enable, 2:by usb speed + #endif +@@ -9839,23 +9840,23 @@ static int rtw_mp_efuse_get(struct net_device *dev, + { + mapLen = EFUSE_MAP_SIZE; + +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < EFUSE_MAP_SIZE; i += 16) + { + // DBG_871X("0x%02x\t", i); +- sprintf(extra, "%s0x%02x\t", extra, i); ++ extra_len += sprintf(extra + extra_len, "0x%02x\t", i); + for (j=0; j<8; j++) { + // DBG_871X("%02X ", data[i+j]); +- sprintf(extra, "%s%02X ", extra, PROMContent[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", PROMContent[i+j]); + } + // DBG_871X("\t"); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j<16; j++) { + // DBG_871X("%02X ", data[i+j]); +- sprintf(extra, "%s%02X ", extra, PROMContent[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", PROMContent[i+j]); + } + // DBG_871X("\n"); +- sprintf(extra,"%s\n",extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + // DBG_871X("\n"); + } +@@ -9870,23 +9871,23 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } + + // DBG_871X("OFFSET\tVALUE(hex)\n"); +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < EFUSE_MAP_SIZE; i += 16) + { + // DBG_871X("0x%02x\t", i); +- sprintf(extra, "%s0x%02x\t", extra, i); ++ extra_len += sprintf(extra + extra_len, "0x%02x\t", i); + for (j=0; j<8; j++) { + // DBG_871X("%02X ", data[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeEfuseInitMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeEfuseInitMap[i+j]); + } + // DBG_871X("\t"); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j<16; j++) { + // DBG_871X("%02X ", data[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeEfuseInitMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeEfuseInitMap[i+j]); + } + // DBG_871X("\n"); +- sprintf(extra,"%s\n",extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + // DBG_871X("\n"); + } +@@ -9929,9 +9930,10 @@ static int rtw_mp_efuse_get(struct net_device *dev, + + // DBG_871X("%s: data={", __FUNCTION__); + *extra = 0; ++ extra_len = 0; + for (i=0; iBTEfuseInitMap[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]); + } + // DBG_871X("\t"); +- sprintf(extra,"%s\t",extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j<16; j++) { + // DBG_871X("%02X ", pEfuseHal->BTEfuseInitMap[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]); + } + // DBG_871X("\n"); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + // DBG_871X("\n"); + } +@@ -10151,24 +10153,24 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } + + // DBG_871X("OFFSET\tVALUE(hex)\n"); +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i=512; i<1024 ; i+=16) + { + // DBG_871X("0x%03x\t", i); +- sprintf(extra, "%s0x%03x\t", extra, i); ++ extra_len += sprintf(extra + extra_len, "0x%03x\t", i); + for (j=0; j<8; j++) + { + // DBG_871X("%02X ", data[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]); + } + // DBG_871X("\t"); +- sprintf(extra,"%s\t",extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j<16; j++) { + // DBG_871X("%02X ", data[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]); + } + // DBG_871X("\n"); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + // DBG_871X("\n"); + } +@@ -10210,11 +10212,12 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } + + *extra = 0; ++ extra_len = 0; + // DBG_871X("%s: bt efuse data={", __FUNCTION__); + for (i=0; ifakeBTEfuseModifiedMap[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); + } + // DBG_871X("\t"); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j<16; j++) { + // DBG_871X("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); + } + // DBG_871X("\n"); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + // DBG_871X("\n"); + } + else if (strcmp(tmp[0],"btbfake") == 0) + { + // DBG_871X("OFFSET\tVALUE(hex)\n"); +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i=512; i<1024; i+=16) + { + // DBG_871X("0x%03x\t", i); +- sprintf(extra, "%s0x%03x\t", extra, i); ++ extra_len += sprintf(extra + extra_len, "0x%03x\t", i); + for (j=0; j<8; j++) { + // DBG_871X("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); + } + // DBG_871X("\t"); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j<16; j++) { + // DBG_871X("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); + } + // DBG_871X("\n"); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + // DBG_871X("\n"); + } + else if (strcmp(tmp[0],"wlrfkmap")== 0) + { + // DBG_871X("OFFSET\tVALUE(hex)\n"); +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i=0; ifakeEfuseModifiedMap[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeEfuseModifiedMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeEfuseModifiedMap[i+j]); + } + // DBG_871X("\t"); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j<16; j++) { + // DBG_871X("%02X ", pEfuseHal->fakeEfuseModifiedMap[i+j]); +- sprintf(extra, "%s %02X", extra, pEfuseHal->fakeEfuseModifiedMap[i+j]); ++ extra_len += sprintf(extra + extra_len, " %02X", pEfuseHal->fakeEfuseModifiedMap[i+j]); + } + // DBG_871X("\n"); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + // DBG_871X("\n"); + +@@ -10312,9 +10315,10 @@ static int rtw_mp_efuse_get(struct net_device *dev, + + // DBG_871X("%s: data={", __FUNCTION__); + *extra = 0; ++ extra_len = 0; + for (i=0; ifakeEfuseModifiedMap[addr+i]); +- sprintf(extra, "%s0x%02X ", extra, pEfuseHal->fakeEfuseModifiedMap[addr+i]); ++ extra_len += sprintf(extra + extra_len, "0x%02X ", pEfuseHal->fakeEfuseModifiedMap[addr+i]); + } + } + else if (strcmp(tmp[0],"btrfkrmap")== 0) +@@ -10340,9 +10344,10 @@ static int rtw_mp_efuse_get(struct net_device *dev, + + // DBG_871X("%s: data={", __FUNCTION__); + *extra = 0; ++ extra_len = 0; + for (i=0; ifakeBTEfuseModifiedMap[addr+i]); +- sprintf(extra, "%s0x%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[addr+i]); ++ extra_len += sprintf(extra + extra_len, "0x%02X ", pEfuseHal->fakeBTEfuseModifiedMap[addr+i]); + } + } + else +diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723bu/os_dep/linux/ioctl_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8723bu/os_dep/linux/ioctl_mp.c +index 96f1e4ee1c9e..13f7f39add77 100644 +--- a/drivers/net/wireless/rockchip_wlan/rtl8723bu/os_dep/linux/ioctl_mp.c ++++ b/drivers/net/wireless/rockchip_wlan/rtl8723bu/os_dep/linux/ioctl_mp.c +@@ -198,7 +198,7 @@ int rtw_mp_read_reg(struct net_device *dev, + if (*pnext != '\0') { + /*strtout = simple_strtoul(pnext , &ptmp, 16);*/ + ret = sscanf(pnext, "%x", &strtout); +- sprintf(extra, "%s %d" , extra , strtout); ++ sprintf(extra + strlen(extra), " %d", strtout); + } else + break; + pch = pnext; +@@ -230,7 +230,7 @@ int rtw_mp_read_reg(struct net_device *dev, + pnext++; + if (*pnext != '\0') { + ret = sscanf(pnext, "%x", &strtout); +- sprintf(extra, "%s %d" , extra , strtout); ++ sprintf(extra + strlen(extra), " %d", strtout); + } else + break; + pch = pnext; +@@ -341,20 +341,23 @@ int rtw_mp_read_rf(struct net_device *dev, + pch = tmp; + DBG_871X("pch=%s", pch); + +- while (*pch != '\0') { +- pnext = strpbrk(pch, " "); +- if (!pnext) +- break; +- pnext++; +- if (*pnext != '\0') { +- /*strtou =simple_strtoul(pnext , &ptmp, 16);*/ +- ret = sscanf(pnext, "%x", &strtou); +- sprintf(extra, "%s %d" , extra , strtou); +- } else +- break; +- pch = pnext; ++ { ++ size_t extra_len = strlen(extra); ++ while (*pch != '\0') { ++ pnext = strpbrk(pch, " "); ++ if (!pnext) ++ break; ++ pnext++; ++ if (*pnext != '\0') { ++ /*strtou =simple_strtoul(pnext , &ptmp, 16);*/ ++ ret = sscanf(pnext, "%x", &strtou); ++ extra_len += sprintf(extra + extra_len, " %d", strtou); ++ } else ++ break; ++ pch = pnext; ++ } ++ wrqu->length = extra_len; + } +- wrqu->length = strlen(extra); + + return 0; + } +@@ -1384,7 +1387,7 @@ int rtw_mp_pretx_proc(PADAPTER padapter, u8 bStartTest, char *extra) + pmp_priv->mode = MP_ON; + sprintf(extra, "Stop continuous Tx"); + } else if (pmp_priv->tx.stop == 1) { +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500 count=%u\n", extra, pmp_priv->tx.count); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500 count=%u\n", pmp_priv->tx.count); + pmp_priv->tx.stop = 0; + SetPacketTx(padapter); + } else { +@@ -1393,26 +1396,26 @@ int rtw_mp_pretx_proc(PADAPTER padapter, u8 bStartTest, char *extra) + return 0; + case MP_SINGLE_TONE_TX: + if (bStartTest != 0) +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes."); + SetSingleToneTx(padapter, (u8)bStartTest); + break; + case MP_CONTINUOUS_TX: + if (bStartTest != 0) +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes."); + SetContinuousTx(padapter, (u8)bStartTest); + break; + case MP_CARRIER_SUPPRISSION_TX: + if (bStartTest != 0) { + if (HwRateToMPTRate(pmp_priv->rateidx) <= MPT_RATE_11M) +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes."); + else +- sprintf(extra, "%s\nSpecify carrier suppression but not CCK rate", extra); ++ sprintf(extra + strlen(extra), "\nSpecify carrier suppression but not CCK rate"); + } + SetCarrierSuppressionTx(padapter, (u8)bStartTest); + break; + case MP_SINGLE_CARRIER_TX: + if (bStartTest != 0) +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes."); + SetSingleCarrierTx(padapter, (u8)bStartTest); + break; + +@@ -1464,6 +1467,7 @@ int rtw_mp_tx(struct net_device *dev, + u32 bandwidth = 0, sg = 0, channel = 6, txpower = 40, rate = 108, ant = 0, txmode = 1, count = 0; + u8 i = 0, j = 0, bStartTest = 1, status = 0, Idx = 0, tmpU1B = 0; + u16 antenna = 0; ++ size_t extra_len; + + if (copy_from_user(extra, wrqu->data.pointer, wrqu->data.length)) + return -EFAULT; +@@ -1490,14 +1494,14 @@ int rtw_mp_tx(struct net_device *dev, + return 0; + } else if (strncmp(extra, "setting", 7) == 0) { + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "Current Setting :\n Channel:%d", pmp_priv->channel); +- sprintf(extra, "%s\n Bandwidth:%d", extra, pmp_priv->bandwidth); +- sprintf(extra, "%s\n Rate index:%d", extra, pmp_priv->rateidx); +- sprintf(extra, "%s\n TxPower index:%d", extra, pmp_priv->txpoweridx); +- sprintf(extra, "%s\n Antenna TxPath:%d", extra, pmp_priv->antenna_tx); +- sprintf(extra, "%s\n Antenna RxPath:%d", extra, pmp_priv->antenna_rx); +- sprintf(extra, "%s\n MP Mode:%d", extra, pmp_priv->mode); +- wrqu->data.length = strlen(extra); ++ extra_len = sprintf(extra, "Current Setting :\n Channel:%d", pmp_priv->channel); ++ extra_len += sprintf(extra + extra_len, "\n Bandwidth:%d", pmp_priv->bandwidth); ++ extra_len += sprintf(extra + extra_len, "\n Rate index:%d", pmp_priv->rateidx); ++ extra_len += sprintf(extra + extra_len, "\n TxPower index:%d", pmp_priv->txpoweridx); ++ extra_len += sprintf(extra + extra_len, "\n Antenna TxPath:%d", pmp_priv->antenna_tx); ++ extra_len += sprintf(extra + extra_len, "\n Antenna RxPath:%d", pmp_priv->antenna_rx); ++ extra_len += sprintf(extra + extra_len, "\n MP Mode:%d", pmp_priv->mode); ++ wrqu->data.length = extra_len; + return 0; + #ifdef CONFIG_MP_VHT_HW_TX_MODE + } else if (strncmp(extra, "pmact", 5) == 0) { +@@ -1634,25 +1638,25 @@ int rtw_mp_tx(struct net_device *dev, + if (sscanf(extra, "ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d", &channel, &bandwidth, &rate, &txpower, &ant, &txmode) < 6) { + DBG_871X("Invalid format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "\n Please input correct format as bleow:\n"); +- sprintf(extra, "%s\t ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d\n", extra, channel, bandwidth, rate, txpower, ant, txmode); +- sprintf(extra, "%s\n [ ch : BGN = <1~14> , A or AC = <36~165> ]", extra); +- sprintf(extra, "%s\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]", extra); +- sprintf(extra, "%s\n [ rate : CCK: 1 2 5.5 11M X 2 = < 2 4 11 22 >]", extra); +- sprintf(extra, "%s\n [ OFDM: 6 9 12 18 24 36 48 54M X 2 = < 12 18 24 36 48 72 96 108>", extra); +- sprintf(extra, "%s\n [ HT 1S2SS MCS0 ~ MCS15 : < [MCS0]=128 ~ [MCS7]=135 ~ [MCS15]=143 >", extra); +- sprintf(extra, "%s\n [ HT 3SS MCS16 ~ MCS32 : < [MCS16]=144 ~ [MCS23]=151 ~ [MCS32]=159 >", extra); +- sprintf(extra, "%s\n [ VHT 1SS MCS0 ~ MCS9 : < [MCS0]=160 ~ [MCS9]=169 >", extra); +- sprintf(extra, "%s\n [ txpower : 1~63 power index", extra); +- sprintf(extra, "%s\n [ ant : ,2T ex: AB=3 BC=6 CD=12", extra); +- sprintf(extra, "%s\n [ txmode : < 0 = CONTINUOUS_TX, 1 = PACKET_TX, 2 = SINGLE_TONE_TX, 3 = CARRIER_SUPPRISSION_TX, 4 = SINGLE_CARRIER_TX>\n", extra); +- wrqu->data.length = strlen(extra); ++ extra_len = sprintf(extra, "\n Please input correct format as bleow:\n"); ++ extra_len += sprintf(extra + extra_len, "\t ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d\n", channel, bandwidth, rate, txpower, ant, txmode); ++ extra_len += sprintf(extra + extra_len, "\n [ ch : BGN = <1~14> , A or AC = <36~165> ]"); ++ extra_len += sprintf(extra + extra_len, "\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]"); ++ extra_len += sprintf(extra + extra_len, "\n [ rate : CCK: 1 2 5.5 11M X 2 = < 2 4 11 22 >]"); ++ extra_len += sprintf(extra + extra_len, "\n [ OFDM: 6 9 12 18 24 36 48 54M X 2 = < 12 18 24 36 48 72 96 108>"); ++ extra_len += sprintf(extra + extra_len, "\n [ HT 1S2SS MCS0 ~ MCS15 : < [MCS0]=128 ~ [MCS7]=135 ~ [MCS15]=143 >"); ++ extra_len += sprintf(extra + extra_len, "\n [ HT 3SS MCS16 ~ MCS32 : < [MCS16]=144 ~ [MCS23]=151 ~ [MCS32]=159 >"); ++ extra_len += sprintf(extra + extra_len, "\n [ VHT 1SS MCS0 ~ MCS9 : < [MCS0]=160 ~ [MCS9]=169 >"); ++ extra_len += sprintf(extra + extra_len, "\n [ txpower : 1~63 power index"); ++ extra_len += sprintf(extra + extra_len, "\n [ ant : ,2T ex: AB=3 BC=6 CD=12"); ++ extra_len += sprintf(extra + extra_len, "\n [ txmode : < 0 = CONTINUOUS_TX, 1 = PACKET_TX, 2 = SINGLE_TONE_TX, 3 = CARRIER_SUPPRISSION_TX, 4 = SINGLE_CARRIER_TX>\n"); ++ wrqu->data.length = extra_len; + return status; + + } else { + DBG_871X("Got format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); ++ extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); + padapter->mppriv.channel = channel; + SetChannel(padapter); + pHalData->CurrentChannel = channel; +@@ -1661,13 +1665,14 @@ int rtw_mp_tx(struct net_device *dev, + bandwidth = CHANNEL_WIDTH_40; + else if (bandwidth == 2) + bandwidth = CHANNEL_WIDTH_80; +- sprintf(extra, "%s\nChange Current Bandwidth %d to Bandwidth %d", extra, padapter->mppriv.bandwidth , bandwidth); ++ extra_len = strlen(extra); ++ extra_len += sprintf(extra + extra_len, "\nChange Current Bandwidth %d to Bandwidth %d", padapter->mppriv.bandwidth , bandwidth); + padapter->mppriv.bandwidth = (u8)bandwidth; + padapter->mppriv.preamble = sg; + SetBandwidth(padapter); + pHalData->CurrentChannelBW = bandwidth; + +- sprintf(extra, "%s\nSet power level :%d", extra, txpower); ++ extra_len += sprintf(extra + extra_len, "\nSet power level :%d", txpower); + padapter->mppriv.txpoweridx = (u8)txpower; + pMptCtx->TxPwrLevel[ODM_RF_PATH_A] = (u8)txpower; + pMptCtx->TxPwrLevel[ODM_RF_PATH_B] = (u8)txpower; +@@ -1690,13 +1695,13 @@ int rtw_mp_tx(struct net_device *dev, + DBG_871X("%s: rate index=%d\n", __func__, rate); + if (rate >= MPT_RATE_LAST) + return -EINVAL; +- sprintf(extra, "%s\nSet data rate to %d index %d", extra, padapter->mppriv.rateidx, rate); ++ extra_len += sprintf(extra + extra_len, "\nSet data rate to %d index %d", padapter->mppriv.rateidx, rate); + + padapter->mppriv.rateidx = rate; + pMptCtx->MptRateIndex = rate; + SetDataRate(padapter); + +- sprintf(extra, "%s\nSet Antenna Path :%d", extra, ant); ++ extra_len += sprintf(extra + extra_len, "\nSet Antenna Path :%d", ant); + switch (ant) { + case 1: + antenna = ANTENNA_A; +@@ -1782,6 +1787,7 @@ int rtw_mp_rx(struct net_device *dev, + u32 bandwidth = 0, sg = 0, channel = 6, ant = 0; + u16 antenna = 0; + u8 bStartRx = 0; ++ size_t extra_len; + + if (copy_from_user(extra, wrqu->data.pointer, wrqu->data.length)) + return -EFAULT; +@@ -1805,19 +1811,19 @@ int rtw_mp_rx(struct net_device *dev, + } else if (sscanf(extra, "ch=%d,bw=%d,ant=%d", &channel, &bandwidth, &ant) < 3) { + DBG_871X("Invalid format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "\n Please input correct format as bleow:\n"); +- sprintf(extra, "%s\t ch=%d,bw=%d,ant=%d\n", extra, channel, bandwidth, ant); +- sprintf(extra, "%s\n [ ch : BGN = <1~14> , A or AC = <36~165> ]", extra); +- sprintf(extra, "%s\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]", extra); +- sprintf(extra, "%s\n [ ant : ,2T ex: AB=3 BC=6 CD=12", extra); +- wrqu->data.length = strlen(extra); ++ extra_len = sprintf(extra, "\n Please input correct format as bleow:\n"); ++ extra_len += sprintf(extra + extra_len, "\t ch=%d,bw=%d,ant=%d\n", channel, bandwidth, ant); ++ extra_len += sprintf(extra + extra_len, "\n [ ch : BGN = <1~14> , A or AC = <36~165> ]"); ++ extra_len += sprintf(extra + extra_len, "\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]"); ++ extra_len += sprintf(extra + extra_len, "\n [ ant : ,2T ex: AB=3 BC=6 CD=12"); ++ wrqu->data.length = extra_len; + return 0; + + } else { + bStartRx = 1; + DBG_871X("Got format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); ++ extra_len += sprintf(extra + extra_len, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); + padapter->mppriv.channel = channel; + SetChannel(padapter); + pHalData->CurrentChannel = channel; +@@ -1826,13 +1832,13 @@ int rtw_mp_rx(struct net_device *dev, + bandwidth = CHANNEL_WIDTH_40; + else if (bandwidth == 2) + bandwidth = CHANNEL_WIDTH_80; +- sprintf(extra, "%s\nChange Current Bandwidth %d to Bandwidth %d", extra, padapter->mppriv.bandwidth , bandwidth); ++ extra_len += sprintf(extra + extra_len, "\nChange Current Bandwidth %d to Bandwidth %d", padapter->mppriv.bandwidth , bandwidth); + padapter->mppriv.bandwidth = (u8)bandwidth; + padapter->mppriv.preamble = sg; + SetBandwidth(padapter); + pHalData->CurrentChannelBW = bandwidth; + +- sprintf(extra, "%s\nSet Antenna Path :%d", extra, ant); ++ extra_len += sprintf(extra + extra_len, "\nSet Antenna Path :%d", ant); + switch (ant) { + case 1: + antenna = ANTENNA_A; +@@ -1883,10 +1889,10 @@ int rtw_mp_rx(struct net_device *dev, + pHalData->AntennaTxPath = antenna; + SetAntenna(padapter); + +- sprintf(extra, "%s\nstart Rx", extra); ++ extra_len += sprintf(extra + extra_len, "\nstart Rx"); + SetPacketRx(padapter, bStartRx, _FALSE); + } +- wrqu->data.length = strlen(extra); ++ wrqu->data.length = extra_len; + return 0; + } + +@@ -2014,6 +2020,7 @@ int rtw_mp_SetBT(struct net_device *dev, + int testmode = 1, ready = 1, trxparam = 1, setgen = 1, getgen = 1, testctrl = 1, testbt = 1, readtherm = 1, setbtmac = 1; + u32 i = 0, ii = 0, jj = 0, kk = 0, cnts = 0, status = 0; + PRT_MP_FIRMWARE pBTFirmware = NULL; ++ size_t extra_len; + + if (copy_from_user(extra, wrqu->data.pointer, wrqu->data.length)) + return -EFAULT; +@@ -2310,17 +2317,18 @@ todo: + + mptbt_BtControlProcess(padapter, &BtReq); + ++ extra_len = strlen(extra); + if (readtherm == 0) { + sprintf(extra, "BT thermal="); + for (i = 4; i < pMptCtx->mptOutLen; i++) { + if ((pMptCtx->mptOutBuf[i] == 0x00) && (pMptCtx->mptOutBuf[i + 1] == 0x00)) + goto exit; + +- sprintf(extra, "%s %d ", extra, (pMptCtx->mptOutBuf[i] & 0x1f)); ++ extra_len += sprintf(extra + extra_len, " %d ", (pMptCtx->mptOutBuf[i] & 0x1f)); + } + } else { + for (i = 4; i < pMptCtx->mptOutLen; i++) +- sprintf(extra, "%s 0x%x ", extra, pMptCtx->mptOutBuf[i]); ++ extra_len += sprintf(extra + extra_len, " 0x%x ", pMptCtx->mptOutBuf[i]); + } + + exit: +diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723cs/core/rtw_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8723cs/core/rtw_mp.c +index 87ced9ab0180..a08b26f0f87f 100644 +--- a/drivers/net/wireless/rockchip_wlan/rtl8723cs/core/rtw_mp.c ++++ b/drivers/net/wireless/rockchip_wlan/rtl8723cs/core/rtw_mp.c +@@ -2119,14 +2119,17 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data) + + data[0] = '\0'; + +- i = psd_start; +- while (i < psd_stop) { +- if (i >= psd_pts) +- psd_data = rtw_GetPSDData(pAdapter, i - psd_pts); +- else +- psd_data = rtw_GetPSDData(pAdapter, i); +- sprintf(data, "%s%x ", data, psd_data); +- i++; ++ { ++ size_t extra_len = strlen(data); ++ i = psd_start; ++ while (i < psd_stop) { ++ if (i >= psd_pts) ++ psd_data = rtw_GetPSDData(pAdapter, i - psd_pts); ++ else ++ psd_data = rtw_GetPSDData(pAdapter, i); ++ extra_len += sprintf(data + extra_len, "%x ", psd_data); ++ i++; ++ } + } + + #ifdef CONFIG_LONG_DELAY_ISSUE +diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723cs/os_dep/linux/ioctl_linux.c b/drivers/net/wireless/rockchip_wlan/rtl8723cs/os_dep/linux/ioctl_linux.c +index 268dee6f5113..0120a3aa52ad 100644 +--- a/drivers/net/wireless/rockchip_wlan/rtl8723cs/os_dep/linux/ioctl_linux.c ++++ b/drivers/net/wireless/rockchip_wlan/rtl8723cs/os_dep/linux/ioctl_linux.c +@@ -9034,6 +9034,7 @@ static int rtw_mp_efuse_get(struct net_device *dev, + #ifdef CONFIG_IOL + u8 org_fw_iol = padapter->registrypriv.fw_iol;/* 0:Disable, 1:enable, 2:by usb speed */ + #endif ++ size_t extra_len; + + wrqu = (struct iw_point *)wdata; + pwrctrlpriv = adapter_to_pwrctl(padapter); +@@ -9105,18 +9106,18 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } else + drvmaporder = 0; + +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < cnt; i += 16) { +- sprintf(extra, "%s0x%02x\t", extra, shift + i); ++ extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i); + for (j = 0; j < 8; j++) +- sprintf(extra, "%s%02X ", extra, efuse[i + j]); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j < 16; j++) +- sprintf(extra, "%s%02X ", extra, efuse[i + j]); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + if ((shift + cnt) < mapLen) +- sprintf(extra, "%s\t...more (left:%d/%d)\n", extra, mapLen-(shift + cnt), mapLen); ++ extra_len += sprintf(extra + extra_len, "\t...more (left:%d/%d)\n", mapLen-(shift + cnt), mapLen); + + } else if (strcmp(tmp[0], "realmap") == 0) { + static u8 order = 0; +@@ -9155,18 +9156,18 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } else + order = 0; + +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < cnt; i += 16) { +- sprintf(extra, "%s0x%02x\t", extra, shift + i); ++ extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i); + for (j = 0; j < 8; j++) +- sprintf(extra, "%s%02X ", extra, efuse[i + j]); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j < 16; j++) +- sprintf(extra, "%s%02X ", extra, efuse[i + j]); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + if ((shift + cnt) < mapLen) +- sprintf(extra, "%s\t...more (left:%d/%d)\n", extra, mapLen-(shift + cnt), mapLen); ++ extra_len += sprintf(extra + extra_len, "\t...more (left:%d/%d)\n", mapLen-(shift + cnt), mapLen); + } else if (strcmp(tmp[0], "rmap") == 0) { + if ((tmp[1] == NULL) || (tmp[2] == NULL)) { + RTW_INFO("%s: rmap Fail!! Parameters error!\n", __FUNCTION__); +@@ -9201,9 +9202,10 @@ static int rtw_mp_efuse_get(struct net_device *dev, + + /* RTW_INFO("%s: data={", __FUNCTION__); */ + *extra = 0; ++ extra_len = 0; + for (i = 0; i < cnts; i++) { + /* RTW_INFO("0x%02x ", data[i]); */ +- sprintf(extra, "%s0x%02X ", extra, data[i]); ++ extra_len += sprintf(extra + extra_len, "0x%02X ", data[i]); + } + /* RTW_INFO("}\n"); */ + } else if (strcmp(tmp[0], "realraw") == 0) { +@@ -9232,18 +9234,18 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } else + raw_order = 0; + +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < cnt; i += 16) { +- sprintf(extra, "%s0x%02x\t", extra, shift + i); ++ extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i); + for (j = 0; j < 8; j++) +- sprintf(extra, "%s%02X ", extra, rawdata[i + j]); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", rawdata[i + j]); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j < 16; j++) +- sprintf(extra, "%s%02X ", extra, rawdata[i + j]); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", rawdata[i + j]); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + if ((shift + cnt) < mapLen) +- sprintf(extra, "%s\t...more (left:%d/%d)\n", extra, mapLen-(shift + cnt), mapLen); ++ extra_len += sprintf(extra + extra_len, "\t...more (left:%d/%d)\n", mapLen-(shift + cnt), mapLen); + + } else if (strcmp(tmp[0], "btrealraw") == 0) { + static u8 bt_raw_order = 0; +@@ -9279,18 +9281,18 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } else + bt_raw_order = 0; + +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < cnt; i += 16) { +- sprintf(extra, "%s0x%02x\t", extra, shift + i); ++ extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i); + for (j = 0; j < 8; j++) +- sprintf(extra, "%s%02X ", extra, rawdata[i + j]); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", rawdata[i + j]); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j < 16; j++) +- sprintf(extra, "%s%02X ", extra, rawdata[i + j]); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", rawdata[i + j]); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + if ((shift + cnt) < mapLen) +- sprintf(extra, "%s\t...more (left:%d/%d)\n", extra, mapLen-(shift + cnt), mapLen); ++ extra_len += sprintf(extra + extra_len, "\t...more (left:%d/%d)\n", mapLen-(shift + cnt), mapLen); + + } else if (strcmp(tmp[0], "mac") == 0) { + if (hal_efuse_macaddr_offset(padapter) == -1) { +@@ -9316,12 +9318,13 @@ static int rtw_mp_efuse_get(struct net_device *dev, + + /* RTW_INFO("%s: MAC address={", __FUNCTION__); */ + *extra = 0; ++ extra_len = 0; + for (i = 0; i < cnts; i++) { + /* RTW_INFO("%02X", data[i]); */ +- sprintf(extra, "%s%02X", extra, data[i]); ++ extra_len += sprintf(extra + extra_len, "%02X", data[i]); + if (i != (cnts - 1)) { + /* RTW_INFO(":"); */ +- sprintf(extra, "%s:", extra); ++ extra_len += sprintf(extra + extra_len, ":"); + } + } + /* RTW_INFO("}\n"); */ +@@ -9379,12 +9382,13 @@ static int rtw_mp_efuse_get(struct net_device *dev, + + /* RTW_INFO("%s: {VID,PID}={", __FUNCTION__); */ + *extra = 0; ++ extra_len = 0; + for (i = 0; i < cnts; i++) { + /* RTW_INFO("0x%02x", data[i]); */ +- sprintf(extra, "%s0x%02X", extra, data[i]); ++ extra_len += sprintf(extra + extra_len, "0x%02X", data[i]); + if (i != (cnts - 1)) { + /* RTW_INFO(","); */ +- sprintf(extra, "%s,", extra); ++ extra_len += sprintf(extra + extra_len, ","); + } + } + /* RTW_INFO("}\n"); */ +@@ -9412,22 +9416,22 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } + + /* RTW_INFO("OFFSET\tVALUE(hex)\n"); */ +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < 512; i += 16) { /* set 512 because the iwpriv's extra size have limit 0x7FF */ + /* RTW_INFO("0x%03x\t", i); */ +- sprintf(extra, "%s0x%03x\t", extra, i); ++ extra_len += sprintf(extra + extra_len, "0x%03x\t", i); + for (j = 0; j < 8; j++) { + /* RTW_INFO("%02X ", pEfuseHal->BTEfuseInitMap[i+j]); */ +- sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i + j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i + j]); + } + /* RTW_INFO("\t"); */ +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j < 16; j++) { + /* RTW_INFO("%02X ", pEfuseHal->BTEfuseInitMap[i+j]); */ +- sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i + j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i + j]); + } + /* RTW_INFO("\n"); */ +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + /* RTW_INFO("\n"); */ + } else if (strcmp(tmp[0], "btbmap") == 0) { +@@ -9441,22 +9445,22 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } + + /* RTW_INFO("OFFSET\tVALUE(hex)\n"); */ +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 512; i < 1024 ; i += 16) { + /* RTW_INFO("0x%03x\t", i); */ +- sprintf(extra, "%s0x%03x\t", extra, i); ++ extra_len += sprintf(extra + extra_len, "0x%03x\t", i); + for (j = 0; j < 8; j++) { + /* RTW_INFO("%02X ", data[i+j]); */ +- sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i + j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i + j]); + } + /* RTW_INFO("\t"); */ +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j < 16; j++) { + /* RTW_INFO("%02X ", data[i+j]); */ +- sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i + j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i + j]); + } + /* RTW_INFO("\n"); */ +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + /* RTW_INFO("\n"); */ + } else if (strcmp(tmp[0], "btrmap") == 0) { +@@ -9504,51 +9508,52 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } + + *extra = 0; ++ extra_len = 0; + /* RTW_INFO("%s: bt efuse data={", __FUNCTION__); */ + for (i = 0; i < cnts; i++) { + /* RTW_INFO("0x%02x ", data[i]); */ +- sprintf(extra, "%s 0x%02X ", extra, data[i]); ++ extra_len += sprintf(extra + extra_len, " 0x%02X ", data[i]); + } + /* RTW_INFO("}\n"); */ + RTW_INFO(FUNC_ADPT_FMT ": BT MAC=[%s]\n", FUNC_ADPT_ARG(padapter), extra); + } else if (strcmp(tmp[0], "btffake") == 0) { + /* RTW_INFO("OFFSET\tVALUE(hex)\n"); */ +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < 512; i += 16) { + /* RTW_INFO("0x%03x\t", i); */ +- sprintf(extra, "%s0x%03x\t", extra, i); ++ extra_len += sprintf(extra + extra_len, "0x%03x\t", i); + for (j = 0; j < 8; j++) { + /* RTW_INFO("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); */ +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i + j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i + j]); + } + /* RTW_INFO("\t"); */ +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j < 16; j++) { + /* RTW_INFO("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); */ +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i + j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i + j]); + } + /* RTW_INFO("\n"); */ +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + /* RTW_INFO("\n"); */ + } else if (strcmp(tmp[0], "btbfake") == 0) { + /* RTW_INFO("OFFSET\tVALUE(hex)\n"); */ +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 512; i < 1024; i += 16) { + /* RTW_INFO("0x%03x\t", i); */ +- sprintf(extra, "%s0x%03x\t", extra, i); ++ extra_len += sprintf(extra + extra_len, "0x%03x\t", i); + for (j = 0; j < 8; j++) { + /* RTW_INFO("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); */ +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i + j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i + j]); + } + /* RTW_INFO("\t"); */ +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j < 16; j++) { + /* RTW_INFO("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); */ +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i + j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i + j]); + } + /* RTW_INFO("\n"); */ +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + /* RTW_INFO("\n"); */ + } else if (strcmp(tmp[0], "wlrfkmap") == 0) { +@@ -9569,18 +9574,18 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } else + fk_order = 0; + +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < cnt; i += 16) { +- sprintf(extra, "%s0x%02x\t", extra, shift + i); ++ extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i); + for (j = 0; j < 8; j++) +- sprintf(extra, "%s%02X ", extra, efuse[i + j]); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j < 16; j++) +- sprintf(extra, "%s%02X ", extra, efuse[i + j]); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + if ((shift + cnt) < mapLen) +- sprintf(extra, "%s\t...more\n", extra); ++ extra_len += sprintf(extra + extra_len, "\t...more\n"); + + } else if (strcmp(tmp[0], "wlrfkrmap") == 0) { + if ((tmp[1] == NULL) || (tmp[2] == NULL)) { +@@ -9602,9 +9607,10 @@ static int rtw_mp_efuse_get(struct net_device *dev, + + /* RTW_INFO("%s: data={", __FUNCTION__); */ + *extra = 0; ++ extra_len = 0; + for (i = 0; i < cnts; i++) { + RTW_INFO("wlrfkrmap = 0x%02x\n", pEfuseHal->fakeEfuseModifiedMap[addr + i]); +- sprintf(extra, "%s0x%02X ", extra, pEfuseHal->fakeEfuseModifiedMap[addr + i]); ++ extra_len += sprintf(extra + extra_len, "0x%02X ", pEfuseHal->fakeEfuseModifiedMap[addr + i]); + } + } else if (strcmp(tmp[0], "btrfkrmap") == 0) { + if ((tmp[1] == NULL) || (tmp[2] == NULL)) { +@@ -9626,9 +9632,10 @@ static int rtw_mp_efuse_get(struct net_device *dev, + + /* RTW_INFO("%s: data={", __FUNCTION__); */ + *extra = 0; ++ extra_len = 0; + for (i = 0; i < cnts; i++) { + RTW_INFO("wlrfkrmap = 0x%02x\n", pEfuseHal->fakeBTEfuseModifiedMap[addr + i]); +- sprintf(extra, "%s0x%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[addr + i]); ++ extra_len += sprintf(extra + extra_len, "0x%02X ", pEfuseHal->fakeBTEfuseModifiedMap[addr + i]); + } + } else if (strcmp(tmp[0], "mask") == 0) { + *extra = 0; +@@ -9638,9 +9645,9 @@ static int rtw_mp_efuse_get(struct net_device *dev, + if (padapter->registrypriv.bFileMaskEfuse == _TRUE) + _rtw_memcpy(mask_buf, maskfileBuffer, mask_len); + +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < mask_len; i++) +- sprintf(extra, "%s0x%02X\n", extra, mask_buf[i]); ++ extra_len += sprintf(extra + extra_len, "0x%02X\n", mask_buf[i]); + + } else + sprintf(extra, "Command not found!"); +diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723cs/os_dep/linux/ioctl_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8723cs/os_dep/linux/ioctl_mp.c +index 47b48aac288c..ca2681a9077b 100644 +--- a/drivers/net/wireless/rockchip_wlan/rtl8723cs/os_dep/linux/ioctl_mp.c ++++ b/drivers/net/wireless/rockchip_wlan/rtl8723cs/os_dep/linux/ioctl_mp.c +@@ -198,7 +198,7 @@ int rtw_mp_read_reg(struct net_device *dev, + if (*pnext != '\0') { + /*strtout = simple_strtoul(pnext , &ptmp, 16);*/ + ret = sscanf(pnext, "%x", &strtout); +- sprintf(extra, "%s %d" , extra , strtout); ++ sprintf(extra + strlen(extra), " %d", strtout); + } else + break; + pch = pnext; +@@ -230,7 +230,7 @@ int rtw_mp_read_reg(struct net_device *dev, + pnext++; + if (*pnext != '\0') { + ret = sscanf(pnext, "%x", &strtout); +- sprintf(extra, "%s %d" , extra , strtout); ++ sprintf(extra + strlen(extra), " %d", strtout); + } else + break; + pch = pnext; +@@ -341,20 +341,23 @@ int rtw_mp_read_rf(struct net_device *dev, + pch = tmp; + RTW_INFO("pch=%s", pch); + +- while (*pch != '\0') { +- pnext = strpbrk(pch, " "); +- if (!pnext) +- break; +- pnext++; +- if (*pnext != '\0') { +- /*strtou =simple_strtoul(pnext , &ptmp, 16);*/ +- ret = sscanf(pnext, "%x", &strtou); +- sprintf(extra, "%s %d" , extra , strtou); +- } else +- break; +- pch = pnext; ++ { ++ size_t extra_len = strlen(extra); ++ while (*pch != '\0') { ++ pnext = strpbrk(pch, " "); ++ if (!pnext) ++ break; ++ pnext++; ++ if (*pnext != '\0') { ++ /*strtou =simple_strtoul(pnext , &ptmp, 16);*/ ++ ret = sscanf(pnext, "%x", &strtou); ++ extra_len += sprintf(extra + extra_len, " %d", strtou); ++ } else ++ break; ++ pch = pnext; ++ } ++ wrqu->length = extra_len; + } +- wrqu->length = strlen(extra); + + return 0; + } +@@ -1417,7 +1420,7 @@ int rtw_mp_pretx_proc(PADAPTER padapter, u8 bStartTest, char *extra) + pmp_priv->mode = MP_ON; + sprintf(extra, "Stop continuous Tx"); + } else if (pmp_priv->tx.stop == 1) { +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500 count=%u\n", extra, pmp_priv->tx.count); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500 count=%u\n", pmp_priv->tx.count); + pmp_priv->tx.stop = 0; + SetPacketTx(padapter); + } else +@@ -1425,26 +1428,26 @@ int rtw_mp_pretx_proc(PADAPTER padapter, u8 bStartTest, char *extra) + return 0; + case MP_SINGLE_TONE_TX: + if (bStartTest != 0) +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes."); + SetSingleToneTx(padapter, (u8)bStartTest); + break; + case MP_CONTINUOUS_TX: + if (bStartTest != 0) +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes."); + SetContinuousTx(padapter, (u8)bStartTest); + break; + case MP_CARRIER_SUPPRISSION_TX: + if (bStartTest != 0) { + if (HwRateToMPTRate(pmp_priv->rateidx) <= MPT_RATE_11M) +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes."); + else +- sprintf(extra, "%s\nSpecify carrier suppression but not CCK rate", extra); ++ sprintf(extra + strlen(extra), "\nSpecify carrier suppression but not CCK rate"); + } + SetCarrierSuppressionTx(padapter, (u8)bStartTest); + break; + case MP_SINGLE_CARRIER_TX: + if (bStartTest != 0) +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes."); + SetSingleCarrierTx(padapter, (u8)bStartTest); + break; + +@@ -1496,6 +1499,7 @@ int rtw_mp_tx(struct net_device *dev, + u32 bandwidth = 0, sg = 0, channel = 6, txpower = 40, rate = 108, ant = 0, txmode = 1, count = 0; + u8 i = 0, j = 0, bStartTest = 1, status = 0, Idx = 0, tmpU1B = 0; + u16 antenna = 0; ++ size_t extra_len; + + if (copy_from_user(extra, wrqu->data.pointer, wrqu->data.length)) + return -EFAULT; +@@ -1522,13 +1526,13 @@ int rtw_mp_tx(struct net_device *dev, + return 0; + } else if (strncmp(extra, "setting", 7) == 0) { + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "Current Setting :\n Channel:%d", pmp_priv->channel); +- sprintf(extra, "%s\n Bandwidth:%d", extra, pmp_priv->bandwidth); +- sprintf(extra, "%s\n Rate index:%d", extra, pmp_priv->rateidx); +- sprintf(extra, "%s\n TxPower index:%d", extra, pmp_priv->txpoweridx); +- sprintf(extra, "%s\n Antenna TxPath:%d", extra, pmp_priv->antenna_tx); +- sprintf(extra, "%s\n Antenna RxPath:%d", extra, pmp_priv->antenna_rx); +- sprintf(extra, "%s\n MP Mode:%d", extra, pmp_priv->mode); ++ extra_len = sprintf(extra, "Current Setting :\n Channel:%d", pmp_priv->channel); ++ extra_len += sprintf(extra + extra_len, "\n Bandwidth:%d", pmp_priv->bandwidth); ++ extra_len += sprintf(extra + extra_len, "\n Rate index:%d", pmp_priv->rateidx); ++ extra_len += sprintf(extra + extra_len, "\n TxPower index:%d", pmp_priv->txpoweridx); ++ extra_len += sprintf(extra + extra_len, "\n Antenna TxPath:%d", pmp_priv->antenna_tx); ++ extra_len += sprintf(extra + extra_len, "\n Antenna RxPath:%d", pmp_priv->antenna_rx); ++ extra_len += sprintf(extra + extra_len, "\n MP Mode:%d", pmp_priv->mode); + wrqu->data.length = strlen(extra); + return 0; + #ifdef CONFIG_MP_VHT_HW_TX_MODE +@@ -1666,25 +1670,25 @@ int rtw_mp_tx(struct net_device *dev, + if (sscanf(extra, "ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d", &channel, &bandwidth, &rate, &txpower, &ant, &txmode) < 6) { + RTW_INFO("Invalid format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "\n Please input correct format as bleow:\n"); +- sprintf(extra, "%s\t ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d\n", extra, channel, bandwidth, rate, txpower, ant, txmode); +- sprintf(extra, "%s\n [ ch : BGN = <1~14> , A or AC = <36~165> ]", extra); +- sprintf(extra, "%s\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]", extra); +- sprintf(extra, "%s\n [ rate : CCK: 1 2 5.5 11M X 2 = < 2 4 11 22 >]", extra); +- sprintf(extra, "%s\n [ OFDM: 6 9 12 18 24 36 48 54M X 2 = < 12 18 24 36 48 72 96 108>", extra); +- sprintf(extra, "%s\n [ HT 1S2SS MCS0 ~ MCS15 : < [MCS0]=128 ~ [MCS7]=135 ~ [MCS15]=143 >", extra); +- sprintf(extra, "%s\n [ HT 3SS MCS16 ~ MCS32 : < [MCS16]=144 ~ [MCS23]=151 ~ [MCS32]=159 >", extra); +- sprintf(extra, "%s\n [ VHT 1SS MCS0 ~ MCS9 : < [MCS0]=160 ~ [MCS9]=169 >", extra); +- sprintf(extra, "%s\n [ txpower : 1~63 power index", extra); +- sprintf(extra, "%s\n [ ant : ,2T ex: AB=3 BC=6 CD=12", extra); +- sprintf(extra, "%s\n [ txmode : < 0 = CONTINUOUS_TX, 1 = PACKET_TX, 2 = SINGLE_TONE_TX, 3 = CARRIER_SUPPRISSION_TX, 4 = SINGLE_CARRIER_TX>\n", extra); ++ extra_len = sprintf(extra, "\n Please input correct format as bleow:\n"); ++ extra_len += sprintf(extra + extra_len, "\t ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d\n", channel, bandwidth, rate, txpower, ant, txmode); ++ extra_len += sprintf(extra + extra_len, "\n [ ch : BGN = <1~14> , A or AC = <36~165> ]"); ++ extra_len += sprintf(extra + extra_len, "\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]"); ++ extra_len += sprintf(extra + extra_len, "\n [ rate : CCK: 1 2 5.5 11M X 2 = < 2 4 11 22 >]"); ++ extra_len += sprintf(extra + extra_len, "\n [ OFDM: 6 9 12 18 24 36 48 54M X 2 = < 12 18 24 36 48 72 96 108>"); ++ extra_len += sprintf(extra + extra_len, "\n [ HT 1S2SS MCS0 ~ MCS15 : < [MCS0]=128 ~ [MCS7]=135 ~ [MCS15]=143 >"); ++ extra_len += sprintf(extra + extra_len, "\n [ HT 3SS MCS16 ~ MCS32 : < [MCS16]=144 ~ [MCS23]=151 ~ [MCS32]=159 >"); ++ extra_len += sprintf(extra + extra_len, "\n [ VHT 1SS MCS0 ~ MCS9 : < [MCS0]=160 ~ [MCS9]=169 >"); ++ extra_len += sprintf(extra + extra_len, "\n [ txpower : 1~63 power index"); ++ extra_len += sprintf(extra + extra_len, "\n [ ant : ,2T ex: AB=3 BC=6 CD=12"); ++ extra_len += sprintf(extra + extra_len, "\n [ txmode : < 0 = CONTINUOUS_TX, 1 = PACKET_TX, 2 = SINGLE_TONE_TX, 3 = CARRIER_SUPPRISSION_TX, 4 = SINGLE_CARRIER_TX>\n"); + wrqu->data.length = strlen(extra); + return status; + + } else { + RTW_INFO("Got format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); ++ extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); + padapter->mppriv.channel = channel; + SetChannel(padapter); + pHalData->current_channel = channel; +@@ -1693,13 +1697,13 @@ int rtw_mp_tx(struct net_device *dev, + bandwidth = CHANNEL_WIDTH_40; + else if (bandwidth == 2) + bandwidth = CHANNEL_WIDTH_80; +- sprintf(extra, "%s\nChange Current Bandwidth %d to Bandwidth %d", extra, padapter->mppriv.bandwidth , bandwidth); ++ extra_len += sprintf(extra + extra_len, "\nChange Current Bandwidth %d to Bandwidth %d", padapter->mppriv.bandwidth , bandwidth); + padapter->mppriv.bandwidth = (u8)bandwidth; + padapter->mppriv.preamble = sg; + SetBandwidth(padapter); + pHalData->current_channel_bw = bandwidth; + +- sprintf(extra, "%s\nSet power level :%d", extra, txpower); ++ extra_len += sprintf(extra + extra_len, "\nSet power level :%d", txpower); + padapter->mppriv.txpoweridx = (u8)txpower; + pMptCtx->TxPwrLevel[ODM_RF_PATH_A] = (u8)txpower; + pMptCtx->TxPwrLevel[ODM_RF_PATH_B] = (u8)txpower; +@@ -1722,13 +1726,13 @@ int rtw_mp_tx(struct net_device *dev, + RTW_INFO("%s: rate index=%d\n", __func__, rate); + if (rate >= MPT_RATE_LAST) + return -EINVAL; +- sprintf(extra, "%s\nSet data rate to %d index %d", extra, padapter->mppriv.rateidx, rate); ++ extra_len += sprintf(extra + extra_len, "\nSet data rate to %d index %d", padapter->mppriv.rateidx, rate); + + padapter->mppriv.rateidx = rate; + pMptCtx->mpt_rate_index = rate; + SetDataRate(padapter); + +- sprintf(extra, "%s\nSet Antenna Path :%d", extra, ant); ++ extra_len += sprintf(extra + extra_len, "\nSet Antenna Path :%d", ant); + switch (ant) { + case 1: + antenna = ANTENNA_A; +@@ -1805,6 +1809,7 @@ int rtw_mp_rx(struct net_device *dev, + struct iw_request_info *info, + union iwreq_data *wrqu, char *extra) + { ++ size_t extra_len; + PADAPTER padapter = rtw_netdev_priv(dev); + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(padapter); + struct mp_priv *pmp_priv = &padapter->mppriv; +@@ -1836,19 +1841,19 @@ int rtw_mp_rx(struct net_device *dev, + } else if (sscanf(extra, "ch=%d,bw=%d,ant=%d", &channel, &bandwidth, &ant) < 3) { + RTW_INFO("Invalid format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "\n Please input correct format as bleow:\n"); +- sprintf(extra, "%s\t ch=%d,bw=%d,ant=%d\n", extra, channel, bandwidth, ant); +- sprintf(extra, "%s\n [ ch : BGN = <1~14> , A or AC = <36~165> ]", extra); +- sprintf(extra, "%s\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]", extra); +- sprintf(extra, "%s\n [ ant : ,2T ex: AB=3 BC=6 CD=12", extra); +- wrqu->data.length = strlen(extra); ++ extra_len = sprintf(extra, "\n Please input correct format as bleow:\n"); ++ extra_len += sprintf(extra + extra_len, "\t ch=%d,bw=%d,ant=%d\n", channel, bandwidth, ant); ++ extra_len += sprintf(extra + extra_len, "\n [ ch : BGN = <1~14> , A or AC = <36~165> ]"); ++ extra_len += sprintf(extra + extra_len, "\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]"); ++ extra_len += sprintf(extra + extra_len, "\n [ ant : ,2T ex: AB=3 BC=6 CD=12"); ++ wrqu->data.length = extra_len; + return 0; + + } else { + bStartRx = 1; + RTW_INFO("Got format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); ++ extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); + padapter->mppriv.channel = channel; + SetChannel(padapter); + pHalData->current_channel = channel; +@@ -1857,13 +1862,13 @@ int rtw_mp_rx(struct net_device *dev, + bandwidth = CHANNEL_WIDTH_40; + else if (bandwidth == 2) + bandwidth = CHANNEL_WIDTH_80; +- sprintf(extra, "%s\nChange Current Bandwidth %d to Bandwidth %d", extra, padapter->mppriv.bandwidth , bandwidth); ++ extra_len += sprintf(extra + extra_len, "\nChange Current Bandwidth %d to Bandwidth %d", padapter->mppriv.bandwidth , bandwidth); + padapter->mppriv.bandwidth = (u8)bandwidth; + padapter->mppriv.preamble = sg; + SetBandwidth(padapter); + pHalData->current_channel_bw = bandwidth; + +- sprintf(extra, "%s\nSet Antenna Path :%d", extra, ant); ++ extra_len += sprintf(extra + extra_len, "\nSet Antenna Path :%d", ant); + switch (ant) { + case 1: + antenna = ANTENNA_A; +@@ -1914,7 +1919,7 @@ int rtw_mp_rx(struct net_device *dev, + pHalData->antenna_tx_path = antenna; + SetAntenna(padapter); + +- sprintf(extra, "%s\nstart Rx", extra); ++ extra_len += sprintf(extra + extra_len, "\nstart Rx"); + SetPacketRx(padapter, bStartRx, _FALSE); + } + wrqu->data.length = strlen(extra); +@@ -1956,6 +1961,7 @@ int rtw_efuse_mask_file(struct net_device *dev, + char *rtw_efuse_mask_file_path; + u8 Status; + PADAPTER padapter = rtw_netdev_priv(dev); ++ size_t extra_len; + + _rtw_memset(maskfileBuffer, 0x00, sizeof(maskfileBuffer)); + +@@ -2006,11 +2012,11 @@ int rtw_efuse_mask_file(struct net_device *dev, + } while (count < 64); + + for (i = 0; i < count; i++) +- sprintf(extra, "%s:%02x", extra, maskfileBuffer[i]); ++ extra_len += sprintf(extra + extra_len, ":%02x", maskfileBuffer[i]); + + padapter->registrypriv.bFileMaskEfuse = _TRUE; + +- sprintf(extra, "%s\nLoad Efuse Mask data %d hex ok\n", extra, count); ++ extra_len += sprintf(extra + extra_len, "\nLoad Efuse Mask data %d hex ok\n", count); + wrqu->data.length = strlen(extra); + return 0; + } +@@ -2388,16 +2394,17 @@ todo: + mptbt_BtControlProcess(padapter, &BtReq); + + if (readtherm == 0) { +- sprintf(extra, "BT thermal="); ++ size_t extra_len = sprintf(extra, "BT thermal="); + for (i = 4; i < pMptCtx->mptOutLen; i++) { + if ((pMptCtx->mptOutBuf[i] == 0x00) && (pMptCtx->mptOutBuf[i + 1] == 0x00)) + goto exit; + +- sprintf(extra, "%s %d ", extra, (pMptCtx->mptOutBuf[i] & 0x1f)); ++ extra_len += sprintf(extra + extra_len, " %d ", (pMptCtx->mptOutBuf[i] & 0x1f)); + } + } else { ++ size_t extra_len = strlen(extra); + for (i = 4; i < pMptCtx->mptOutLen; i++) +- sprintf(extra, "%s 0x%x ", extra, pMptCtx->mptOutBuf[i]); ++ extra_len += sprintf(extra + extra_len, " 0x%x ", pMptCtx->mptOutBuf[i]); + } + + exit: +diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723ds/core/rtw_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8723ds/core/rtw_mp.c +index 548a293b73ff..3c48e1f674dc 100644 +--- a/drivers/net/wireless/rockchip_wlan/rtl8723ds/core/rtw_mp.c ++++ b/drivers/net/wireless/rockchip_wlan/rtl8723ds/core/rtw_mp.c +@@ -2444,14 +2444,17 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data) + + data[0] = '\0'; + +- i = psd_start; +- while (i < psd_stop) { +- if (i >= psd_pts) +- psd_data = rtw_GetPSDData(pAdapter, i - psd_pts); +- else +- psd_data = rtw_GetPSDData(pAdapter, i); +- sprintf(data, "%s%x ", data, psd_data); +- i++; ++ { ++ size_t extra_len = strlen(data); ++ i = psd_start; ++ while (i < psd_stop) { ++ if (i >= psd_pts) ++ psd_data = rtw_GetPSDData(pAdapter, i - psd_pts); ++ else ++ psd_data = rtw_GetPSDData(pAdapter, i); ++ extra_len += sprintf(data + extra_len, "%x ", psd_data); ++ i++; ++ } + } + + #ifdef CONFIG_LONG_DELAY_ISSUE +diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723ds/os_dep/linux/ioctl_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8723ds/os_dep/linux/ioctl_mp.c +index afd10ab97fd8..9fa849e32212 100644 +--- a/drivers/net/wireless/rockchip_wlan/rtl8723ds/os_dep/linux/ioctl_mp.c ++++ b/drivers/net/wireless/rockchip_wlan/rtl8723ds/os_dep/linux/ioctl_mp.c +@@ -551,6 +551,7 @@ int rtw_mp_txpower_index(struct net_device *dev, + char input[wrqu->length + 1]; + u32 rfpath; + u32 txpower_inx; ++ size_t extra_len; + + if (wrqu->length > 128) + return -EFAULT; +@@ -571,15 +572,15 @@ int rtw_mp_txpower_index(struct net_device *dev, + sprintf(extra, "patha=%d", txpower_inx); + if (phal_data->rf_type > RF_1T2R) { + txpower_inx = mpt_ProQueryCalTxPower(padapter, 1); +- sprintf(extra, "%s,pathb=%d", extra, txpower_inx); ++ extra_len += sprintf(extra + extra_len, ",pathb=%d", txpower_inx); + } + if (phal_data->rf_type > RF_2T4R) { + txpower_inx = mpt_ProQueryCalTxPower(padapter, 2); +- sprintf(extra, "%s,pathc=%d", extra, txpower_inx); ++ extra_len += sprintf(extra + extra_len, ",pathc=%d", txpower_inx); + } + if (phal_data->rf_type > RF_3T4R) { + txpower_inx = mpt_ProQueryCalTxPower(padapter, 3); +- sprintf(extra, "%s,pathd=%d", extra, txpower_inx); ++ extra_len += sprintf(extra + extra_len, ",pathd=%d", txpower_inx); + } + } + wrqu->length = strlen(extra); +@@ -1821,7 +1822,7 @@ int rtw_mp_tx(struct net_device *dev, + char *pextra = extra; + RTW_INFO("Got format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); ++ extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); + padapter->mppriv.channel = channel; + SetChannel(padapter); + pHalData->current_channel = channel; +@@ -1944,6 +1945,7 @@ int rtw_mp_rx(struct net_device *dev, + struct iw_request_info *info, + union iwreq_data *wrqu, char *extra) + { ++ size_t extra_len; + PADAPTER padapter = rtw_netdev_priv(dev); + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(padapter); + struct mp_priv *pmp_priv = &padapter->mppriv; +@@ -1987,7 +1989,7 @@ int rtw_mp_rx(struct net_device *dev, + bStartRx = 1; + RTW_INFO("Got format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); ++ extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); + padapter->mppriv.channel = channel; + SetChannel(padapter); + pHalData->current_channel = channel; +@@ -2158,6 +2160,7 @@ int rtw_efuse_mask_file(struct net_device *dev, + char *rtw_efuse_mask_file_path; + u8 Status; + PADAPTER padapter = rtw_netdev_priv(dev); ++ size_t extra_len; + + _rtw_memset(maskfileBuffer, 0x00, sizeof(maskfileBuffer)); + +@@ -2208,11 +2211,11 @@ int rtw_efuse_mask_file(struct net_device *dev, + } while (count < 64); + + for (i = 0; i < count; i++) +- sprintf(extra, "%s:%02x", extra, maskfileBuffer[i]); ++ extra_len += sprintf(extra + extra_len, ":%02x", maskfileBuffer[i]); + + padapter->registrypriv.bFileMaskEfuse = _TRUE; + +- sprintf(extra, "%s\nLoad Efuse Mask data %d hex ok\n", extra, count); ++ extra_len += sprintf(extra + extra_len, "\nLoad Efuse Mask data %d hex ok\n", count); + wrqu->data.length = strlen(extra); + return 0; + } +@@ -2635,16 +2638,17 @@ todo: + mptbt_BtControlProcess(padapter, &BtReq); + + if (readtherm == 0) { +- sprintf(extra, "BT thermal="); ++ size_t extra_len = sprintf(extra, "BT thermal="); + for (i = 4; i < pMptCtx->mptOutLen; i++) { + if ((pMptCtx->mptOutBuf[i] == 0x00) && (pMptCtx->mptOutBuf[i + 1] == 0x00)) + goto exit; + +- sprintf(extra, "%s %d ", extra, (pMptCtx->mptOutBuf[i] & 0x1f)); ++ extra_len += sprintf(extra + extra_len, " %d ", (pMptCtx->mptOutBuf[i] & 0x1f)); + } + } else { ++ size_t extra_len = strlen(extra); + for (i = 4; i < pMptCtx->mptOutLen; i++) +- sprintf(extra, "%s 0x%x ", extra, pMptCtx->mptOutBuf[i]); ++ extra_len += sprintf(extra + extra_len, " 0x%x ", pMptCtx->mptOutBuf[i]); + } + + exit: +diff --git a/drivers/net/wireless/rockchip_wlan/rtl8822be/core/rtw_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8822be/core/rtw_mp.c +index 98054d1338a2..590b4ac87825 100644 +--- a/drivers/net/wireless/rockchip_wlan/rtl8822be/core/rtw_mp.c ++++ b/drivers/net/wireless/rockchip_wlan/rtl8822be/core/rtw_mp.c +@@ -2076,14 +2076,17 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data) + + data[0] = '\0'; + +- i = psd_start; +- while (i < psd_stop) { +- if (i >= psd_pts) +- psd_data = rtw_GetPSDData(pAdapter, i - psd_pts); +- else +- psd_data = rtw_GetPSDData(pAdapter, i); +- sprintf(data, "%s%x ", data, psd_data); +- i++; ++ { ++ size_t extra_len = strlen(data); ++ i = psd_start; ++ while (i < psd_stop) { ++ if (i >= psd_pts) ++ psd_data = rtw_GetPSDData(pAdapter, i - psd_pts); ++ else ++ psd_data = rtw_GetPSDData(pAdapter, i); ++ extra_len += sprintf(data + extra_len, "%x ", psd_data); ++ i++; ++ } + } + + #ifdef CONFIG_LONG_DELAY_ISSUE +diff --git a/drivers/net/wireless/rockchip_wlan/rtl8822be/os_dep/linux/ioctl_linux.c b/drivers/net/wireless/rockchip_wlan/rtl8822be/os_dep/linux/ioctl_linux.c +index be44a62c438b..d80c366700b6 100644 +--- a/drivers/net/wireless/rockchip_wlan/rtl8822be/os_dep/linux/ioctl_linux.c ++++ b/drivers/net/wireless/rockchip_wlan/rtl8822be/os_dep/linux/ioctl_linux.c +@@ -9059,6 +9059,7 @@ static int rtw_mp_efuse_get(struct net_device *dev, + #ifdef CONFIG_IOL + u8 org_fw_iol = padapter->registrypriv.fw_iol;/* 0:Disable, 1:enable, 2:by usb speed */ + #endif ++ size_t extra_len; + + wrqu = (struct iw_point *)wdata; + pwrctrlpriv = adapter_to_pwrctl(padapter); +@@ -9114,22 +9115,22 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } else if (strcmp(tmp[0], "drvmap") == 0) { + EFUSE_GetEfuseDefinition(padapter, EFUSE_WIFI, TYPE_EFUSE_MAP_LEN, (void *)&mapLen, _FALSE); + +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < mapLen; i += 16) { + /*RTW_INFO("0x%02x\t", i);*/ +- sprintf(extra, "%s0x%02x\t", extra, i); ++ extra_len += sprintf(extra + extra_len, "0x%02x\t", i); + for (j = 0; j < 8; j++) { + /* RTW_INFO("%02X ", data[i+j]); */ +- sprintf(extra, "%s%02X ", extra, PROMContent[i + j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", PROMContent[i + j]); + } + /* RTW_INFO("\t"); */ +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j < 16; j++) { + /* RTW_INFO("%02X ", data[i+j]); */ +- sprintf(extra, "%s%02X ", extra, PROMContent[i + j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", PROMContent[i + j]); + } + /* RTW_INFO("\n"); */ +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + /* RTW_INFO("\n"); */ + } else if (strcmp(tmp[0], "realmap") == 0) { +@@ -9169,18 +9170,18 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } else + order = 0; + +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < cnt; i += 16) { +- sprintf(extra, "%s0x%02x\t", extra, shift + i); ++ extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i); + for (j = 0; j < 8; j++) +- sprintf(extra, "%s%02X ", extra, efuse[i + j]); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j < 16; j++) +- sprintf(extra, "%s%02X ", extra, efuse[i + j]); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + if ((shift + cnt) < mapLen) +- sprintf(extra, "%s\t...more\n", extra); ++ extra_len += sprintf(extra + extra_len, "\t...more\n"); + } else if (strcmp(tmp[0], "rmap") == 0) { + if ((tmp[1] == NULL) || (tmp[2] == NULL)) { + RTW_INFO("%s: rmap Fail!! Parameters error!\n", __FUNCTION__); +@@ -9215,9 +9216,10 @@ static int rtw_mp_efuse_get(struct net_device *dev, + + /* RTW_INFO("%s: data={", __FUNCTION__); */ + *extra = 0; ++ extra_len = 0; + for (i = 0; i < cnts; i++) { + /* RTW_INFO("0x%02x ", data[i]); */ +- sprintf(extra, "%s0x%02X ", extra, data[i]); ++ extra_len += sprintf(extra + extra_len, "0x%02X ", data[i]); + } + /* RTW_INFO("}\n"); */ + } else if (strcmp(tmp[0], "realraw") == 0) { +@@ -9244,18 +9246,18 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } else + raw_order = 0; + +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < cnt; i += 16) { +- sprintf(extra, "%s0x%02x\t", extra, shift + i); ++ extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i); + for (j = 0; j < 8; j++) +- sprintf(extra, "%s%02X ", extra, rawdata[i + j]); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", rawdata[i + j]); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j < 16; j++) +- sprintf(extra, "%s%02X ", extra, rawdata[i + j]); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", rawdata[i + j]); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + if ((shift + cnt) < mapLen) +- sprintf(extra, "%s\t...more (left:%d/%d)\n", extra, mapLen-(shift + cnt), mapLen); ++ extra_len += sprintf(extra + extra_len, "\t...more (left:%d/%d)\n", mapLen-(shift + cnt), mapLen); + + } else if (strcmp(tmp[0], "btrealraw") == 0) { + static u8 bt_raw_order = 0; +@@ -9290,19 +9292,19 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } else + bt_raw_order = 0; + +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < cnt; i += 16) { +- sprintf(extra, "%s0x%02x\t", extra, shift + i); ++ extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i); + for (j = 0; j < 8; j++) +- sprintf(extra, "%s%02X ", extra, rawdata[i + j]); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", rawdata[i + j]); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j < 16; j++) +- sprintf(extra, "%s%02X ", extra, rawdata[i + j]); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", rawdata[i + j]); ++ extra_len += sprintf(extra + extra_len, "\n"); + + } + if ((shift + cnt) < mapLen) +- sprintf(extra, "%s\t...more (left:%d/%d)\n", extra, mapLen-(shift + cnt), mapLen); ++ extra_len += sprintf(extra + extra_len, "\t...more (left:%d/%d)\n", mapLen-(shift + cnt), mapLen); + } else if (strcmp(tmp[0], "mac") == 0) { + if (hal_efuse_macaddr_offset(padapter) == -1) { + err = -EFAULT; +@@ -9327,12 +9329,13 @@ static int rtw_mp_efuse_get(struct net_device *dev, + + /* RTW_INFO("%s: MAC address={", __FUNCTION__); */ + *extra = 0; ++ extra_len = 0; + for (i = 0; i < cnts; i++) { + /* RTW_INFO("%02X", data[i]); */ +- sprintf(extra, "%s%02X", extra, data[i]); ++ extra_len += sprintf(extra + extra_len, "%02X", data[i]); + if (i != (cnts - 1)) { + /* RTW_INFO(":"); */ +- sprintf(extra, "%s:", extra); ++ extra_len += sprintf(extra + extra_len, ":"); + } + } + /* RTW_INFO("}\n"); */ +@@ -9390,12 +9393,13 @@ static int rtw_mp_efuse_get(struct net_device *dev, + + /* RTW_INFO("%s: {VID,PID}={", __FUNCTION__); */ + *extra = 0; ++ extra_len = 0; + for (i = 0; i < cnts; i++) { + /* RTW_INFO("0x%02x", data[i]); */ +- sprintf(extra, "%s0x%02X", extra, data[i]); ++ extra_len += sprintf(extra + extra_len, "0x%02X", data[i]); + if (i != (cnts - 1)) { + /* RTW_INFO(","); */ +- sprintf(extra, "%s,", extra); ++ extra_len += sprintf(extra + extra_len, ","); + } + } + /* RTW_INFO("}\n"); */ +@@ -9423,22 +9427,22 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } + + /* RTW_INFO("OFFSET\tVALUE(hex)\n"); */ +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < 512; i += 16) { /* set 512 because the iwpriv's extra size have limit 0x7FF */ + /* RTW_INFO("0x%03x\t", i); */ +- sprintf(extra, "%s0x%03x\t", extra, i); ++ extra_len += sprintf(extra + extra_len, "0x%03x\t", i); + for (j = 0; j < 8; j++) { + /* RTW_INFO("%02X ", pEfuseHal->BTEfuseInitMap[i+j]); */ +- sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i + j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i + j]); + } + /* RTW_INFO("\t"); */ +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j < 16; j++) { + /* RTW_INFO("%02X ", pEfuseHal->BTEfuseInitMap[i+j]); */ +- sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i + j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i + j]); + } + /* RTW_INFO("\n"); */ +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + /* RTW_INFO("\n"); */ + } else if (strcmp(tmp[0], "btbmap") == 0) { +@@ -9452,22 +9456,22 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } + + /* RTW_INFO("OFFSET\tVALUE(hex)\n"); */ +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 512; i < 1024 ; i += 16) { + /* RTW_INFO("0x%03x\t", i); */ +- sprintf(extra, "%s0x%03x\t", extra, i); ++ extra_len += sprintf(extra + extra_len, "0x%03x\t", i); + for (j = 0; j < 8; j++) { + /* RTW_INFO("%02X ", data[i+j]); */ +- sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i + j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i + j]); + } + /* RTW_INFO("\t"); */ +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j < 16; j++) { + /* RTW_INFO("%02X ", data[i+j]); */ +- sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i + j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i + j]); + } + /* RTW_INFO("\n"); */ +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + /* RTW_INFO("\n"); */ + } else if (strcmp(tmp[0], "btrmap") == 0) { +@@ -9517,51 +9521,52 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } + + *extra = 0; ++ extra_len = 0; + /* RTW_INFO("%s: bt efuse data={", __FUNCTION__); */ + for (i = 0; i < cnts; i++) { + /* RTW_INFO("0x%02x ", data[i]); */ +- sprintf(extra, "%s 0x%02X ", extra, data[i]); ++ extra_len += sprintf(extra + extra_len, " 0x%02X ", data[i]); + } + /* RTW_INFO("}\n"); */ + RTW_INFO(FUNC_ADPT_FMT ": BT MAC=[%s]\n", FUNC_ADPT_ARG(padapter), extra); + } else if (strcmp(tmp[0], "btffake") == 0) { + /* RTW_INFO("OFFSET\tVALUE(hex)\n"); */ +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < 512; i += 16) { + /* RTW_INFO("0x%03x\t", i); */ +- sprintf(extra, "%s0x%03x\t", extra, i); ++ extra_len += sprintf(extra + extra_len, "0x%03x\t", i); + for (j = 0; j < 8; j++) { + /* RTW_INFO("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); */ +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i + j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i + j]); + } + /* RTW_INFO("\t"); */ +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j < 16; j++) { + /* RTW_INFO("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); */ +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i + j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i + j]); + } + /* RTW_INFO("\n"); */ +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + /* RTW_INFO("\n"); */ + } else if (strcmp(tmp[0], "btbfake") == 0) { + /* RTW_INFO("OFFSET\tVALUE(hex)\n"); */ +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 512; i < 1024; i += 16) { + /* RTW_INFO("0x%03x\t", i); */ +- sprintf(extra, "%s0x%03x\t", extra, i); ++ extra_len += sprintf(extra + extra_len, "0x%03x\t", i); + for (j = 0; j < 8; j++) { + /* RTW_INFO("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); */ +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i + j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i + j]); + } + /* RTW_INFO("\t"); */ +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j < 16; j++) { + /* RTW_INFO("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); */ +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i + j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i + j]); + } + /* RTW_INFO("\n"); */ +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + /* RTW_INFO("\n"); */ + } else if (strcmp(tmp[0], "wlrfkmap") == 0) { +@@ -9582,18 +9587,18 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } else + fk_order = 0; + +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < cnt; i += 16) { +- sprintf(extra, "%s0x%02x\t", extra, shift + i); ++ extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i); + for (j = 0; j < 8; j++) +- sprintf(extra, "%s%02X ", extra, efuse[i + j]); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j < 16; j++) +- sprintf(extra, "%s%02X ", extra, efuse[i + j]); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + if ((shift + cnt) < mapLen) +- sprintf(extra, "%s\t...more\n", extra); ++ extra_len += sprintf(extra + extra_len, "\t...more\n"); + + } else if (strcmp(tmp[0], "wlrfkrmap") == 0) { + if ((tmp[1] == NULL) || (tmp[2] == NULL)) { +@@ -9615,9 +9620,10 @@ static int rtw_mp_efuse_get(struct net_device *dev, + + /* RTW_INFO("%s: data={", __FUNCTION__); */ + *extra = 0; ++ extra_len = 0; + for (i = 0; i < cnts; i++) { + RTW_INFO("wlrfkrmap = 0x%02x\n", pEfuseHal->fakeEfuseModifiedMap[addr + i]); +- sprintf(extra, "%s0x%02X ", extra, pEfuseHal->fakeEfuseModifiedMap[addr + i]); ++ extra_len += sprintf(extra + extra_len, "0x%02X ", pEfuseHal->fakeEfuseModifiedMap[addr + i]); + } + } else if (strcmp(tmp[0], "btrfkrmap") == 0) { + if ((tmp[1] == NULL) || (tmp[2] == NULL)) { +@@ -9639,9 +9645,10 @@ static int rtw_mp_efuse_get(struct net_device *dev, + + /* RTW_INFO("%s: data={", __FUNCTION__); */ + *extra = 0; ++ extra_len = 0; + for (i = 0; i < cnts; i++) { + RTW_INFO("wlrfkrmap = 0x%02x\n", pEfuseHal->fakeBTEfuseModifiedMap[addr + i]); +- sprintf(extra, "%s0x%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[addr + i]); ++ extra_len += sprintf(extra + extra_len, "0x%02X ", pEfuseHal->fakeBTEfuseModifiedMap[addr + i]); + } + } else + sprintf(extra, "Command not found!"); +diff --git a/drivers/net/wireless/rockchip_wlan/rtl8822be/os_dep/linux/ioctl_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8822be/os_dep/linux/ioctl_mp.c +index ce3484d36fd1..c304e81e0a57 100644 +--- a/drivers/net/wireless/rockchip_wlan/rtl8822be/os_dep/linux/ioctl_mp.c ++++ b/drivers/net/wireless/rockchip_wlan/rtl8822be/os_dep/linux/ioctl_mp.c +@@ -198,7 +198,7 @@ int rtw_mp_read_reg(struct net_device *dev, + if (*pnext != '\0') { + /*strtout = simple_strtoul(pnext , &ptmp, 16);*/ + ret = sscanf(pnext, "%x", &strtout); +- sprintf(extra, "%s %d" , extra , strtout); ++ sprintf(extra + strlen(extra), " %d", strtout); + } else + break; + pch = pnext; +@@ -230,7 +230,7 @@ int rtw_mp_read_reg(struct net_device *dev, + pnext++; + if (*pnext != '\0') { + ret = sscanf(pnext, "%x", &strtout); +- sprintf(extra, "%s %d" , extra , strtout); ++ sprintf(extra + strlen(extra), " %d", strtout); + } else + break; + pch = pnext; +@@ -341,20 +341,23 @@ int rtw_mp_read_rf(struct net_device *dev, + pch = tmp; + RTW_INFO("pch=%s", pch); + +- while (*pch != '\0') { +- pnext = strpbrk(pch, " "); +- if (!pnext) +- break; +- pnext++; +- if (*pnext != '\0') { +- /*strtou =simple_strtoul(pnext , &ptmp, 16);*/ +- ret = sscanf(pnext, "%x", &strtou); +- sprintf(extra, "%s %d" , extra , strtou); +- } else +- break; +- pch = pnext; ++ { ++ size_t extra_len = strlen(extra); ++ while (*pch != '\0') { ++ pnext = strpbrk(pch, " "); ++ if (!pnext) ++ break; ++ pnext++; ++ if (*pnext != '\0') { ++ /*strtou =simple_strtoul(pnext , &ptmp, 16);*/ ++ ret = sscanf(pnext, "%x", &strtou); ++ extra_len += sprintf(extra + extra_len, " %d", strtou); ++ } else ++ break; ++ pch = pnext; ++ } ++ wrqu->length = extra_len; + } +- wrqu->length = strlen(extra); + + return 0; + } +@@ -1412,7 +1415,7 @@ int rtw_mp_pretx_proc(PADAPTER padapter, u8 bStartTest, char *extra) + pmp_priv->mode = MP_ON; + sprintf(extra, "Stop continuous Tx"); + } else if (pmp_priv->tx.stop == 1) { +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500 count=%u\n", extra, pmp_priv->tx.count); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500 count=%u\n", pmp_priv->tx.count); + pmp_priv->tx.stop = 0; + SetPacketTx(padapter); + } else +@@ -1420,26 +1423,26 @@ int rtw_mp_pretx_proc(PADAPTER padapter, u8 bStartTest, char *extra) + return 0; + case MP_SINGLE_TONE_TX: + if (bStartTest != 0) +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes."); + SetSingleToneTx(padapter, (u8)bStartTest); + break; + case MP_CONTINUOUS_TX: + if (bStartTest != 0) +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes."); + SetContinuousTx(padapter, (u8)bStartTest); + break; + case MP_CARRIER_SUPPRISSION_TX: + if (bStartTest != 0) { + if (HwRateToMPTRate(pmp_priv->rateidx) <= MPT_RATE_11M) +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes."); + else +- sprintf(extra, "%s\nSpecify carrier suppression but not CCK rate", extra); ++ sprintf(extra + strlen(extra), "\nSpecify carrier suppression but not CCK rate"); + } + SetCarrierSuppressionTx(padapter, (u8)bStartTest); + break; + case MP_SINGLE_CARRIER_TX: + if (bStartTest != 0) +- sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra); ++ sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes."); + SetSingleCarrierTx(padapter, (u8)bStartTest); + break; + +@@ -1517,13 +1520,13 @@ int rtw_mp_tx(struct net_device *dev, + return 0; + } else if (strncmp(extra, "setting", 7) == 0) { + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "Current Setting :\n Channel:%d", pmp_priv->channel); +- sprintf(extra, "%s\n Bandwidth:%d", extra, pmp_priv->bandwidth); +- sprintf(extra, "%s\n Rate index:%d", extra, pmp_priv->rateidx); +- sprintf(extra, "%s\n TxPower index:%d", extra, pmp_priv->txpoweridx); +- sprintf(extra, "%s\n Antenna TxPath:%d", extra, pmp_priv->antenna_tx); +- sprintf(extra, "%s\n Antenna RxPath:%d", extra, pmp_priv->antenna_rx); +- sprintf(extra, "%s\n MP Mode:%d", extra, pmp_priv->mode); ++ extra_len = sprintf(extra, "Current Setting :\n Channel:%d", pmp_priv->channel); ++ extra_len += sprintf(extra + extra_len, "\n Bandwidth:%d", pmp_priv->bandwidth); ++ extra_len += sprintf(extra + extra_len, "\n Rate index:%d", pmp_priv->rateidx); ++ extra_len += sprintf(extra + extra_len, "\n TxPower index:%d", pmp_priv->txpoweridx); ++ extra_len += sprintf(extra + extra_len, "\n Antenna TxPath:%d", pmp_priv->antenna_tx); ++ extra_len += sprintf(extra + extra_len, "\n Antenna RxPath:%d", pmp_priv->antenna_rx); ++ extra_len += sprintf(extra + extra_len, "\n MP Mode:%d", pmp_priv->mode); + wrqu->data.length = strlen(extra); + return 0; + #ifdef CONFIG_MP_VHT_HW_TX_MODE +@@ -1661,25 +1664,25 @@ int rtw_mp_tx(struct net_device *dev, + if (sscanf(extra, "ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d", &channel, &bandwidth, &rate, &txpower, &ant, &txmode) < 6) { + RTW_INFO("Invalid format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "\n Please input correct format as bleow:\n"); +- sprintf(extra, "%s\t ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d\n", extra, channel, bandwidth, rate, txpower, ant, txmode); +- sprintf(extra, "%s\n [ ch : BGN = <1~14> , A or AC = <36~165> ]", extra); +- sprintf(extra, "%s\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]", extra); +- sprintf(extra, "%s\n [ rate : CCK: 1 2 5.5 11M X 2 = < 2 4 11 22 >]", extra); +- sprintf(extra, "%s\n [ OFDM: 6 9 12 18 24 36 48 54M X 2 = < 12 18 24 36 48 72 96 108>", extra); +- sprintf(extra, "%s\n [ HT 1S2SS MCS0 ~ MCS15 : < [MCS0]=128 ~ [MCS7]=135 ~ [MCS15]=143 >", extra); +- sprintf(extra, "%s\n [ HT 3SS MCS16 ~ MCS32 : < [MCS16]=144 ~ [MCS23]=151 ~ [MCS32]=159 >", extra); +- sprintf(extra, "%s\n [ VHT 1SS MCS0 ~ MCS9 : < [MCS0]=160 ~ [MCS9]=169 >", extra); +- sprintf(extra, "%s\n [ txpower : 1~63 power index", extra); +- sprintf(extra, "%s\n [ ant : ,2T ex: AB=3 BC=6 CD=12", extra); +- sprintf(extra, "%s\n [ txmode : < 0 = CONTINUOUS_TX, 1 = PACKET_TX, 2 = SINGLE_TONE_TX, 3 = CARRIER_SUPPRISSION_TX, 4 = SINGLE_CARRIER_TX>\n", extra); ++ extra_len = sprintf(extra, "\n Please input correct format as bleow:\n"); ++ extra_len += sprintf(extra + extra_len, "\t ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d\n", channel, bandwidth, rate, txpower, ant, txmode); ++ extra_len += sprintf(extra + extra_len, "\n [ ch : BGN = <1~14> , A or AC = <36~165> ]"); ++ extra_len += sprintf(extra + extra_len, "\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]"); ++ extra_len += sprintf(extra + extra_len, "\n [ rate : CCK: 1 2 5.5 11M X 2 = < 2 4 11 22 >]"); ++ extra_len += sprintf(extra + extra_len, "\n [ OFDM: 6 9 12 18 24 36 48 54M X 2 = < 12 18 24 36 48 72 96 108>"); ++ extra_len += sprintf(extra + extra_len, "\n [ HT 1S2SS MCS0 ~ MCS15 : < [MCS0]=128 ~ [MCS7]=135 ~ [MCS15]=143 >"); ++ extra_len += sprintf(extra + extra_len, "\n [ HT 3SS MCS16 ~ MCS32 : < [MCS16]=144 ~ [MCS23]=151 ~ [MCS32]=159 >"); ++ extra_len += sprintf(extra + extra_len, "\n [ VHT 1SS MCS0 ~ MCS9 : < [MCS0]=160 ~ [MCS9]=169 >"); ++ extra_len += sprintf(extra + extra_len, "\n [ txpower : 1~63 power index"); ++ extra_len += sprintf(extra + extra_len, "\n [ ant : ,2T ex: AB=3 BC=6 CD=12"); ++ extra_len += sprintf(extra + extra_len, "\n [ txmode : < 0 = CONTINUOUS_TX, 1 = PACKET_TX, 2 = SINGLE_TONE_TX, 3 = CARRIER_SUPPRISSION_TX, 4 = SINGLE_CARRIER_TX>\n"); + wrqu->data.length = strlen(extra); + return status; + + } else { + RTW_INFO("Got format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); ++ extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); + padapter->mppriv.channel = channel; + SetChannel(padapter); + pHalData->CurrentChannel = channel; +@@ -1688,13 +1691,13 @@ int rtw_mp_tx(struct net_device *dev, + bandwidth = CHANNEL_WIDTH_40; + else if (bandwidth == 2) + bandwidth = CHANNEL_WIDTH_80; +- sprintf(extra, "%s\nChange Current Bandwidth %d to Bandwidth %d", extra, padapter->mppriv.bandwidth , bandwidth); ++ extra_len += sprintf(extra + extra_len, "\nChange Current Bandwidth %d to Bandwidth %d", padapter->mppriv.bandwidth , bandwidth); + padapter->mppriv.bandwidth = (u8)bandwidth; + padapter->mppriv.preamble = sg; + SetBandwidth(padapter); + pHalData->CurrentChannelBW = bandwidth; + +- sprintf(extra, "%s\nSet power level :%d", extra, txpower); ++ extra_len += sprintf(extra + extra_len, "\nSet power level :%d", txpower); + padapter->mppriv.txpoweridx = (u8)txpower; + pMptCtx->TxPwrLevel[ODM_RF_PATH_A] = (u8)txpower; + pMptCtx->TxPwrLevel[ODM_RF_PATH_B] = (u8)txpower; +@@ -1717,13 +1720,13 @@ int rtw_mp_tx(struct net_device *dev, + RTW_INFO("%s: rate index=%d\n", __func__, rate); + if (rate >= MPT_RATE_LAST) + return -EINVAL; +- sprintf(extra, "%s\nSet data rate to %d index %d", extra, padapter->mppriv.rateidx, rate); ++ extra_len += sprintf(extra + extra_len, "\nSet data rate to %d index %d", padapter->mppriv.rateidx, rate); + + padapter->mppriv.rateidx = rate; + pMptCtx->MptRateIndex = rate; + SetDataRate(padapter); + +- sprintf(extra, "%s\nSet Antenna Path :%d", extra, ant); ++ extra_len += sprintf(extra + extra_len, "\nSet Antenna Path :%d", ant); + switch (ant) { + case 1: + antenna = ANTENNA_A; +@@ -1800,6 +1803,7 @@ int rtw_mp_rx(struct net_device *dev, + struct iw_request_info *info, + union iwreq_data *wrqu, char *extra) + { ++ size_t extra_len; + PADAPTER padapter = rtw_netdev_priv(dev); + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(padapter); + struct mp_priv *pmp_priv = &padapter->mppriv; +@@ -1831,19 +1835,19 @@ int rtw_mp_rx(struct net_device *dev, + } else if (sscanf(extra, "ch=%d,bw=%d,ant=%d", &channel, &bandwidth, &ant) < 3) { + RTW_INFO("Invalid format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "\n Please input correct format as bleow:\n"); +- sprintf(extra, "%s\t ch=%d,bw=%d,ant=%d\n", extra, channel, bandwidth, ant); +- sprintf(extra, "%s\n [ ch : BGN = <1~14> , A or AC = <36~165> ]", extra); +- sprintf(extra, "%s\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]", extra); +- sprintf(extra, "%s\n [ ant : ,2T ex: AB=3 BC=6 CD=12", extra); +- wrqu->data.length = strlen(extra); ++ extra_len = sprintf(extra, "\n Please input correct format as bleow:\n"); ++ extra_len += sprintf(extra + extra_len, "\t ch=%d,bw=%d,ant=%d\n", channel, bandwidth, ant); ++ extra_len += sprintf(extra + extra_len, "\n [ ch : BGN = <1~14> , A or AC = <36~165> ]"); ++ extra_len += sprintf(extra + extra_len, "\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]"); ++ extra_len += sprintf(extra + extra_len, "\n [ ant : ,2T ex: AB=3 BC=6 CD=12"); ++ wrqu->data.length = extra_len; + return 0; + + } else { + bStartRx = 1; + RTW_INFO("Got format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); ++ extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); + padapter->mppriv.channel = channel; + SetChannel(padapter); + pHalData->CurrentChannel = channel; +@@ -1852,13 +1856,13 @@ int rtw_mp_rx(struct net_device *dev, + bandwidth = CHANNEL_WIDTH_40; + else if (bandwidth == 2) + bandwidth = CHANNEL_WIDTH_80; +- sprintf(extra, "%s\nChange Current Bandwidth %d to Bandwidth %d", extra, padapter->mppriv.bandwidth , bandwidth); ++ extra_len += sprintf(extra + extra_len, "\nChange Current Bandwidth %d to Bandwidth %d", padapter->mppriv.bandwidth , bandwidth); + padapter->mppriv.bandwidth = (u8)bandwidth; + padapter->mppriv.preamble = sg; + SetBandwidth(padapter); + pHalData->CurrentChannelBW = bandwidth; + +- sprintf(extra, "%s\nSet Antenna Path :%d", extra, ant); ++ extra_len += sprintf(extra + extra_len, "\nSet Antenna Path :%d", ant); + switch (ant) { + case 1: + antenna = ANTENNA_A; +@@ -1909,7 +1913,7 @@ int rtw_mp_rx(struct net_device *dev, + pHalData->AntennaTxPath = antenna; + SetAntenna(padapter); + +- sprintf(extra, "%s\nstart Rx", extra); ++ extra_len += sprintf(extra + extra_len, "\nstart Rx"); + SetPacketRx(padapter, bStartRx, _FALSE); + } + wrqu->data.length = strlen(extra); +@@ -1951,6 +1955,7 @@ int rtw_efuse_mask_file(struct net_device *dev, + char *rtw_efuse_mask_file_path; + u8 Status; + PADAPTER padapter = rtw_netdev_priv(dev); ++ size_t extra_len; + + _rtw_memset(maskfileBuffer, 0x00, sizeof(maskfileBuffer)); + +@@ -2339,16 +2344,17 @@ todo: + mptbt_BtControlProcess(padapter, &BtReq); + + if (readtherm == 0) { +- sprintf(extra, "BT thermal="); ++ size_t extra_len = sprintf(extra, "BT thermal="); + for (i = 4; i < pMptCtx->mptOutLen; i++) { + if ((pMptCtx->mptOutBuf[i] == 0x00) && (pMptCtx->mptOutBuf[i + 1] == 0x00)) + goto exit; + +- sprintf(extra, "%s %d ", extra, (pMptCtx->mptOutBuf[i] & 0x1f)); ++ extra_len += sprintf(extra + extra_len, " %d ", (pMptCtx->mptOutBuf[i] & 0x1f)); + } + } else { ++ size_t extra_len = strlen(extra); + for (i = 4; i < pMptCtx->mptOutLen; i++) +- sprintf(extra, "%s 0x%x ", extra, pMptCtx->mptOutBuf[i]); ++ extra_len += sprintf(extra + extra_len, " 0x%x ", pMptCtx->mptOutBuf[i]); + } + + exit: +diff --git a/drivers/net/wireless/rtl8192cu/core/rtw_mp.c b/drivers/net/wireless/rtl8192cu/core/rtw_mp.c +index 9af42cdc980a..73be688b5fed 100755 +--- a/drivers/net/wireless/rtl8192cu/core/rtw_mp.c ++++ b/drivers/net/wireless/rtl8192cu/core/rtw_mp.c +@@ -1276,7 +1276,7 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data) + { + u32 i, psd_pts=0, psd_start=0, psd_stop=0; + u32 psd_data=0; +- ++ size_t data_len = 0; + #ifdef PLATFORM_LINUX + if (!netif_running(pAdapter->pnetdev)) { + RT_TRACE(_module_mp_, _drv_warning_, ("mp_query_psd: Fail! interface not opened!\n")); +@@ -1307,7 +1307,7 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data) + } else { + psd_data = GetPSDData(pAdapter, i); + } +- sprintf(data, "%s%x ", data, psd_data); ++ data_len += sprintf(data + data_len, "%x ", psd_data); + i++; + } + +diff --git a/drivers/net/wireless/rtl8192cu/os_dep/linux/ioctl_linux.c b/drivers/net/wireless/rtl8192cu/os_dep/linux/ioctl_linux.c +index 9adbeaf16cf8..3e067fe7422c 100755 +--- a/drivers/net/wireless/rtl8192cu/os_dep/linux/ioctl_linux.c ++++ b/drivers/net/wireless/rtl8192cu/os_dep/linux/ioctl_linux.c +@@ -8668,6 +8668,7 @@ static int rtw_mp_efuse_get(struct net_device *dev, + u16 mapLen=0; + char *pch, *ptmp, *token, *tmp[3]={0x00,0x00,0x00}; + u16 addr = 0, cnts = 0, max_available_size = 0,raw_cursize = 0 ,raw_maxsize = 0; ++ size_t extra_len; + + _rtw_memset(data, '\0', sizeof(data)); + _rtw_memset(rawdata, '\0', sizeof(rawdata)); +@@ -8701,27 +8702,27 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } + _rtw_memset(extra, '\0', sizeof(extra)); + DBG_871X("\tOFFSET\tVALUE(hex)\n"); +- sprintf(extra, "%s \n", extra); ++ extra_len = sprintf(extra, " \n"); + for ( i = 0; i < EFUSE_MAP_SIZE; i += 16 ) + { + DBG_871X("\t0x%02x\t", i); +- sprintf(extra, "%s \t0x%02x\t", extra,i); ++ extra_len += sprintf(extra + extra_len, " \t0x%02x\t",i); + for (j = 0; j < 8; j++) + { + DBG_871X("%02X ", data[i+j]); +- sprintf(extra, "%s %02X", extra, data[i+j]); ++ extra_len += sprintf(extra + extra_len, " %02X", data[i+j]); + } + DBG_871X("\t"); +- sprintf(extra,"%s\t",extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j < 16; j++){ + DBG_871X("%02X ", data[i+j]); +- sprintf(extra, "%s %02X", extra, data[i+j]); ++ extra_len += sprintf(extra + extra_len, " %02X", data[i+j]); + } + DBG_871X("\n"); +- sprintf(extra,"%s\n",extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + DBG_871X("\n"); +- wrqu->length = strlen(extra); ++ wrqu->length = extra_len; + + return 0; + } +@@ -8753,14 +8754,15 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } + + _rtw_memset(extra, '\0', sizeof(extra)); ++ extra_len = 0; + for ( i = 0; i < cnts; i ++) { + DBG_871X("0x%02x", data[i]); +- sprintf(extra, "%s 0x%02X", extra, data[i]); ++ extra_len += sprintf(extra + extra_len, " 0x%02X", data[i]); + DBG_871X(" "); +- sprintf(extra,"%s ",extra); ++ extra_len += sprintf(extra + extra_len, " "); + } + +- wrqu->length = strlen(extra)+1; ++ wrqu->length = extra_len; + + DBG_871X("extra = %s ", extra); + +@@ -8780,20 +8782,21 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } + + _rtw_memset(extra, '\0', sizeof(extra)); ++ extra_len = 0; + for ( i=0; ilength = strlen(extra); ++ wrqu->length = extra_len; + return 0; + } + else if ( strcmp(tmp[0],"mac") == 0 ) { +@@ -8819,13 +8822,14 @@ static int rtw_mp_efuse_get(struct net_device *dev, + DBG_871X("rtw_efuse_access ok \n"); + } + _rtw_memset(extra, '\0', sizeof(extra)); ++ extra_len = 0; + for ( i = 0; i < cnts; i ++) { + DBG_871X("0x%02x", data[i]); +- sprintf(extra, "%s 0x%02X", extra, data[i+j]); ++ extra_len += sprintf(extra + extra_len, " 0x%02X", data[i+j]); + DBG_871X(" "); +- sprintf(extra,"%s ",extra); ++ extra_len += sprintf(extra + extra_len, " "); + } +- wrqu->length = strlen(extra); ++ wrqu->length = extra_len; + return 0; + } + else if ( strcmp(tmp[0],"vidpid") == 0 ) { +@@ -8850,26 +8854,29 @@ static int rtw_mp_efuse_get(struct net_device *dev, + DBG_871X("rtw_efuse_access ok \n"); + } + _rtw_memset(extra, '\0', sizeof(extra)); ++ extra_len = 0; + for ( i = 0; i < cnts; i ++) { + DBG_871X("0x%02x", data[i]); +- sprintf(extra, "%s 0x%02X", extra, data[i+j]); ++ extra_len += sprintf(extra + extra_len, " 0x%02X", data[i+j]); + DBG_871X(" "); +- sprintf(extra,"%s ",extra); ++ extra_len += sprintf(extra + extra_len, " "); + } +- wrqu->length = strlen(extra); ++ wrqu->length = extra_len; + return 0; + } + else if ( strcmp(tmp[0],"ableraw") == 0 ) { + efuse_GetCurrentSize(padapter,&raw_cursize); + raw_maxsize = efuse_GetMaxSize(padapter); +- sprintf(extra, "%s : [ available raw size] = %d",extra,raw_maxsize-raw_cursize); +- wrqu->length = strlen(extra); ++ extra_len = strlen(extra); ++ extra_len += sprintf(extra + extra_len, " : [ available raw size] = %d",raw_maxsize-raw_cursize); ++ wrqu->length = extra_len; + + return 0; + }else + { +- sprintf(extra, "%s : Command not found\n",extra); +- wrqu->length = strlen(extra); ++ extra_len = strlen(extra); ++ extra_len += sprintf(extra + extra_len, " : Command not found\n"); ++ wrqu->length = extra_len; + return 0; + } + +@@ -9140,6 +9147,7 @@ static int rtw_mp_read_reg(struct net_device *dev, + //u32 *data = (u32*)extra; + u32 ret, i=0, j=0, strtout=0; + PADAPTER padapter = rtw_netdev_priv(dev); ++ size_t extra_len; + + if (wrqu->length > 128) return -EFAULT; + +@@ -9190,6 +9198,7 @@ static int rtw_mp_read_reg(struct net_device *dev, + pch = tmp; + DBG_871X("pch=%s",pch); + ++ extra_len = strlen(extra); + while( *pch != '\0' ) + { + pnext = strpbrk(pch, " "); +@@ -9197,7 +9206,7 @@ static int rtw_mp_read_reg(struct net_device *dev, + if ( *pnext != '\0' ) + { + strtout = simple_strtoul (pnext , &ptmp, 16); +- sprintf( extra, "%s %d" ,extra ,strtout ); ++ extra_len += sprintf( extra + extra_len, " %d", strtout ); + } + else{ + break; +@@ -9224,6 +9233,7 @@ static int rtw_mp_read_reg(struct net_device *dev, + pch = tmp; + DBG_871X("pch=%s",pch); + ++ extra_len = strlen(extra); + while( *pch != '\0' ) + { + pnext = strpbrk(pch, " "); +@@ -9231,7 +9241,7 @@ static int rtw_mp_read_reg(struct net_device *dev, + if ( *pnext != '\0' ) + { + strtout = simple_strtoul (pnext , &ptmp, 16); +- sprintf( extra, "%s %d" ,extra ,strtout ); ++ extra_len += sprintf( extra + extra_len, " %d", strtout ); + } + else{ + break; +@@ -9304,6 +9314,7 @@ static int rtw_mp_read_rf(struct net_device *dev, + u32 path, addr; + u32 ret,i=0 ,j=0,strtou=0; + PADAPTER padapter = rtw_netdev_priv(dev); ++ size_t extra_len = 0; + + + if (wrqu->length > 128) return -EFAULT; +@@ -9341,14 +9352,14 @@ static int rtw_mp_read_rf(struct net_device *dev, + if ( *pnext != '\0' ) + { + strtou = simple_strtoul (pnext , &ptmp, 16); +- sprintf( extra, "%s %d" ,extra ,strtou ); ++ extra_len += sprintf( extra + extra_len, " %d", strtou ); + } + else{ + break; + } + pch = pnext; + } +- wrqu->length = strlen(extra); ++ wrqu->length = extra_len; + + return 0; + } +diff --git a/drivers/net/wireless/rtl8812au/core/rtw_mp.c b/drivers/net/wireless/rtl8812au/core/rtw_mp.c +index c2e400df1ce5..9884bb7f8a10 100644 +--- a/drivers/net/wireless/rtl8812au/core/rtw_mp.c ++++ b/drivers/net/wireless/rtl8812au/core/rtw_mp.c +@@ -1840,7 +1840,7 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data) + { + u32 i, psd_pts=0, psd_start=0, psd_stop=0; + u32 psd_data=0; +- ++ size_t data_len = 0; + + #ifdef PLATFORM_LINUX + if (!netif_running(pAdapter->pnetdev)) { +@@ -1871,7 +1871,7 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data) + } else { + psd_data = rtw_GetPSDData(pAdapter, i); + } +- sprintf(data, "%s%x ", data, psd_data); ++ data_len += sprintf(data + data_len, "%x ", psd_data); + i++; + } + +diff --git a/drivers/net/wireless/rtl8812au/os_dep/linux/ioctl_linux.c b/drivers/net/wireless/rtl8812au/os_dep/linux/ioctl_linux.c +index 4eba681b1cb6..62f472e020f2 100644 +--- a/drivers/net/wireless/rtl8812au/os_dep/linux/ioctl_linux.c ++++ b/drivers/net/wireless/rtl8812au/os_dep/linux/ioctl_linux.c +@@ -9013,6 +9013,7 @@ static int rtw_mp_efuse_get(struct net_device *dev, + #ifdef CONFIG_IOL + u8 org_fw_iol = padapter->registrypriv.fw_iol;// 0:Disable, 1:enable, 2:by usb speed + #endif ++ size_t extra_len; + + wrqu = (struct iw_point*)wdata; + pwrctrlpriv = adapter_to_pwrctl(padapter); +@@ -9065,22 +9066,22 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } else if (strcmp(tmp[0], "drvmap") == 0) { + mapLen = EFUSE_MAP_SIZE; + +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < EFUSE_MAP_SIZE; i += 16) { + // DBG_871X("0x%02x\t", i); +- sprintf(extra, "%s0x%02x\t", extra, i); ++ extra_len += sprintf(extra + extra_len, "0x%02x\t", i); + for (j=0; j<8; j++) { + // DBG_871X("%02X ", data[i+j]); +- sprintf(extra, "%s%02X ", extra, PROMContent[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", PROMContent[i+j]); + } + // DBG_871X("\t"); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j<16; j++) { + // DBG_871X("%02X ", data[i+j]); +- sprintf(extra, "%s%02X ", extra, PROMContent[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", PROMContent[i+j]); + } + // DBG_871X("\n"); +- sprintf(extra,"%s\n",extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + // DBG_871X("\n"); + } else if (strcmp(tmp[0], "realmap") == 0) { +@@ -9092,22 +9093,22 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } + + // DBG_871X("OFFSET\tVALUE(hex)\n"); +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i = 0; i < EFUSE_MAP_SIZE; i += 16) { + // DBG_871X("0x%02x\t", i); +- sprintf(extra, "%s0x%02x\t", extra, i); ++ extra_len += sprintf(extra + extra_len, "0x%02x\t", i); + for (j=0; j<8; j++) { + // DBG_871X("%02X ", data[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeEfuseInitMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeEfuseInitMap[i+j]); + } + // DBG_871X("\t"); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j<16; j++) { + // DBG_871X("%02X ", data[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeEfuseInitMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeEfuseInitMap[i+j]); + } + // DBG_871X("\n"); +- sprintf(extra,"%s\n",extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + // DBG_871X("\n"); + } else if (strcmp(tmp[0], "rmap") == 0) { +@@ -9144,9 +9145,10 @@ static int rtw_mp_efuse_get(struct net_device *dev, + + // DBG_871X("%s: data={", __FUNCTION__); + *extra = 0; ++ extra_len = 0; + for (i=0; iBTEfuseInitMap[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]); + } + // DBG_871X("\t"); +- sprintf(extra,"%s\t",extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j<16; j++) { + // DBG_871X("%02X ", pEfuseHal->BTEfuseInitMap[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]); + } + // DBG_871X("\n"); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + // DBG_871X("\n"); + } else if (strcmp(tmp[0],"btbmap") == 0) { +@@ -9369,22 +9374,22 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } + + // DBG_871X("OFFSET\tVALUE(hex)\n"); +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i=512; i<1024 ; i+=16) { + // DBG_871X("0x%03x\t", i); +- sprintf(extra, "%s0x%03x\t", extra, i); ++ extra_len += sprintf(extra + extra_len, "0x%03x\t", i); + for (j=0; j<8; j++) { + // DBG_871X("%02X ", data[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]); + } + // DBG_871X("\t"); +- sprintf(extra,"%s\t",extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j<16; j++) { + // DBG_871X("%02X ", data[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]); + } + // DBG_871X("\n"); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + // DBG_871X("\n"); + } else if (strcmp(tmp[0],"btrmap") == 0) { +@@ -9421,71 +9426,72 @@ static int rtw_mp_efuse_get(struct net_device *dev, + } + + *extra = 0; ++ extra_len = 0; + // DBG_871X("%s: bt efuse data={", __FUNCTION__); + for (i=0; ifakeBTEfuseModifiedMap[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); + } + // DBG_871X("\t"); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j<16; j++) { + // DBG_871X("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); + } + // DBG_871X("\n"); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + // DBG_871X("\n"); + } else if (strcmp(tmp[0],"btbfake") == 0) { + // DBG_871X("OFFSET\tVALUE(hex)\n"); +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i=512; i<1024; i+=16) { + // DBG_871X("0x%03x\t", i); +- sprintf(extra, "%s0x%03x\t", extra, i); ++ extra_len += sprintf(extra + extra_len, "0x%03x\t", i); + for (j=0; j<8; j++) { + // DBG_871X("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); + } + // DBG_871X("\t"); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j<16; j++) { + // DBG_871X("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); + } + // DBG_871X("\n"); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + // DBG_871X("\n"); + } else if (strcmp(tmp[0],"wlrfkmap")== 0) { + // DBG_871X("OFFSET\tVALUE(hex)\n"); +- sprintf(extra, "\n"); ++ extra_len = sprintf(extra, "\n"); + for (i=0; ifakeEfuseModifiedMap[i+j]); +- sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeEfuseModifiedMap[i+j]); ++ extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeEfuseModifiedMap[i+j]); + } + // DBG_871X("\t"); +- sprintf(extra, "%s\t", extra); ++ extra_len += sprintf(extra + extra_len, "\t"); + for (; j<16; j++) { + // DBG_871X("%02X ", pEfuseHal->fakeEfuseModifiedMap[i+j]); +- sprintf(extra, "%s %02X", extra, pEfuseHal->fakeEfuseModifiedMap[i+j]); ++ extra_len += sprintf(extra + extra_len, " %02X", pEfuseHal->fakeEfuseModifiedMap[i+j]); + } + // DBG_871X("\n"); +- sprintf(extra, "%s\n", extra); ++ extra_len += sprintf(extra + extra_len, "\n"); + } + // DBG_871X("\n"); + +@@ -9509,9 +9515,10 @@ static int rtw_mp_efuse_get(struct net_device *dev, + + // DBG_871X("%s: data={", __FUNCTION__); + *extra = 0; ++ extra_len = 0; + for (i=0; ifakeEfuseModifiedMap[addr+i]); +- sprintf(extra, "%s0x%02X ", extra, pEfuseHal->fakeEfuseModifiedMap[addr+i]); ++ extra_len += sprintf(extra + extra_len, "0x%02X ", pEfuseHal->fakeEfuseModifiedMap[addr+i]); + } + } else if (strcmp(tmp[0],"btrfkrmap")== 0) { + if ((tmp[1]==NULL) || (tmp[2]==NULL)) { +@@ -9533,9 +9540,10 @@ static int rtw_mp_efuse_get(struct net_device *dev, + + // DBG_871X("%s: data={", __FUNCTION__); + *extra = 0; ++ extra_len = 0; + for (i=0; ifakeBTEfuseModifiedMap[addr+i]); +- sprintf(extra, "%s0x%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[addr+i]); ++ extra_len += sprintf(extra + extra_len, "0x%02X ", pEfuseHal->fakeBTEfuseModifiedMap[addr+i]); + } + } else { + sprintf(extra, "Command not found!"); +@@ -10320,6 +10328,7 @@ static int rtw_mp_read_reg(struct net_device *dev, + //u32 *data = (u32*)extra; + u32 ret, i=0, j=0, strtout=0; + PADAPTER padapter = rtw_netdev_priv(dev); ++ size_t extra_len; + + + if (wrqu->length > 128) +@@ -10370,6 +10379,7 @@ static int rtw_mp_read_reg(struct net_device *dev, + pch = tmp; + DBG_871X("pch=%s",pch); + ++ extra_len = strlen(extra); + while( *pch != '\0' ) { + pnext = strpbrk(pch, " "); + if (!pnext) +@@ -10378,7 +10388,7 @@ static int rtw_mp_read_reg(struct net_device *dev, + pnext++; + if ( *pnext != '\0' ) { + strtout = simple_strtoul (pnext , &ptmp, 16); +- sprintf( extra, "%s %d" ,extra ,strtout ); ++ extra_len += sprintf( extra + extra_len, " %d", strtout ); + } else { + break; + } +@@ -10404,6 +10414,7 @@ static int rtw_mp_read_reg(struct net_device *dev, + pch = tmp; + DBG_871X("pch=%s",pch); + ++ extra_len = strlen(extra); + while( *pch != '\0' ) { + pnext = strpbrk(pch, " "); + if (!pnext) +@@ -10412,7 +10423,7 @@ static int rtw_mp_read_reg(struct net_device *dev, + pnext++; + if ( *pnext != '\0' ) { + strtout = simple_strtoul (pnext , &ptmp, 16); +- sprintf( extra, "%s %d" ,extra ,strtout ); ++ extra_len += sprintf( extra + extra_len, " %d", strtout ); + } else { + break; + } +@@ -10490,6 +10501,7 @@ static int rtw_mp_read_rf(struct net_device *dev, + u32 path, addr; + u32 ret,i=0 ,j=0,strtou=0; + PADAPTER padapter = rtw_netdev_priv(dev); ++ size_t extra_len = 0; + + + if (wrqu->length > 128) return -EFAULT; +@@ -10525,13 +10537,13 @@ static int rtw_mp_read_rf(struct net_device *dev, + pnext++; + if ( *pnext != '\0' ) { + strtou = simple_strtoul (pnext , &ptmp, 16); +- sprintf( extra, "%s %d" ,extra ,strtou ); ++ extra_len += sprintf( extra + extra_len, " %d", strtou ); + } else { + break; + } + pch = pnext; + } +- wrqu->length = strlen(extra); ++ wrqu->length = extra_len; + + return 0; + } +@@ -11979,20 +11991,20 @@ todo: + mptbt_BtControlProcess(padapter, &BtReq); + + if (readtherm == 0) { +- sprintf(extra, "BT thermal="); ++ extra_len = sprintf(extra, "BT thermal="); + for (i=4; imptOutLen; i++) { + if ((pMptCtx->mptOutBuf[i]==0x00) && (pMptCtx->mptOutBuf[i+1]==0x00)) + goto exit; + + #ifdef CONFIG_RTL8723A +- sprintf(extra, "%s %d ", extra, (pMptCtx->mptOutBuf[i]& 0x3f)); ++ extra_len += sprintf(extra + extra_len, " %d ", (pMptCtx->mptOutBuf[i]& 0x3f)); + #else +- sprintf(extra, "%s %d ", extra, (pMptCtx->mptOutBuf[i]& 0x1f)); ++ extra_len += sprintf(extra + extra_len, " %d ", (pMptCtx->mptOutBuf[i]& 0x1f)); + #endif + } + } else { + for (i=4; imptOutLen; i++) { +- sprintf(extra, "%s 0x%x ", extra, pMptCtx->mptOutBuf[i]); ++ extra_len += sprintf(extra + extra_len, " 0x%x ", pMptCtx->mptOutBuf[i]); + } + } + +diff --git a/drivers/net/wireless/rtl8821cu/core/rtw_mp.c b/drivers/net/wireless/rtl8821cu/core/rtw_mp.c +index d966fac76f89..1cc3585750cf 100755 +--- a/drivers/net/wireless/rtl8821cu/core/rtw_mp.c ++++ b/drivers/net/wireless/rtl8821cu/core/rtw_mp.c +@@ -2423,14 +2423,17 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data) + + data[0] = '\0'; + +- i = psd_start; +- while (i < psd_stop) { +- if (i >= psd_pts) +- psd_data = rtw_GetPSDData(pAdapter, i - psd_pts); +- else +- psd_data = rtw_GetPSDData(pAdapter, i); +- sprintf(data, "%s%x ", data, psd_data); +- i++; ++ { ++ size_t extra_len = strlen(data); ++ i = psd_start; ++ while (i < psd_stop) { ++ if (i >= psd_pts) ++ psd_data = rtw_GetPSDData(pAdapter, i - psd_pts); ++ else ++ psd_data = rtw_GetPSDData(pAdapter, i); ++ extra_len += sprintf(data + extra_len, "%x ", psd_data); ++ i++; ++ } + } + + #ifdef CONFIG_LONG_DELAY_ISSUE +diff --git a/drivers/net/wireless/rtl8821cu/os_dep/linux/ioctl_mp.c b/drivers/net/wireless/rtl8821cu/os_dep/linux/ioctl_mp.c +index ad8df2d4e580..4408b3402a9f 100755 +--- a/drivers/net/wireless/rtl8821cu/os_dep/linux/ioctl_mp.c ++++ b/drivers/net/wireless/rtl8821cu/os_dep/linux/ioctl_mp.c +@@ -570,15 +570,15 @@ int rtw_mp_txpower_index(struct net_device *dev, + sprintf(extra, "patha=%d", txpower_inx); + if (phal_data->rf_type > RF_1T2R) { + txpower_inx = mpt_ProQueryCalTxPower(padapter, 1); +- sprintf(extra, "%s,pathb=%d", extra, txpower_inx); ++ sprintf(extra + strlen(extra), ",pathb=%d", txpower_inx); + } + if (phal_data->rf_type > RF_2T4R) { + txpower_inx = mpt_ProQueryCalTxPower(padapter, 2); +- sprintf(extra, "%s,pathc=%d", extra, txpower_inx); ++ sprintf(extra + strlen(extra), ",pathc=%d", txpower_inx); + } + if (phal_data->rf_type > RF_3T4R) { + txpower_inx = mpt_ProQueryCalTxPower(padapter, 3); +- sprintf(extra, "%s,pathd=%d", extra, txpower_inx); ++ sprintf(extra + strlen(extra), ",pathd=%d", txpower_inx); + } + } + wrqu->length = strlen(extra); +@@ -1820,7 +1820,7 @@ int rtw_mp_tx(struct net_device *dev, + char *pextra = extra; + RTW_INFO("Got format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); ++ pextra += sprintf(pextra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); + padapter->mppriv.channel = channel; + SetChannel(padapter); + pHalData->current_channel = channel; +@@ -2181,6 +2181,7 @@ int rtw_efuse_mask_file(struct net_device *dev, + char *ptmp, tmp; + u8 count = 0; + u8 i = 0; ++ size_t extra_len; + + ptmp = extra; + pch = strsep(&ptmp, ","); +@@ -2206,13 +2207,15 @@ int rtw_efuse_mask_file(struct net_device *dev, + + } while (count < 64); + +- for (i = 0; i < count; i++) +- sprintf(extra, "%s:%02x", extra, maskfileBuffer[i]); ++ extra_len = strlen(extra); ++ for (i = 0; i < count; i++) { ++ extra_len += sprintf(extra + extra_len, ":%02x", maskfileBuffer[i]); ++ } + + padapter->registrypriv.bFileMaskEfuse = _TRUE; + +- sprintf(extra, "%s\nLoad Efuse Mask data %d hex ok\n", extra, count); +- wrqu->data.length = strlen(extra); ++ extra_len += sprintf(extra + extra_len, "\nLoad Efuse Mask data %d hex ok\n", count); ++ wrqu->data.length = extra_len; + return 0; + } + rtw_efuse_mask_file_path = extra; +@@ -2634,16 +2637,20 @@ todo: + mptbt_BtControlProcess(padapter, &BtReq); + + if (readtherm == 0) { ++ size_t extra_len; + sprintf(extra, "BT thermal="); ++ extra_len = strlen(extra); + for (i = 4; i < pMptCtx->mptOutLen; i++) { + if ((pMptCtx->mptOutBuf[i] == 0x00) && (pMptCtx->mptOutBuf[i + 1] == 0x00)) + goto exit; + +- sprintf(extra, "%s %d ", extra, (pMptCtx->mptOutBuf[i] & 0x1f)); ++ extra_len += sprintf(extra + extra_len, " %d ", (pMptCtx->mptOutBuf[i] & 0x1f)); + } + } else { ++ size_t extra_len; ++ extra_len = strlen(extra); + for (i = 4; i < pMptCtx->mptOutLen; i++) +- sprintf(extra, "%s 0x%x ", extra, pMptCtx->mptOutBuf[i]); ++ extra_len += sprintf(extra + extra_len, " 0x%x ", pMptCtx->mptOutBuf[i]); + } + + exit: +diff --git a/drivers/net/wireless/rtl88x2bu/core/rtw_mp.c b/drivers/net/wireless/rtl88x2bu/core/rtw_mp.c +index ad9755b4da91..8272e6533fa4 100644 +--- a/drivers/net/wireless/rtl88x2bu/core/rtw_mp.c ++++ b/drivers/net/wireless/rtl88x2bu/core/rtw_mp.c +@@ -2123,14 +2123,17 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data) + + data[0] = '\0'; + +- i = psd_start; +- while (i < psd_stop) { +- if (i >= psd_pts) +- psd_data = rtw_GetPSDData(pAdapter, i - psd_pts); +- else +- psd_data = rtw_GetPSDData(pAdapter, i); +- sprintf(data, "%s%x ", data, psd_data); +- i++; ++ { ++ size_t extra_len = strlen(data); ++ i = psd_start; ++ while (i < psd_stop) { ++ if (i >= psd_pts) ++ psd_data = rtw_GetPSDData(pAdapter, i - psd_pts); ++ else ++ psd_data = rtw_GetPSDData(pAdapter, i); ++ extra_len += sprintf(data + extra_len, "%x ", psd_data); ++ i++; ++ } + } + + #ifdef CONFIG_LONG_DELAY_ISSUE +diff --git a/drivers/net/wireless/rtl88x2bu/os_dep/linux/ioctl_mp.c b/drivers/net/wireless/rtl88x2bu/os_dep/linux/ioctl_mp.c +index e82c39f6262c..0eaed1239317 100644 +--- a/drivers/net/wireless/rtl88x2bu/os_dep/linux/ioctl_mp.c ++++ b/drivers/net/wireless/rtl88x2bu/os_dep/linux/ioctl_mp.c +@@ -1795,7 +1795,7 @@ int rtw_mp_tx(struct net_device *dev, + char *pextra = extra; + RTW_INFO("Got format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode); + _rtw_memset(extra, 0, wrqu->data.length); +- sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); ++ pextra += sprintf(pextra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel); + padapter->mppriv.channel = channel; + SetChannel(padapter); + pHalData->current_channel = channel; +@@ -2159,6 +2159,7 @@ int rtw_efuse_mask_file(struct net_device *dev, + u8 count = 0; + u8 i = 0; + u32 datalen = 0; ++ size_t extra_len; + + ptmp = extra; + pch = strsep(&ptmp, ","); +@@ -2184,12 +2185,13 @@ int rtw_efuse_mask_file(struct net_device *dev, + + } while (count < 64); + ++ extra_len = strlen(extra); + for (i = 0; i < count; i++) +- sprintf(extra, "%s:%02x", extra, maskfileBuffer[i]); ++ extra_len += sprintf(extra + extra_len, ":%02x", maskfileBuffer[i]); + + padapter->registrypriv.bFileMaskEfuse = _TRUE; + +- sprintf(extra, "%s\nLoad Efuse Mask data %d hex ok\n", extra, count); ++ extra_len += sprintf(extra + extra_len, "\nLoad Efuse Mask data %d hex ok\n", count); + wrqu->data.length = strlen(extra); + return 0; + } +@@ -2612,16 +2614,18 @@ todo: + mptbt_BtControlProcess(padapter, &BtReq); + + if (readtherm == 0) { ++ size_t extra_len; + sprintf(extra, "BT thermal="); + for (i = 4; i < pMptCtx->mptOutLen; i++) { + if ((pMptCtx->mptOutBuf[i] == 0x00) && (pMptCtx->mptOutBuf[i + 1] == 0x00)) + goto exit; + +- sprintf(extra, "%s %d ", extra, (pMptCtx->mptOutBuf[i] & 0x1f)); ++ extra_len += sprintf(extra + extra_len, " %d ", (pMptCtx->mptOutBuf[i] & 0x1f)); + } + } else { ++ size_t extra_len; + for (i = 4; i < pMptCtx->mptOutLen; i++) +- sprintf(extra, "%s 0x%x ", extra, pMptCtx->mptOutBuf[i]); ++ extra_len += sprintf(extra + extra_len, " 0x%x ", pMptCtx->mptOutBuf[i]); + } + + exit: +diff --git a/drivers/net/wireless/ti/wlcore/boot.c b/drivers/net/wireless/ti/wlcore/boot.c +index 19b7ec7b69c2..fe642b354a84 100644 +--- a/drivers/net/wireless/ti/wlcore/boot.c ++++ b/drivers/net/wireless/ti/wlcore/boot.c +@@ -87,6 +87,7 @@ static int wlcore_validate_fw_ver(struct wl1271 *wl) + wl->min_mr_fw_ver : wl->min_sr_fw_ver; + char min_fw_str[32] = ""; + int i; ++ size_t min_fw_len = 0; + + /* the chip must be exactly equal */ + if ((min_ver[FW_VER_CHIP] != WLCORE_FW_VER_IGNORE) && +@@ -121,11 +122,11 @@ static int wlcore_validate_fw_ver(struct wl1271 *wl) + fail: + for (i = 0; i < NUM_FW_VER; i++) + if (min_ver[i] == WLCORE_FW_VER_IGNORE) +- snprintf(min_fw_str, sizeof(min_fw_str), +- "%s*.", min_fw_str); ++ min_fw_len += snprintf(min_fw_str + min_fw_len, ++ sizeof(min_fw_str) - min_fw_len, "*."); + else +- snprintf(min_fw_str, sizeof(min_fw_str), +- "%s%u.", min_fw_str, min_ver[i]); ++ min_fw_len += snprintf(min_fw_str + min_fw_len, ++ sizeof(min_fw_str) - min_fw_len, "%u.", min_ver[i]); + + wl1271_error("Your WiFi FW version (%u.%u.%u.%u.%u) is invalid.\n" + "Please use at least FW %s\n" +diff --git a/drivers/net/wireless/ti/wlcore/debugfs.h b/drivers/net/wireless/ti/wlcore/debugfs.h +index bfb79399d40f..31b4d4a77640 100644 +--- a/drivers/net/wireless/ti/wlcore/debugfs.h ++++ b/drivers/net/wireless/ti/wlcore/debugfs.h +@@ -97,12 +97,13 @@ static ssize_t sub## _ ##name## _read(struct file *file, \ + struct struct_type *stats = wl->stats.fw_stats; \ + char buf[DEBUGFS_FORMAT_BUFFER_SIZE] = ""; \ + int i; \ ++ size_t buf_len = 0; \ + \ + wl1271_debugfs_update_stats(wl); \ + \ + for (i = 0; i < len; i++) \ +- snprintf(buf, sizeof(buf), "%s[%d] = %d\n", \ +- buf, i, stats->sub.name[i]); \ ++ snprintf(buf + buf_len, sizeof(buf) - buf_len, \ ++ "[%d] = %d\n", i, stats->sub.name[i]); \ + \ + return wl1271_format_buffer(userbuf, count, ppos, "%s", buf); \ + } \ +-- +2.27.0 +