Update to v5.8.7.2_36899.20200819

Makefile

@@ -74,7 +74,7 @@ CONFIG_80211W = y
 CONFIG_REDUCE_TX_CPU_LOADING = n
 CONFIG_BR_EXT = y
 CONFIG_TDLS = n
-CONFIG_WIFI_MONITOR = n
+CONFIG_WIFI_MONITOR =  y
 CONFIG_MCC_MODE = n
 CONFIG_APPEND_VENDOR_IE_ENABLE = n
 CONFIG_RTW_NAPI = y

core/rtw_wlan_util.c

@@ -2282,7 +2282,9 @@ u8 support_rate_ranges[] = {
 	IEEE80211_OFDM_RATE_9MB,
 	IEEE80211_OFDM_RATE_12MB,
 	IEEE80211_OFDM_RATE_18MB,
+	IEEE80211_PBCC_RATE_22MB,
 	IEEE80211_OFDM_RATE_24MB,
+	IEEE80211_PBCC_RATE_33MB,
 	IEEE80211_OFDM_RATE_36MB,
 	IEEE80211_OFDM_RATE_48MB,
 	IEEE80211_OFDM_RATE_54MB,

hal/rtl8822b/rtl8822b_halinit.c

@@ -351,9 +351,6 @@ void rtl8822b_init_default_value(PADAPTER adapter)
 	/* init default value */
 	hal->fw_ractrl = _FALSE;
 
-	if (!adapter_to_pwrctl(adapter)->bkeepfwalive)
-		hal->LastHMEBoxNum = 0;
-
 	/* init phydm default value */
 	hal->bIQKInitialized = _FALSE;
 

include/ieee80211.h

@@ -766,16 +766,18 @@ struct ieee80211_snap_hdr {
 #define IEEE80211_NUM_OFDM_RATESLEN	8
 
 
-#define IEEE80211_CCK_RATE_1MB		        0x02
+#define IEEE80211_CCK_RATE_1MB			0x02
-#define IEEE80211_CCK_RATE_2MB		        0x04
+#define IEEE80211_CCK_RATE_2MB			0x04
-#define IEEE80211_CCK_RATE_5MB		        0x0B
+#define IEEE80211_CCK_RATE_5MB			0x0B
-#define IEEE80211_CCK_RATE_11MB		        0x16
+#define IEEE80211_CCK_RATE_11MB 		0x16
-#define IEEE80211_OFDM_RATE_LEN		8
+#define IEEE80211_OFDM_RATE_LEN 		8
-#define IEEE80211_OFDM_RATE_6MB		        0x0C
+#define IEEE80211_OFDM_RATE_6MB 		0x0C
-#define IEEE80211_OFDM_RATE_9MB		        0x12
+#define IEEE80211_OFDM_RATE_9MB 		0x12
 #define IEEE80211_OFDM_RATE_12MB		0x18
 #define IEEE80211_OFDM_RATE_18MB		0x24
+#define IEEE80211_PBCC_RATE_22MB		0x2C
 #define IEEE80211_OFDM_RATE_24MB		0x30
+#define IEEE80211_PBCC_RATE_33MB		0x42
 #define IEEE80211_OFDM_RATE_36MB		0x48
 #define IEEE80211_OFDM_RATE_48MB		0x60
 #define IEEE80211_OFDM_RATE_54MB		0x6C

include/osdep_service_linux.h

@@ -56,6 +56,10 @@
 #include <linux/list.h>
 #include <linux/vmalloc.h>
 
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 4, 0))
+	#include <uapi/linux/sched/types.h>
+#endif
+
 #if (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 5, 41))
 	#include <linux/tqueue.h>
 #endif

include/rtw_version.h

@@ -1,2 +1,2 @@
-#define DRIVERVERSION	"v5.8.7.1_35809.20191129_COEX20191120-7777"
+#define DRIVERVERSION	"v5.8.7.2_36899.20200819_COEX20191120-7777"
 #define BTCOEXVERSION	"COEX20191120-7777"

os_dep/linux/ioctl_cfg80211.c

@@ -434,7 +434,7 @@ u8 rtw_cfg80211_ch_switch_notify(_adapter *adapter, u8 ch, u8 bw, u8 offset,
 	u8 ret = _SUCCESS;
 
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0))
-	struct cfg80211_chan_def chdef;
+	struct cfg80211_chan_def chdef = {};
 
 	ret = rtw_chbw_to_cfg80211_chan_def(wiphy, &chdef, ch, bw, offset, ht);
 	if (ret != _SUCCESS)
@@ -6267,6 +6267,7 @@ static int cfg80211_rtw_set_monitor_channel(struct wiphy *wiphy
 
 	switch (chandef->width) {
 	case NL80211_CHAN_WIDTH_20_NOHT:
+		/* fall through */
 	case NL80211_CHAN_WIDTH_20:
 		target_width = CHANNEL_WIDTH_20;
 		target_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;

os_dep/linux/ioctl_linux.c

@@ -9828,6 +9828,10 @@ static int rtw_mp_efuse_set(struct net_device *dev,
 			err = -EINVAL;
 			goto exit;
 		}
+		pHalData->current_channel = 0;
+		pHalData->current_channel_bw = CHANNEL_WIDTH_MAX;
+		pHalData->current_band_type = BAND_MAX;
+
 		_rtw_memset(extra, '\0', strlen(extra));
 		sprintf(extra, "eFuse Update OK\n");
 	} else if (strcmp(tmp[0], "analyze") == 0) {

os_dep/linux/ioctl_mp.c

@@ -23,6 +23,18 @@
 	#include <rtw_bt_mp.h>
 #endif
 
+#define RTW_IWD_MAX_LEN	128
+inline u8 rtw_do_mp_iwdata_len_chk(const char *caller, u32 len)
+{
+	u8 is_illegal = _FALSE;
+	if (len >= RTW_IWD_MAX_LEN) {
+		RTW_ERR("%s : iw data len(%u) > RTW_IWD_MAX_LEN(%u)",
+			caller, len, RTW_IWD_MAX_LEN);
+		is_illegal = _TRUE;
+	}
+	return is_illegal;
+}
+
 /*
  * Input Format: %s,%d,%d
  *	%s is width, could be
@@ -42,11 +54,12 @@ int rtw_mp_write_reg(struct net_device *dev,
 	u32 addr, data;
 	int ret = 0;
 	PADAPTER padapter = rtw_netdev_priv(dev);
-	char *input;
+	char input[RTW_IWD_MAX_LEN];
 
-	input = rtw_zmalloc(wrqu->length + 1);
+	if (rtw_do_mp_iwdata_len_chk(__func__, (wrqu->length + 1)))
-	if (!input)
+		return -EFAULT;
-		return -ENOMEM;
+
+	_rtw_memset(input, 0, sizeof(input));
 
 	if (copy_from_user(input, wrqu->pointer, wrqu->length)) {
 		ret = -EFAULT;
@@ -142,7 +155,7 @@ int rtw_mp_read_reg(struct net_device *dev,
 		    struct iw_request_info *info,
 		    struct iw_point *wrqu, char *extra)
 {
-	char *input;
+	char input[RTW_IWD_MAX_LEN];
 	char *pch, *pnext;
 	char *width_str;
 	char width;
@@ -153,12 +166,10 @@ int rtw_mp_read_reg(struct net_device *dev,
 	char *pextra = extra;
 	int ret = 0;
 
-	if (wrqu->length > 128)
+	if (rtw_do_mp_iwdata_len_chk(__func__, (wrqu->length + 1)))
 		return -EFAULT;
 
-	input = rtw_zmalloc(wrqu->length + 1);
+	_rtw_memset(input, 0, wrqu->length);
-	if (!input)
-		return -ENOMEM;
 
 	if (copy_from_user(input, wrqu->pointer, wrqu->length)) {
 		ret = -EFAULT;
@@ -288,12 +299,12 @@ int rtw_mp_write_rf(struct net_device *dev,
 	u32 path, addr, data;
 	int ret = 0, cnt;
 	PADAPTER padapter = rtw_netdev_priv(dev);
-	char *input;
+	char input[RTW_IWD_MAX_LEN];
 
+	if (rtw_do_mp_iwdata_len_chk(__func__, wrqu->length))
+		return -EFAULT;
 
-	input = rtw_zmalloc(wrqu->length);
+	_rtw_memset(input, 0, wrqu->length);
-	if (!input)
-		return -ENOMEM;
 
 	if (copy_from_user(input, wrqu->pointer, wrqu->length)) {
 		ret = -EFAULT;
@@ -338,7 +349,7 @@ int rtw_mp_read_rf(struct net_device *dev,
 		   struct iw_request_info *info,
 		   struct iw_point *wrqu, char *extra)
 {
-	char *input;
+	char input[RTW_IWD_MAX_LEN];
 	char *pch, *pnext;
 	char data[20], tmp[20];
 	u32 path, addr, strtou;
@@ -347,12 +358,10 @@ int rtw_mp_read_rf(struct net_device *dev,
 	char *pextra = extra;
 	int ret = 0, cnt;
 
-	if (wrqu->length > 128)
+	if (rtw_do_mp_iwdata_len_chk(__func__, wrqu->length))
 		return -EFAULT;
 
-	input = rtw_zmalloc(wrqu->length);
+	_rtw_memset(input, 0, wrqu->length);
-	if (!input)
-		return -ENOMEM;
 
 	if (copy_from_user(input, wrqu->pointer, wrqu->length)) {
 		ret = -EFAULT;
@@ -468,14 +477,15 @@ int rtw_mp_rate(struct net_device *dev,
 		struct iw_point *wrqu, char *extra)
 {
 	u32 rate = MPT_RATE_1M;
-	u8 *input;
+	u8 input[RTW_IWD_MAX_LEN];
 	PADAPTER padapter = rtw_netdev_priv(dev);
 	PMPT_CONTEXT		pMptCtx = &(padapter->mppriv.mpt_ctx);
 	int ret = 0;
 
-	input = rtw_zmalloc(wrqu->length + 1);
+	if (rtw_do_mp_iwdata_len_chk(__func__, (wrqu->length + 1)))
-	if (!input)
+		return -EFAULT;
-		return -ENOMEM;
+
+	_rtw_memset(input, 0, sizeof(input));
 
 	if (copy_from_user(input, wrqu->pointer, wrqu->length)) {
 		ret = -EFAULT;
@@ -530,13 +540,14 @@ int rtw_mp_channel(struct net_device *dev,
 
 	PADAPTER padapter = rtw_netdev_priv(dev);
 	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(padapter);
-	u8 *input;
+	u8 input[RTW_IWD_MAX_LEN];
 	u32	channel = 1;
 	int ret = 0;
 
-	input = rtw_zmalloc(wrqu->length + 1);
+	if (rtw_do_mp_iwdata_len_chk(__func__, (wrqu->length + 1)))
-	if (!input)
+		return -EFAULT;
-		return -ENOMEM;
+
+	_rtw_memset(input, 0, sizeof(input));
 
 	if (copy_from_user(input, wrqu->pointer, wrqu->length)) {
 		ret = -EFAULT;
@@ -568,13 +579,14 @@ int rtw_mp_ch_offset(struct net_device *dev,
 {
 
 	PADAPTER padapter = rtw_netdev_priv(dev);
-	u8 *input;
+	u8 input[RTW_IWD_MAX_LEN];
 	u32	ch_offset = 0;
 	int ret = 0;
 
-	input = rtw_zmalloc(wrqu->length + 1);
+	if (rtw_do_mp_iwdata_len_chk(__func__, (wrqu->length + 1)))
-	if (!input)
+		return -EFAULT;
-		return -ENOMEM;
+
+	_rtw_memset(input, 0, sizeof(input));
 
 	if (copy_from_user(input, wrqu->pointer, wrqu->length)) {
 		ret = -EFAULT;
@@ -605,12 +617,13 @@ int rtw_mp_bandwidth(struct net_device *dev,
 	u32 bandwidth = 0, sg = 0;
 	PADAPTER padapter = rtw_netdev_priv(dev);
 	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(padapter);
-	u8 *input;
+	u8 input[RTW_IWD_MAX_LEN];
 	int ret = 0;
 
-	input = rtw_zmalloc(wrqu->length);
+	if (rtw_do_mp_iwdata_len_chk(__func__, wrqu->length))
-	if (!input)
+		return -EFAULT;
-		return -ENOMEM;
+
+	_rtw_memset(input, 0, sizeof(input));
 
 	if (copy_from_user(input, wrqu->pointer, wrqu->length)) {
 		ret = -EFAULT;
@@ -650,18 +663,16 @@ int rtw_mp_txpower_index(struct net_device *dev,
 {
 	PADAPTER padapter = rtw_netdev_priv(dev);
  	HAL_DATA_TYPE	*phal_data	= GET_HAL_DATA(padapter);
-	char *input;
+	char input[RTW_IWD_MAX_LEN];
 	u32 rfpath = 0 ;
 	u32 txpower_inx = 0, tarpowerdbm = 0;
 	char *pextra = extra;
 	int ret = 0;
 
-	if (wrqu->length > 128)
+	if (rtw_do_mp_iwdata_len_chk(__func__, (wrqu->length + 1)))
 		return -EFAULT;
 
-	input = rtw_zmalloc(wrqu->length + 1);
+	_rtw_memset(input, 0, sizeof(input));
-	if (!input)
-		return -ENOMEM;
 
 	if (copy_from_user(input, wrqu->pointer, wrqu->length)) {
 		ret = -EFAULT;
@@ -730,14 +741,15 @@ int rtw_mp_txpower(struct net_device *dev,
 {
 	u32 idx_a = 0, idx_b = 0, idx_c = 0, idx_d = 0;
 	int MsetPower = 1;
-	u8 *input;
+	u8 input[RTW_IWD_MAX_LEN];
 	int ret = 0;
 	PADAPTER padapter = rtw_netdev_priv(dev);
 	PMPT_CONTEXT		pMptCtx = &(padapter->mppriv.mpt_ctx);
 
-	input = rtw_zmalloc(wrqu->length);
+	if (rtw_do_mp_iwdata_len_chk(__func__, wrqu->length))
-	if (!input)
+		return -EFAULT;
-		return -ENOMEM;
+
+	_rtw_memset(input, 0, sizeof(input));
 
 	if (copy_from_user(input, wrqu->pointer, wrqu->length)) {
 		ret = -EFAULT;
@@ -778,15 +790,16 @@ int rtw_mp_ant_tx(struct net_device *dev,
 		  struct iw_point *wrqu, char *extra)
 {
 	u8 i;
-	u8 *input;
+	u8 input[RTW_IWD_MAX_LEN];
 	u16 antenna = 0;
 	PADAPTER padapter = rtw_netdev_priv(dev);
 	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
 	int ret = 0;
 
-	input = rtw_zmalloc(wrqu->length + 1);
+	if (rtw_do_mp_iwdata_len_chk(__func__, (wrqu->length + 1)))
-	if (!input)
+		return -EFAULT;
-		return -ENOMEM;
+
+	_rtw_memset(input, 0, sizeof(input));
 
 	if (copy_from_user(input, wrqu->pointer, wrqu->length)) {
 		ret = -EFAULT;
@@ -842,14 +855,15 @@ int rtw_mp_ant_rx(struct net_device *dev,
 {
 	u8 i;
 	u16 antenna = 0;
-	u8 *input;
+	u8 input[RTW_IWD_MAX_LEN];
 	PADAPTER padapter = rtw_netdev_priv(dev);
 	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
 	int ret = 0;
 
-	input = rtw_zmalloc(wrqu->length + 1);
+	if (rtw_do_mp_iwdata_len_chk(__func__, (wrqu->length + 1)))
-	if (!input)
+		return -EFAULT;
-		return -ENOMEM;
+
+	_rtw_memset(input, 0, sizeof(input));
 
 	if (copy_from_user(input, wrqu->pointer, wrqu->length)) {
 		ret = -EFAULT;
@@ -1081,13 +1095,14 @@ int rtw_mp_disable_bt_coexist(struct net_device *dev,
 	PADAPTER padapter = (PADAPTER)rtw_netdev_priv(dev);
 
 #endif
-	u8 *input;
+	u8 input[RTW_IWD_MAX_LEN];
 	u32 bt_coexist;
 	int ret = 0;
 
-	input = rtw_zmalloc(wrqu->data.length + 1);
+	if (rtw_do_mp_iwdata_len_chk(__func__, (wrqu->data.length + 1)))
-	if (!input)
+		return -EFAULT;
-		return -ENOMEM;
+
+	_rtw_memset(input, 0, sizeof(input));
 
 	if (copy_from_user(input, wrqu->data.pointer, wrqu->data.length)) {
 		ret = -EFAULT;
@@ -1127,7 +1142,7 @@ int rtw_mp_arx(struct net_device *dev,
 {
 	int bStartRx = 0, bStopRx = 0, bQueryPhy = 0, bQueryMac = 0, bSetBssid = 0, bSetRxframe = 0;
 	int bmac_filter = 0, bmon = 0, bSmpCfg = 0;
-	u8 *input;
+	u8 input[RTW_IWD_MAX_LEN];
 	char *pch, *token, *tmp[2] = {0x00, 0x00};
 	u32 i = 0, jj = 0, kk = 0, cnts = 0;
 	PADAPTER padapter = rtw_netdev_priv(dev);
@@ -1135,9 +1150,10 @@ int rtw_mp_arx(struct net_device *dev,
 	struct dbg_rx_counter rx_counter;
 	int ret = 0;
 
-	input = rtw_zmalloc(wrqu->length);
+	if (rtw_do_mp_iwdata_len_chk(__func__, wrqu->length))
-	if (!input)
+		return -EFAULT;
-		return -ENOMEM;
+
+	_rtw_memset(input, 0, sizeof(input));
 
 	if (copy_from_user(input, wrqu->pointer, wrqu->length)) {
 		ret = -EFAULT;
@@ -1332,12 +1348,13 @@ int rtw_mp_pwrtrk(struct net_device *dev,
 	u32 thermal;
 	s32 res;
 	PADAPTER padapter = rtw_netdev_priv(dev);
-	u8 *input;
+	u8 input[RTW_IWD_MAX_LEN];
 	int ret = 0;
 
-	input = rtw_zmalloc(wrqu->length);
+	if (rtw_do_mp_iwdata_len_chk(__func__, wrqu->length))
-	if (!input)
+		return -EFAULT;
-		return -ENOMEM;
+
+	_rtw_memset(input, 0, sizeof(input));
 
 	if (copy_from_user(input, wrqu->pointer, wrqu->length)) {
 		ret = -EFAULT;
@@ -1386,12 +1403,13 @@ int rtw_mp_psd(struct net_device *dev,
 	       struct iw_point *wrqu, char *extra)
 {
 	PADAPTER padapter = rtw_netdev_priv(dev);
-	u8 *input;
+	u8 input[RTW_IWD_MAX_LEN];
 	int ret = 0;
 
-	input = rtw_zmalloc(wrqu->length + 1);
+	if (rtw_do_mp_iwdata_len_chk(__func__, (wrqu->length + 1)))
-	if (!input)
+		return -EFAULT;
-		return -ENOMEM;
+
+	_rtw_memset(input, 0, sizeof(input));
 
 	if (copy_from_user(input, wrqu->pointer, wrqu->length)) {
 		ret = -EFAULT;
@@ -1550,13 +1568,14 @@ int rtw_mp_dump(struct net_device *dev,
 		struct iw_point *wrqu, char *extra)
 {
 	struct mp_priv *pmp_priv;
-	u8 *input;
+	u8 input[RTW_IWD_MAX_LEN];
 	PADAPTER padapter = rtw_netdev_priv(dev);
 	int ret = 0;
 
-	input = rtw_zmalloc(wrqu->length);
+	if (rtw_do_mp_iwdata_len_chk(__func__, wrqu->length))
-	if (!input)
+		return -EFAULT;
-		return -ENOMEM;
+
+	_rtw_memset(input, 0, sizeof(input));
 
 	pmp_priv = &padapter->mppriv;
 
@@ -1585,15 +1604,15 @@ int rtw_mp_phypara(struct net_device *dev,
 
 	PADAPTER padapter = rtw_netdev_priv(dev);
 	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(padapter);
-	char *input;
+	char input[RTW_IWD_MAX_LEN];
 	u32		invalxcap = 0, cnt = 0, bwrite_xcap = 0, hwxtaladdr = 0;
 	u16		pgval;
 	int ret = 0;
 
+	if (rtw_do_mp_iwdata_len_chk(__func__, wrqu->length))
+		return -EFAULT;
 
-	input = rtw_zmalloc(wrqu->length);
+	_rtw_memset(input, 0, sizeof(input));
-	if (!input)
-		return -ENOMEM;
 
 	if (copy_from_user(input, wrqu->pointer, wrqu->length)) {
 		ret = -EFAULT;
@@ -1651,16 +1670,17 @@ int rtw_mp_SetRFPath(struct net_device *dev,
 		     struct iw_point *wrqu, char *extra)
 {
 	PADAPTER padapter = rtw_netdev_priv(dev);
-	char *input;
+	char input[RTW_IWD_MAX_LEN];
 	int		bMain = 1, bTurnoff = 1;
 	int ret = 0;
 #ifdef CONFIG_ANTENNA_DIVERSITY
 	u8 res = _TRUE;
 #endif
 
-	input = rtw_zmalloc(wrqu->length);
+	if (rtw_do_mp_iwdata_len_chk(__func__, wrqu->length))
-	if (!input)
+		return -EFAULT;
-		return -ENOMEM;
+
+	_rtw_memset(input, 0, sizeof(input));
 
 	if (copy_from_user(input, wrqu->pointer, wrqu->length)) {
 		ret = -EFAULT;
@@ -1711,14 +1731,14 @@ int rtw_mp_switch_rf_path(struct net_device *dev,
 {
 	PADAPTER padapter = rtw_netdev_priv(dev);
 	struct mp_priv *pmp_priv;
-	char *input;
+	char input[RTW_IWD_MAX_LEN];
 	int		bwlg = 1, bwla = 1, btg = 1, bbt=1;
 	int ret = 0;
 
+	if (rtw_do_mp_iwdata_len_chk(__func__, wrqu->length + 1))
+		return -EFAULT;
 
-	input = rtw_zmalloc(wrqu->length + 1);
+	_rtw_memset(input, 0, sizeof(input));
-	if (!input)
-		return -ENOMEM;
 
 	if (copy_from_user(input, wrqu->pointer, wrqu->length)) {
 		ret = -EFAULT;
@@ -1769,15 +1789,16 @@ int rtw_mp_QueryDrv(struct net_device *dev,
 		    union iwreq_data *wrqu, char *extra)
 {
 	PADAPTER padapter = rtw_netdev_priv(dev);
-	char *input;
+	char input[RTW_IWD_MAX_LEN];
 	int	qAutoLoad = 1;
 	int ret = 0;
 
 	PHAL_DATA_TYPE pHalData = GET_HAL_DATA(padapter);
 
-	input = rtw_zmalloc(wrqu->data.length);
+	if (rtw_do_mp_iwdata_len_chk(__func__, wrqu->data.length))
-	if (!input)
+		return -EFAULT;
-		return -ENOMEM;
+
+	_rtw_memset(input, 0, sizeof(input));
 
 	if (copy_from_user(input, wrqu->data.pointer, wrqu->data.length)) {
 		ret = -EFAULT;
@@ -1809,15 +1830,16 @@ int rtw_mp_PwrCtlDM(struct net_device *dev,
 		    struct iw_point *wrqu, char *extra)
 {
 	PADAPTER padapter = rtw_netdev_priv(dev);
-	u8		*input;
+	u8 input[RTW_IWD_MAX_LEN];
 	u8		pwrtrk_state = 0;
 	u8		pwtk_type[5][25] = {"Thermal tracking off","Thermal tracking on",
 					"TSSI tracking off","TSSI tracking on","TSSI calibration"};
 	int ret = 0;
 
-	input = rtw_zmalloc(wrqu->length);
+	if (rtw_do_mp_iwdata_len_chk(__func__, wrqu->length))
-	if (!input)
+		return -EFAULT;
-		return -ENOMEM;
+
+	_rtw_memset(input, 0, sizeof(input));
 
 	if (copy_from_user(input, wrqu->pointer, wrqu->length)) {
 		ret = -EFAULT;
@@ -2932,7 +2954,7 @@ int rtw_mp_link(struct net_device *dev,
 {
 	PADAPTER padapter = rtw_netdev_priv(dev);
 	struct mp_priv *pmp_priv;
-	char *input;
+	char input[RTW_IWD_MAX_LEN];
 	int		bgetrxdata = 0, btxdata = 0, bsetbt = 0;
 	u32 i = 0, datalen = 0,jj, kk, waittime = 0;
 	u16 val = 0x00, res = 0;
@@ -2943,9 +2965,10 @@ int rtw_mp_link(struct net_device *dev,
 
 	pmp_priv = &padapter->mppriv;
 
-	input = rtw_zmalloc(wrqu->length);
+	if (rtw_do_mp_iwdata_len_chk(__func__, wrqu->length))
-	if (!input)
+		return -EFAULT;
-		return -ENOMEM;
+
+	_rtw_memset(input, 0, sizeof(input));
 
 	if (copy_from_user(input, wrqu->pointer, wrqu->length)) {
 		ret = -EFAULT;

os_dep/linux/rtw_proc.c

@@ -81,27 +81,17 @@ inline struct proc_dir_entry *rtw_proc_create_dir(const char *name, struct proc_
 }
 
 inline struct proc_dir_entry *rtw_proc_create_entry(const char *name, struct proc_dir_entry *parent,
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0))
+	const struct rtw_proc_ops *fops, void * data)
-	const struct proc_ops *proc_ops, void * data)
-#else
-	const struct file_operations *fops, void * data)
-#endif
 {
 	struct proc_dir_entry *entry;
 
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0))
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 26))
-	entry = proc_create_data(name,  S_IFREG | S_IRUGO | S_IWUGO, parent, proc_ops, data);
-#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 26))
 	entry = proc_create_data(name,  S_IFREG | S_IRUGO | S_IWUGO, parent, fops, data);
 #else
 	entry = create_proc_entry(name, S_IFREG | S_IRUGO | S_IWUGO, parent);
 	if (entry) {
 		entry->data = data;
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0))
-		entry->proc_ops = proc_ops;
-#else
 		entry->proc_fops = fops;
-#endif
 	}
 #endif
 
@@ -271,43 +261,39 @@ static ssize_t rtw_drv_proc_write(struct file *file, const char __user *buffer,
 	return -EROFS;
 }
 
+static const struct rtw_proc_ops rtw_drv_proc_seq_fops = {
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0))
-static const struct proc_ops rtw_drv_proc_seq_fops = {
 	.proc_open = rtw_drv_proc_open,
 	.proc_read = seq_read,
 	.proc_lseek = seq_lseek,
 	.proc_release = seq_release,
 	.proc_write = rtw_drv_proc_write,
-};
 #else
-static const struct file_operations rtw_drv_proc_seq_fops = {
 	.owner = THIS_MODULE,
 	.open = rtw_drv_proc_open,
 	.read = seq_read,
 	.llseek = seq_lseek,
 	.release = seq_release,
 	.write = rtw_drv_proc_write,
-};
 #endif
+};
 
+static const struct rtw_proc_ops rtw_drv_proc_sseq_fops = {
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0))
-static const struct proc_ops rtw_drv_proc_sseq_fops = {
 	.proc_open = rtw_drv_proc_open,
 	.proc_read = seq_read,
 	.proc_lseek = seq_lseek,
 	.proc_release = single_release,
 	.proc_write = rtw_drv_proc_write,
-};
 #else
-static const struct file_operations rtw_drv_proc_sseq_fops = {
 	.owner = THIS_MODULE,
 	.open = rtw_drv_proc_open,
 	.read = seq_read,
 	.llseek = seq_lseek,
 	.release = single_release,
 	.write = rtw_drv_proc_write,
-};
 #endif
+};
 
 int rtw_drv_proc_init(void)
 {
@@ -4808,43 +4794,39 @@ static ssize_t rtw_adapter_proc_write(struct file *file, const char __user *buff
 	return -EROFS;
 }
 
+static const struct rtw_proc_ops rtw_adapter_proc_seq_fops = {
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0))
-static const struct proc_ops rtw_adapter_proc_seq_fops = {
 	.proc_open = rtw_adapter_proc_open,
 	.proc_read = seq_read,
 	.proc_lseek = seq_lseek,
 	.proc_release = seq_release,
 	.proc_write = rtw_adapter_proc_write,
-};
 #else
-static const struct file_operations rtw_adapter_proc_seq_fops = {
 	.owner = THIS_MODULE,
 	.open = rtw_adapter_proc_open,
 	.read = seq_read,
 	.llseek = seq_lseek,
 	.release = seq_release,
 	.write = rtw_adapter_proc_write,
-};
 #endif
+};
 
+static const struct rtw_proc_ops rtw_adapter_proc_sseq_fops = {
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0))
-static const struct proc_ops rtw_adapter_proc_sseq_fops = {
 	.proc_open = rtw_adapter_proc_open,
 	.proc_read = seq_read,
 	.proc_lseek = seq_lseek,
 	.proc_release = single_release,
 	.proc_write = rtw_adapter_proc_write,
-};
 #else
-static const struct file_operations rtw_adapter_proc_sseq_fops = {
 	.owner = THIS_MODULE,
 	.open = rtw_adapter_proc_open,
 	.read = seq_read,
 	.llseek = seq_lseek,
 	.release = single_release,
 	.write = rtw_adapter_proc_write,
-};
 #endif
+};
 
 int proc_get_odm_adaptivity(struct seq_file *m, void *v)
 {
@@ -5001,43 +4983,39 @@ static ssize_t rtw_odm_proc_write(struct file *file, const char __user *buffer,
 	return -EROFS;
 }
 
+static const struct rtw_proc_ops rtw_odm_proc_seq_fops = {
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0))
-static const struct proc_ops rtw_odm_proc_seq_fops = {
 	.proc_open = rtw_odm_proc_open,
 	.proc_read = seq_read,
 	.proc_lseek = seq_lseek,
 	.proc_release = seq_release,
 	.proc_write = rtw_odm_proc_write,
-};
 #else
-static const struct file_operations rtw_odm_proc_seq_fops = {
 	.owner = THIS_MODULE,
 	.open = rtw_odm_proc_open,
 	.read = seq_read,
 	.llseek = seq_lseek,
 	.release = seq_release,
 	.write = rtw_odm_proc_write,
-};
 #endif
+};
 
+static const struct rtw_proc_ops rtw_odm_proc_sseq_fops = {
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0))
-static const struct proc_ops rtw_odm_proc_sseq_fops = {
 	.proc_open = rtw_odm_proc_open,
 	.proc_read = seq_read,
 	.proc_lseek = seq_lseek,
 	.proc_release = single_release,
 	.proc_write = rtw_odm_proc_write,
-};
 #else
-static const struct file_operations rtw_odm_proc_sseq_fops = {
 	.owner = THIS_MODULE,
 	.open = rtw_odm_proc_open,
 	.read = seq_read,
 	.llseek = seq_lseek,
 	.release = single_release,
 	.write = rtw_odm_proc_write,
-};
 #endif
+};
 
 struct proc_dir_entry *rtw_odm_proc_init(struct net_device *dev)
 {
@@ -5170,22 +5148,38 @@ static ssize_t rtw_mcc_proc_write(struct file *file, const char __user *buffer,
 	return -EROFS;
 }
 
-static const struct file_operations rtw_mcc_proc_seq_fops = {
+static const struct rtw_proc_ops rtw_mcc_proc_seq_fops = {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0))
+	.proc_open = rtw_mcc_proc_open,
+	.proc_read = seq_read,
+	.proc_lseek = seq_lseek,
+	.proc_release = seq_release,
+	.proc_write = rtw_mcc_proc_write,
+#else
 	.owner = THIS_MODULE,
 	.open = rtw_mcc_proc_open,
 	.read = seq_read,
 	.llseek = seq_lseek,
 	.release = seq_release,
 	.write = rtw_mcc_proc_write,
+#endif
 };
 
-static const struct file_operations rtw_mcc_proc_sseq_fops = {
+static const struct rtw_proc_ops rtw_mcc_proc_sseq_fops = {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0))
+	.proc_open = rtw_mcc_proc_open,
+	.proc_read = seq_read,
+	.proc_lseek = seq_lseek,
+	.proc_release = single_release,
+	.proc_write = rtw_mcc_proc_write,
+#else
 	.owner = THIS_MODULE,
 	.open = rtw_mcc_proc_open,
 	.read = seq_read,
 	.llseek = seq_lseek,
 	.release = single_release,
 	.write = rtw_mcc_proc_write,
+#endif
 };
 
 struct proc_dir_entry *rtw_mcc_proc_init(struct net_device *dev)

os_dep/linux/rtw_proc.h

@@ -45,6 +45,12 @@ struct rtw_proc_hdl {
 #define RTW_PROC_HDL_SZSEQ(_name, _show, _write, _size) \
 	{ .name = _name, .type = RTW_PROC_HDL_TYPE_SZSEQ, .u.sz.show = _show, .write = _write, .u.sz.size = _size}
 
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0))
+#define rtw_proc_ops proc_ops
+#else
+#define rtw_proc_ops file_operations
+#endif
+
 #ifdef CONFIG_PROC_DEBUG
 
 int rtw_drv_proc_init(void);