import PULS_20180308

[GitHub/mt8127/android_kernel_alcatel_ttab.git] / drivers / misc / mediatek / connectivity / combo / drv_wlan / mt6630 / wlan / os / linux / gl_wext.c

diff --git a/drivers/misc/mediatek/connectivity/combo/drv_wlan/mt6630/wlan/os/linux/gl_wext.c b/drivers/misc/mediatek/connectivity/combo/drv_wlan/mt6630/wlan/os/linux/gl_wext.c
index 6bd7ddaa0bc702cde6ec442818962bacbe923768..7ab78ddf6a7fd0cd979547a56f510d161237b844 100644 (file)
--- a/drivers/misc/mediatek/connectivity/combo/drv_wlan/mt6630/wlan/os/linux/gl_wext.c
+++ b/drivers/misc/mediatek/connectivity/combo/drv_wlan/mt6630/wlan/os/linux/gl_wext.c
@@ -1783,7 +1783,7 @@ wext_set_mlme(IN struct net_device *prNetDev,
 /*----------------------------------------------------------------------------*/
 static int
 wext_set_scan(IN struct net_device *prNetDev,
-             IN struct iw_request_info *prIwrInfo, IN union iwreq_data *prData, IN char *pcExtra)
+             IN struct iw_request_info *prIwrInfo, IN struct iw_scan_req *prIwScanReq, IN char *pcExtra)
 {
        P_GLUE_INFO_T prGlueInfo = NULL;
        WLAN_STATUS rStatus = WLAN_STATUS_SUCCESS;
@@ -1798,10 +1798,8 @@ wext_set_scan(IN struct net_device *prNetDev,
 
 #if WIRELESS_EXT > 17
        /* retrieve SSID */
-       if (prData) {
-               essid_len =
-                   ((struct iw_scan_req *)(((struct iw_point *)prData)->pointer))->essid_len;
-       }
+       if (prIwScanReq)
+               essid_len = prIwScanReq->essid_len;
 #endif
 
        init_completion(&prGlueInfo->rScanComp);
@@ -3699,6 +3697,7 @@ int wext_support_ioctl(IN struct net_device *prDev, IN struct ifreq *prIfReq, IN
        int ret = 0;
        char *prExtraBuf = NULL;
        UINT_32 u4ExtraSize = 0;
+       struct iw_scan_req * prIwScanReq = NULL;
 
        /* prDev is verified in the caller function wlanDoIOCTL() */
 
@@ -3841,23 +3840,22 @@ int wext_support_ioctl(IN struct net_device *prDev, IN struct ifreq *prIfReq, IN
                }
 #if WIRELESS_EXT > 17
                else if (iwr->u.data.length == sizeof(struct iw_scan_req)) {
-                       prExtraBuf = kalMemAlloc(MAX_SSID_LEN, VIR_MEM_TYPE);
-                       if (!prExtraBuf) {
+                       prIwScanReq = kalMemAlloc(iwr->u.data.length, VIR_MEM_TYPE);
+                       if (!prIwScanReq) {
                                ret = -ENOMEM;
                                break;
                        }
-                       if (copy_from_user
-                           (prExtraBuf, ((struct iw_scan_req *)(iwr->u.data.pointer))->essid,
-                            ((struct iw_scan_req *)(iwr->u.data.pointer))->essid_len)) {
+
+                       if (copy_from_user(prIwScanReq, iwr->u.data.pointer, iwr->u.data.length)) {
                                ret = -EFAULT;
                        } else {
-                               ret =
-                                   wext_set_scan(prDev, NULL, (union iwreq_data *)&(iwr->u.data),
-                                                 prExtraBuf);
+                               if (prIwScanReq->essid_len > IW_ESSID_MAX_SIZE)
+                                       prIwScanReq->essid_len = IW_ESSID_MAX_SIZE;
+                               ret = wext_set_scan(prDev, NULL, prIwScanReq, &(prIwScanReq->essid[0]));
                        }
 
-                       kalMemFree(prExtraBuf, VIR_MEM_TYPE, MAX_SSID_LEN);
-                       prExtraBuf = NULL;
+                       kalMemFree(prIwScanReq, VIR_MEM_TYPE, iwr->u.data.length);
+                       prIwScanReq = NULL;
                }
 #endif
                else {