diff --git a/core/hdd/src/wlan_hdd_wext.c b/core/hdd/src/wlan_hdd_wext.c index a273c996d0a0..cc67a448f21c 100644 --- a/core/hdd/src/wlan_hdd_wext.c +++ b/core/hdd/src/wlan_hdd_wext.c @@ -973,6 +973,8 @@ */ #define WE_SET_CHANNEL 88 #define WE_SET_CONC_SYSTEM_PREF 89 +#define MAX_SUB_CMD 91 // Motorola, IKDREL3KK-10418 + /* * @@ -5867,9 +5869,13 @@ static int __iw_set_three_ints_getnone(struct net_device *dev, union iwreq_data *wrqu, char *extra) { struct hdd_adapter *adapter = WLAN_HDD_GET_PRIV_PTR(dev); - int *value = (int *)extra; - int sub_cmd = value[0]; - int ret; + //BEGIN MOT a19110 IKSWL-15774 Ioctl from Mot code + int *value; + int sub_cmd, cmd_len; + int *tmp_value; + int *get_value = NULL; + int ret = 0; + //END IKSWL-15774 uint8_t dual_mac_feature = DISABLE_DBS_CXN_AND_SCAN; struct hdd_context *hdd_ctx = WLAN_HDD_GET_CTX(adapter); QDF_STATUS status; @@ -5884,6 +5890,29 @@ static int __iw_set_three_ints_getnone(struct net_device *dev, ret = wlan_hdd_validate_context(hdd_ctx); if (0 != ret) return ret; + //BEGIN MOT a19110 IKSWL-15774 Ioctl from Mot code + tmp_value = (int *)extra; + + // Copy from wrqu structure if it was a ioctl from Motorola code + if(tmp_value[0] < 0 || (tmp_value[0] >= MAX_SUB_CMD)) { + cmd_len = wrqu->data.length; + get_value = (int *) kmalloc(cmd_len+1, GFP_KERNEL); // Motorola, IKHSS7-39028 + + if(get_value == NULL) + return -ENOMEM; + + if(copy_from_user((char *) get_value, (char*)(wrqu->data.pointer), cmd_len)) { + hdd_alert("copy_from_user --data pointer failed! bailing"); + kfree(get_value); + return -EFAULT; + } + + value = (int *)get_value; + } else { + value = (int *)extra; + } + sub_cmd = value[0]; + //END IKSWL-15774 ret = hdd_check_private_wext_control(hdd_ctx, info); if (0 != ret) @@ -5928,6 +5957,11 @@ static int __iw_set_three_ints_getnone(struct net_device *dev, break; } + + //BEGIN MOT a19110 IKSWL-15774 Ioctl from Mot code + if(get_value != NULL) + kfree(get_value); + //END IKSWL-15774 hdd_exit(); return ret; }