diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
index d0919bcb19530c..b26ad8507e93f6 100644
--- a/arch/arm64/include/asm/uaccess.h
+++ b/arch/arm64/include/asm/uaccess.h
@@ -410,12 +410,15 @@ static inline unsigned long __must_check __copy_to_user(void __user *to, const v
 
 static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
 {
+	unsigned long res = n;
+
 	if (access_ok(VERIFY_READ, from, n)) {
 		check_object_size(to, n, false);
-		n = __arch_copy_from_user(to, from, n);
-	} else /* security hole - plug it */
-		memset(to, 0, n);
-	return n;
+		res = __arch_copy_from_user(to, from, n);
+	}
+	if (unlikely(res))
+		memset(to + (n - res), 0, res);
+	return res;
 }
 
 static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
diff --git a/arch/arm64/lib/copy_from_user.S b/arch/arm64/lib/copy_from_user.S
index 683adc358be7d7..c7a7d9689e8f23 100644
--- a/arch/arm64/lib/copy_from_user.S
+++ b/arch/arm64/lib/copy_from_user.S
@@ -74,11 +74,6 @@ ENDPROC(__arch_copy_from_user)
 
 	.section .fixup,"ax"
 	.align	2
-9998:
-	sub	x0, end, dst
-9999:
-	strb	wzr, [dst], #1			// zero remaining buffer space
-	cmp	dst, end
-	b.lo	9999b
+9998:	sub	x0, end, dst			// bytes not copied
 	ret
 	.previous
diff --git a/drivers/input/joystick/analog.c b/drivers/input/joystick/analog.c
index 6f8b084e13d072..1e7e29fa47c56d 100644
--- a/drivers/input/joystick/analog.c
+++ b/drivers/input/joystick/analog.c
@@ -440,9 +440,11 @@ static void analog_name(struct analog *analog)
 		 hweight8(analog->mask & ANALOG_BTNS_STD) + !!(analog->mask & ANALOG_BTNS_CHF) * 2 +
 		 hweight16(analog->mask & ANALOG_BTNS_GAMEPAD) + !!(analog->mask & ANALOG_HBTN_CHF) * 4);
 
-	if (analog->mask & ANALOG_HATS_ALL)
-		snprintf(analog->name, sizeof(analog->name), "%s %d-hat",
-			 analog->name, hweight16(analog->mask & ANALOG_HATS_ALL));
+	if (analog->mask & ANALOG_HATS_ALL) {
+		size_t len = strnlen(analog->name, sizeof(analog->name));
+		snprintf(analog->name + len, sizeof(analog->name) - len, " %d-hat",
+			hweight16(analog->mask & ANALOG_HATS_ALL));
+	}
 
 	if (analog->mask & ANALOG_HAT_FCS)
 		strlcat(analog->name, " FCS", sizeof(analog->name));
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index d079ac58c7da1e..f20c0e31cb4500 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -661,9 +661,12 @@ phy_registers_show(struct device *dev, struct device_attribute *attr, char *buf)
 	struct phy_device *phydev = to_phy_device(dev);
 	int index;
 
-	for (index = 0; index < 32; index++)
-		sprintf(buf, "%s%2d: 0x%x\n", buf, index,
+	char tmp[50];
+	for (index = 0; index < 32; index++) {
+		snprintf(tmp, sizeof(tmp), "%2d: 0x%x\n", index,
 			phy_read(phydev, index));
+		strcat(buf, tmp);
+	}
 
 	return strlen(buf);
 }
diff --git a/drivers/net/wireless/ew-7611ulb/core/rtw_mp.c b/drivers/net/wireless/ew-7611ulb/core/rtw_mp.c
index a16da9b60103d2..39384d584f3873 100644
--- a/drivers/net/wireless/ew-7611ulb/core/rtw_mp.c
+++ b/drivers/net/wireless/ew-7611ulb/core/rtw_mp.c
@@ -2093,14 +2093,17 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data)
 
 	data[0] = '\0';
 
-	i = psd_start;
-	while (i < psd_stop) {
-		if (i >= psd_pts)
-			psd_data = rtw_GetPSDData(pAdapter, i - psd_pts);
-		else
-			psd_data = rtw_GetPSDData(pAdapter, i);
-		sprintf(data, "%s%x ", data, psd_data);
-		i++;
+	{
+		size_t extra_len = strlen(data);
+		i = psd_start;
+		while (i < psd_stop) {
+			if (i >= psd_pts)
+				psd_data = rtw_GetPSDData(pAdapter, i - psd_pts);
+			else
+				psd_data = rtw_GetPSDData(pAdapter, i);
+			extra_len += sprintf(data + extra_len, "%x ", psd_data);
+			i++;
+		}
 	}
 
 #ifdef CONFIG_LONG_DELAY_ISSUE
diff --git a/drivers/net/wireless/ew-7611ulb/os_dep/linux/ioctl_mp.c b/drivers/net/wireless/ew-7611ulb/os_dep/linux/ioctl_mp.c
index ad2bb026739ad7..179d08d72e7f15 100644
--- a/drivers/net/wireless/ew-7611ulb/os_dep/linux/ioctl_mp.c
+++ b/drivers/net/wireless/ew-7611ulb/os_dep/linux/ioctl_mp.c
@@ -1719,7 +1719,7 @@ int rtw_mp_tx(struct net_device *dev,
 			char *pextra = extra;
 			RTW_INFO("Got format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode);
 			_rtw_memset(extra, 0, wrqu->data.length);
-			sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
+			pextra += sprintf(pextra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
 			padapter->mppriv.channel = channel;
 			SetChannel(padapter);
 			pHalData->current_channel = channel;
@@ -2074,6 +2074,7 @@ int rtw_efuse_mask_file(struct net_device *dev,
 		u8	count = 0;
 		u8	i = 0;
 		u32	datalen = 0;
+		size_t extra_len;
 
 		ptmp = extra;
 		pch = strsep(&ptmp, ",");
@@ -2099,12 +2100,13 @@ int rtw_efuse_mask_file(struct net_device *dev,
 
 		 } while (count < 64);
 
+		extra_len = strlen(extra);
 		for (i = 0; i < count; i++)
-			sprintf(extra, "%s:%02x", extra, maskfileBuffer[i]);
+			extra_len += sprintf(extra + extra_len, ":%02x", maskfileBuffer[i]);
 
 		padapter->registrypriv.bFileMaskEfuse = _TRUE;
 
-		sprintf(extra, "%s\nLoad Efuse Mask data %d hex ok\n", extra, count);
+		extra_len += sprintf(extra + extra_len, "\nLoad Efuse Mask data %d hex ok\n", count);
 		wrqu->data.length = strlen(extra);
 		return 0;
 	}
@@ -2522,16 +2524,18 @@ int rtw_mp_SetBT(struct net_device *dev,
 	mptbt_BtControlProcess(padapter, &BtReq);
 
 	if (readtherm == 0) {
+		size_t extra_len;
 		sprintf(extra, "BT thermal=");
 		for (i = 4; i < pMptCtx->mptOutLen; i++) {
 			if ((pMptCtx->mptOutBuf[i] == 0x00) && (pMptCtx->mptOutBuf[i + 1] == 0x00))
 				goto exit;
 
-			sprintf(extra, "%s %d ", extra, (pMptCtx->mptOutBuf[i] & 0x1f));
+			extra_len += sprintf(extra + extra_len, " %d ", (pMptCtx->mptOutBuf[i] & 0x1f));
 		}
 	} else {
+		size_t extra_len;
 		for (i = 4; i < pMptCtx->mptOutLen; i++)
-			sprintf(extra, "%s 0x%x ", extra, pMptCtx->mptOutBuf[i]);
+			extra_len += sprintf(extra + extra_len, " 0x%x ", pMptCtx->mptOutBuf[i]);
 	}
 
 exit:
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8188eu/core/rtw_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8188eu/core/rtw_mp.c
index ec39412959b0b3..a7658d4e8e765f 100644
--- a/drivers/net/wireless/rockchip_wlan/rtl8188eu/core/rtw_mp.c
+++ b/drivers/net/wireless/rockchip_wlan/rtl8188eu/core/rtw_mp.c
@@ -2119,14 +2119,17 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data)
 
 	data[0] = '\0';
 
-	i = psd_start;
-	while (i < psd_stop) {
-		if (i >= psd_pts)
-			psd_data = rtw_GetPSDData(pAdapter, i - psd_pts);
-		else
-			psd_data = rtw_GetPSDData(pAdapter, i);
-		sprintf(data, "%s%x ", data, psd_data);
-		i++;
+	{
+		size_t extra_len = strlen(data);
+		i = psd_start;
+		while (i < psd_stop) {
+			if (i >= psd_pts)
+				psd_data = rtw_GetPSDData(pAdapter, i - psd_pts);
+			else
+				psd_data = rtw_GetPSDData(pAdapter, i);
+			extra_len += sprintf(data + extra_len, "%x ", psd_data);
+			i++;
+		}
 	}
 
 #ifdef CONFIG_LONG_DELAY_ISSUE
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8188eu/os_dep/linux/ioctl_linux.c b/drivers/net/wireless/rockchip_wlan/rtl8188eu/os_dep/linux/ioctl_linux.c
index 5537ead019c245..99ef1740099934 100644
--- a/drivers/net/wireless/rockchip_wlan/rtl8188eu/os_dep/linux/ioctl_linux.c
+++ b/drivers/net/wireless/rockchip_wlan/rtl8188eu/os_dep/linux/ioctl_linux.c
@@ -9034,6 +9034,7 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 	u16 mask_len;
 	u8 mask_buf[64] = "";
 	int err;
+	size_t extra_len;
 #ifdef CONFIG_IOL
 	u8 org_fw_iol = padapter->registrypriv.fw_iol;/* 0:Disable, 1:enable, 2:by usb speed */
 #endif
@@ -9108,18 +9109,18 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		} else
 			drvmaporder = 0;
 
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < cnt; i += 16) {
-			sprintf(extra, "%s0x%02x\t", extra, shift + i);
+			extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i);
 			for (j = 0; j < 8; j++)
-				sprintf(extra, "%s%02X ", extra, efuse[i + j]);
-			sprintf(extra, "%s\t", extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j < 16; j++)
-				sprintf(extra, "%s%02X ", extra, efuse[i + j]);
-			sprintf(extra, "%s\n", extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 		if ((shift + cnt) < mapLen)
-			sprintf(extra, "%s\t...more (left:%d/%d)\n", extra, mapLen-(shift + cnt), mapLen);
+			extra_len += sprintf(extra + extra_len, "\t...more (left:%d/%d)\n", mapLen-(shift + cnt), mapLen);
 
 	} else if (strcmp(tmp[0], "realmap") == 0) {
 		static u8 order = 0;
@@ -9158,18 +9159,18 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		} else
 			order = 0;
 
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < cnt; i += 16) {
-			sprintf(extra, "%s0x%02x\t", extra, shift + i);
+			extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i);
 			for (j = 0; j < 8; j++)
-				sprintf(extra, "%s%02X ", extra, efuse[i + j]);
-			sprintf(extra, "%s\t", extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j < 16; j++)
-				sprintf(extra, "%s%02X ", extra, efuse[i + j]);
-			sprintf(extra, "%s\n", extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 		if ((shift + cnt) < mapLen)
-			sprintf(extra, "%s\t...more (left:%d/%d)\n", extra, mapLen-(shift + cnt), mapLen);
+			extra_len += sprintf(extra + extra_len, "\t...more (left:%d/%d)\n", mapLen-(shift + cnt), mapLen);
 	} else if (strcmp(tmp[0], "rmap") == 0) {
 		if ((tmp[1] == NULL) || (tmp[2] == NULL)) {
 			RTW_INFO("%s: rmap Fail!! Parameters error!\n", __FUNCTION__);
@@ -9204,9 +9205,10 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 		/*		RTW_INFO("%s: data={", __FUNCTION__); */
 		*extra = 0;
+		extra_len = 0;
 		for (i = 0; i < cnts; i++) {
 			/*			RTW_INFO("0x%02x ", data[i]); */
-			sprintf(extra, "%s0x%02X ", extra, data[i]);
+			extra_len += sprintf(extra + extra_len, "0x%02X ", data[i]);
 		}
 		/*		RTW_INFO("}\n"); */
 	} else if (strcmp(tmp[0], "realraw") == 0) {
@@ -9235,18 +9237,18 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		} else
 			raw_order = 0;
 
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < cnt; i += 16) {
-			sprintf(extra, "%s0x%02x\t", extra, shift + i);
+			extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i);
 			for (j = 0; j < 8; j++)
-				sprintf(extra, "%s%02X ", extra, rawdata[i + j]);
-			sprintf(extra, "%s\t", extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", rawdata[i + j]);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j < 16; j++)
-				sprintf(extra, "%s%02X ", extra, rawdata[i + j]);
-			sprintf(extra, "%s\n", extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", rawdata[i + j]);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 		if ((shift + cnt) < mapLen)
-			sprintf(extra, "%s\t...more (left:%d/%d)\n", extra, mapLen-(shift + cnt), mapLen);
+			extra_len += sprintf(extra + extra_len, "\t...more (left:%d/%d)\n", mapLen-(shift + cnt), mapLen);
 
 	} else if (strcmp(tmp[0], "btrealraw") == 0) {
 		static u8 bt_raw_order = 0;
@@ -9282,18 +9284,18 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		} else
 			bt_raw_order = 0;
 
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < cnt; i += 16) {
-			sprintf(extra, "%s0x%02x\t", extra, shift + i);
+			extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i);
 			for (j = 0; j < 8; j++)
-				sprintf(extra, "%s%02X ", extra, rawdata[i + j]);
-			sprintf(extra, "%s\t", extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", rawdata[i + j]);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j < 16; j++)
-				sprintf(extra, "%s%02X ", extra, rawdata[i + j]);
-			sprintf(extra, "%s\n", extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", rawdata[i + j]);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 		if ((shift + cnt) < mapLen)
-			sprintf(extra, "%s\t...more (left:%d/%d)\n", extra, mapLen-(shift + cnt), mapLen);
+			extra_len += sprintf(extra + extra_len, "\t...more (left:%d/%d)\n", mapLen-(shift + cnt), mapLen);
 
 	} else if (strcmp(tmp[0], "mac") == 0) {
 		if (hal_efuse_macaddr_offset(padapter) == -1) {
@@ -9319,12 +9321,13 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 		/*		RTW_INFO("%s: MAC address={", __FUNCTION__); */
 		*extra = 0;
+		extra_len = 0;
 		for (i = 0; i < cnts; i++) {
 			/*			RTW_INFO("%02X", data[i]); */
-			sprintf(extra, "%s%02X", extra, data[i]);
+			extra_len += sprintf(extra + extra_len, "%02X", data[i]);
 			if (i != (cnts - 1)) {
 				/*				RTW_INFO(":"); */
-				sprintf(extra, "%s:", extra);
+				extra_len += sprintf(extra + extra_len, ":");
 			}
 		}
 		/*		RTW_INFO("}\n"); */
@@ -9382,12 +9385,13 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 		/*		RTW_INFO("%s: {VID,PID}={", __FUNCTION__); */
 		*extra = 0;
+		extra_len = 0;
 		for (i = 0; i < cnts; i++) {
 			/*			RTW_INFO("0x%02x", data[i]); */
-			sprintf(extra, "%s0x%02X", extra, data[i]);
+			extra_len += sprintf(extra + extra_len, "0x%02X", data[i]);
 			if (i != (cnts - 1)) {
 				/*				RTW_INFO(","); */
-				sprintf(extra, "%s,", extra);
+				extra_len += sprintf(extra + extra_len, ",");
 			}
 		}
 		/*		RTW_INFO("}\n"); */
@@ -9415,22 +9419,22 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		}
 
 		/*		RTW_INFO("OFFSET\tVALUE(hex)\n"); */
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < 512; i += 16) { /* set 512 because the iwpriv's extra size have limit 0x7FF */
 			/*			RTW_INFO("0x%03x\t", i); */
-			sprintf(extra, "%s0x%03x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%03x\t", i);
 			for (j = 0; j < 8; j++) {
 				/*				RTW_INFO("%02X ", pEfuseHal->BTEfuseInitMap[i+j]); */
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i + j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i + j]);
 			}
 			/*			RTW_INFO("\t"); */
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j < 16; j++) {
 				/*				RTW_INFO("%02X ", pEfuseHal->BTEfuseInitMap[i+j]); */
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i + j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i + j]);
 			}
 			/*			RTW_INFO("\n"); */
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 		/*		RTW_INFO("\n"); */
 	} else if (strcmp(tmp[0], "btbmap") == 0) {
@@ -9444,22 +9448,22 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		}
 
 		/*		RTW_INFO("OFFSET\tVALUE(hex)\n"); */
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 512; i < 1024 ; i += 16) {
 			/*			RTW_INFO("0x%03x\t", i); */
-			sprintf(extra, "%s0x%03x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%03x\t", i);
 			for (j = 0; j < 8; j++) {
 				/*				RTW_INFO("%02X ", data[i+j]); */
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i + j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i + j]);
 			}
 			/*			RTW_INFO("\t"); */
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j < 16; j++) {
 				/*				RTW_INFO("%02X ", data[i+j]); */
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i + j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i + j]);
 			}
 			/*			RTW_INFO("\n"); */
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 		/*		RTW_INFO("\n"); */
 	} else if (strcmp(tmp[0], "btrmap") == 0) {
@@ -9507,51 +9511,52 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		}
 
 		*extra = 0;
+		extra_len = 0;
 		/*		RTW_INFO("%s: bt efuse data={", __FUNCTION__); */
 		for (i = 0; i < cnts; i++) {
 			/*			RTW_INFO("0x%02x ", data[i]); */
-			sprintf(extra, "%s 0x%02X ", extra, data[i]);
+			extra_len += sprintf(extra + extra_len, " 0x%02X ", data[i]);
 		}
 		/*		RTW_INFO("}\n"); */
 		RTW_INFO(FUNC_ADPT_FMT ": BT MAC=[%s]\n", FUNC_ADPT_ARG(padapter), extra);
 	} else if (strcmp(tmp[0], "btffake") == 0) {
 		/*		RTW_INFO("OFFSET\tVALUE(hex)\n"); */
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < 512; i += 16) {
 			/*			RTW_INFO("0x%03x\t", i); */
-			sprintf(extra, "%s0x%03x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%03x\t", i);
 			for (j = 0; j < 8; j++) {
 				/*				RTW_INFO("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); */
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i + j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i + j]);
 			}
 			/*			RTW_INFO("\t"); */
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j < 16; j++) {
 				/*				RTW_INFO("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); */
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i + j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i + j]);
 			}
 			/*			RTW_INFO("\n"); */
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 		/*		RTW_INFO("\n"); */
 	} else if (strcmp(tmp[0], "btbfake") == 0) {
 		/*		RTW_INFO("OFFSET\tVALUE(hex)\n"); */
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 512; i < 1024; i += 16) {
 			/*			RTW_INFO("0x%03x\t", i); */
-			sprintf(extra, "%s0x%03x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%03x\t", i);
 			for (j = 0; j < 8; j++) {
 				/*				RTW_INFO("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); */
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i + j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i + j]);
 			}
 			/*			RTW_INFO("\t"); */
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j < 16; j++) {
 				/*				RTW_INFO("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); */
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i + j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i + j]);
 			}
 			/*			RTW_INFO("\n"); */
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 		/*		RTW_INFO("\n"); */
 	} else if (strcmp(tmp[0], "wlrfkmap") == 0) {
@@ -9572,18 +9577,18 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		} else
 			fk_order = 0;
 
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < cnt; i += 16) {
-			sprintf(extra, "%s0x%02x\t", extra, shift + i);
+			extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i);
 			for (j = 0; j < 8; j++)
-				sprintf(extra, "%s%02X ", extra, efuse[i + j]);
-			sprintf(extra, "%s\t", extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j < 16; j++)
-				sprintf(extra, "%s%02X ", extra, efuse[i + j]);
-			sprintf(extra, "%s\n", extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 		if ((shift + cnt) < mapLen)
-			sprintf(extra, "%s\t...more\n", extra);
+			extra_len += sprintf(extra + extra_len, "\t...more\n");
 
 	} else if (strcmp(tmp[0], "wlrfkrmap") == 0) {
 		if ((tmp[1] == NULL) || (tmp[2] == NULL)) {
@@ -9605,9 +9610,10 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 		/*		RTW_INFO("%s: data={", __FUNCTION__); */
 		*extra = 0;
+		extra_len = 0;
 		for (i = 0; i < cnts; i++) {
 			RTW_INFO("wlrfkrmap = 0x%02x\n", pEfuseHal->fakeEfuseModifiedMap[addr + i]);
-			sprintf(extra, "%s0x%02X ", extra, pEfuseHal->fakeEfuseModifiedMap[addr + i]);
+			extra_len += sprintf(extra + extra_len, "0x%02X ", pEfuseHal->fakeEfuseModifiedMap[addr + i]);
 		}
 	} else if (strcmp(tmp[0], "btrfkrmap") == 0) {
 		if ((tmp[1] == NULL) || (tmp[2] == NULL)) {
@@ -9629,9 +9635,10 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 		/*		RTW_INFO("%s: data={", __FUNCTION__); */
 		*extra = 0;
+		extra_len = 0;
 		for (i = 0; i < cnts; i++) {
 			RTW_INFO("wlrfkrmap = 0x%02x\n", pEfuseHal->fakeBTEfuseModifiedMap[addr + i]);
-			sprintf(extra, "%s0x%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[addr + i]);
+			extra_len += sprintf(extra + extra_len, "0x%02X ", pEfuseHal->fakeBTEfuseModifiedMap[addr + i]);
 		}
 	} else if (strcmp(tmp[0], "mask") == 0) {
 		*extra = 0;
@@ -9641,9 +9648,9 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		if (padapter->registrypriv.bFileMaskEfuse == _TRUE)
 			_rtw_memcpy(mask_buf, maskfileBuffer, mask_len);
 
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < mask_len; i++)
-			sprintf(extra, "%s0x%02X\n", extra, mask_buf[i]);
+			extra_len += sprintf(extra + extra_len, "0x%02X\n", mask_buf[i]);
 
 	} else
 		sprintf(extra, "Command not found!");
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8188eu/os_dep/linux/ioctl_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8188eu/os_dep/linux/ioctl_mp.c
index b7109f9a81d172..b0c108e574b7fd 100644
--- a/drivers/net/wireless/rockchip_wlan/rtl8188eu/os_dep/linux/ioctl_mp.c
+++ b/drivers/net/wireless/rockchip_wlan/rtl8188eu/os_dep/linux/ioctl_mp.c
@@ -198,7 +198,7 @@ int rtw_mp_read_reg(struct net_device *dev,
 			if (*pnext != '\0') {
 				/*strtout = simple_strtoul(pnext , &ptmp, 16);*/
 				ret = sscanf(pnext, "%x", &strtout);
-				sprintf(extra, "%s %d" , extra , strtout);
+				sprintf(extra + strlen(extra), " %d", strtout);
 			} else
 				break;
 			pch = pnext;
@@ -230,7 +230,7 @@ int rtw_mp_read_reg(struct net_device *dev,
 			pnext++;
 			if (*pnext != '\0') {
 				ret = sscanf(pnext, "%x", &strtout);
-				sprintf(extra, "%s %d" , extra , strtout);
+				sprintf(extra + strlen(extra), " %d", strtout);
 			} else
 				break;
 			pch = pnext;
@@ -341,20 +341,23 @@ int rtw_mp_read_rf(struct net_device *dev,
 	pch = tmp;
 	RTW_INFO("pch=%s", pch);
 
-	while (*pch != '\0') {
-		pnext = strpbrk(pch, " ");
-		if (!pnext)
-			break;
-		pnext++;
-		if (*pnext != '\0') {
-			/*strtou =simple_strtoul(pnext , &ptmp, 16);*/
-			ret = sscanf(pnext, "%x", &strtou);
-			sprintf(extra, "%s %d" , extra , strtou);
-		} else
-			break;
-		pch = pnext;
+	{
+		size_t extra_len = strlen(extra);
+		while (*pch != '\0') {
+			pnext = strpbrk(pch, " ");
+			if (!pnext)
+				break;
+			pnext++;
+			if (*pnext != '\0') {
+				/*strtou =simple_strtoul(pnext , &ptmp, 16);*/
+				ret = sscanf(pnext, "%x", &strtou);
+				extra_len += sprintf(extra + extra_len, " %d", strtou);
+			} else
+				break;
+			pch = pnext;
+		}
+		wrqu->length = extra_len;
 	}
-	wrqu->length = strlen(extra);
 
 	return 0;
 }
@@ -1417,7 +1420,7 @@ int rtw_mp_pretx_proc(PADAPTER padapter, u8 bStartTest, char *extra)
 			pmp_priv->mode = MP_ON;
 			sprintf(extra, "Stop continuous Tx");
 		} else if (pmp_priv->tx.stop == 1) {
-			sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500 count=%u\n", extra, pmp_priv->tx.count);
+			sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500 count=%u\n", pmp_priv->tx.count);
 			pmp_priv->tx.stop = 0;
 			SetPacketTx(padapter);
 		} else
@@ -1425,26 +1428,26 @@ int rtw_mp_pretx_proc(PADAPTER padapter, u8 bStartTest, char *extra)
 		return 0;
 	case MP_SINGLE_TONE_TX:
 		if (bStartTest != 0)
-			sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra);
+			sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.");
 		SetSingleToneTx(padapter, (u8)bStartTest);
 		break;
 	case MP_CONTINUOUS_TX:
 		if (bStartTest != 0)
-			sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra);
+			sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.");
 		SetContinuousTx(padapter, (u8)bStartTest);
 		break;
 	case MP_CARRIER_SUPPRISSION_TX:
 		if (bStartTest != 0) {
 			if (HwRateToMPTRate(pmp_priv->rateidx) <= MPT_RATE_11M)
-				sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra);
+				sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.");
 			else
-				sprintf(extra, "%s\nSpecify carrier suppression but not CCK rate", extra);
+				sprintf(extra + strlen(extra), "\nSpecify carrier suppression but not CCK rate");
 		}
 		SetCarrierSuppressionTx(padapter, (u8)bStartTest);
 		break;
 	case MP_SINGLE_CARRIER_TX:
 		if (bStartTest != 0)
-			sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra);
+			sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.");
 		SetSingleCarrierTx(padapter, (u8)bStartTest);
 		break;
 
@@ -1496,6 +1499,7 @@ int rtw_mp_tx(struct net_device *dev,
 	u32 bandwidth = 0, sg = 0, channel = 6, txpower = 40, rate = 108, ant = 0, txmode = 1, count = 0;
 	u8 i = 0, j = 0, bStartTest = 1, status = 0, Idx = 0, tmpU1B = 0;
 	u16 antenna = 0;
+	size_t extra_len;
 
 	if (copy_from_user(extra, wrqu->data.pointer, wrqu->data.length))
 		return -EFAULT;
@@ -1522,13 +1526,13 @@ int rtw_mp_tx(struct net_device *dev,
 		return 0;
 	} else if (strncmp(extra, "setting", 7) == 0) {
 		_rtw_memset(extra, 0, wrqu->data.length);
-		sprintf(extra, "Current Setting :\n Channel:%d", pmp_priv->channel);
-		sprintf(extra, "%s\n Bandwidth:%d", extra, pmp_priv->bandwidth);
-		sprintf(extra, "%s\n Rate index:%d", extra, pmp_priv->rateidx);
-		sprintf(extra, "%s\n TxPower index:%d", extra, pmp_priv->txpoweridx);
-		sprintf(extra, "%s\n Antenna TxPath:%d", extra, pmp_priv->antenna_tx);
-		sprintf(extra, "%s\n Antenna RxPath:%d", extra, pmp_priv->antenna_rx);
-		sprintf(extra, "%s\n MP Mode:%d", extra, pmp_priv->mode);
+		extra_len = sprintf(extra, "Current Setting :\n Channel:%d", pmp_priv->channel);
+		extra_len += sprintf(extra + extra_len, "\n Bandwidth:%d", pmp_priv->bandwidth);
+		extra_len += sprintf(extra + extra_len, "\n Rate index:%d", pmp_priv->rateidx);
+		extra_len += sprintf(extra + extra_len, "\n TxPower index:%d", pmp_priv->txpoweridx);
+		extra_len += sprintf(extra + extra_len, "\n Antenna TxPath:%d", pmp_priv->antenna_tx);
+		extra_len += sprintf(extra + extra_len, "\n Antenna RxPath:%d", pmp_priv->antenna_rx);
+		extra_len += sprintf(extra + extra_len, "\n MP Mode:%d", pmp_priv->mode);
 		wrqu->data.length = strlen(extra);
 		return 0;
 #ifdef CONFIG_MP_VHT_HW_TX_MODE
@@ -1666,25 +1670,25 @@ int rtw_mp_tx(struct net_device *dev,
 		if (sscanf(extra, "ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d", &channel, &bandwidth, &rate, &txpower, &ant, &txmode) < 6) {
 			RTW_INFO("Invalid format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode);
 			_rtw_memset(extra, 0, wrqu->data.length);
-			sprintf(extra, "\n Please input correct format as bleow:\n");
-			sprintf(extra, "%s\t ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d\n", extra, channel, bandwidth, rate, txpower, ant, txmode);
-			sprintf(extra, "%s\n [ ch : BGN = <1~14> , A or AC = <36~165> ]", extra);
-			sprintf(extra, "%s\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]", extra);
-			sprintf(extra, "%s\n [ rate :	CCK: 1 2 5.5 11M X 2 = < 2 4 11 22 >]", extra);
-			sprintf(extra, "%s\n [		OFDM: 6 9 12 18 24 36 48 54M X 2 = < 12 18 24 36 48 72 96 108>", extra);
-			sprintf(extra, "%s\n [		HT 1S2SS MCS0 ~ MCS15 : < [MCS0]=128 ~ [MCS7]=135 ~ [MCS15]=143 >", extra);
-			sprintf(extra, "%s\n [		HT 3SS MCS16 ~ MCS32 : < [MCS16]=144 ~ [MCS23]=151 ~ [MCS32]=159 >", extra);
-			sprintf(extra, "%s\n [		VHT 1SS MCS0 ~ MCS9 : < [MCS0]=160 ~ [MCS9]=169 >", extra);
-			sprintf(extra, "%s\n [ txpower : 1~63 power index", extra);
-			sprintf(extra, "%s\n [ ant : <A = 1, B = 2, C = 4, D = 8> ,2T ex: AB=3 BC=6 CD=12", extra);
-			sprintf(extra, "%s\n [ txmode : < 0 = CONTINUOUS_TX, 1 = PACKET_TX, 2 = SINGLE_TONE_TX, 3 = CARRIER_SUPPRISSION_TX, 4 = SINGLE_CARRIER_TX>\n", extra);
+			extra_len = sprintf(extra, "\n Please input correct format as bleow:\n");
+			extra_len += sprintf(extra + extra_len, "\t ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d\n", channel, bandwidth, rate, txpower, ant, txmode);
+			extra_len += sprintf(extra + extra_len, "\n [ ch : BGN = <1~14> , A or AC = <36~165> ]");
+			extra_len += sprintf(extra + extra_len, "\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]");
+			extra_len += sprintf(extra + extra_len, "\n [ rate :	CCK: 1 2 5.5 11M X 2 = < 2 4 11 22 >]");
+			extra_len += sprintf(extra + extra_len, "\n [		OFDM: 6 9 12 18 24 36 48 54M X 2 = < 12 18 24 36 48 72 96 108>");
+			extra_len += sprintf(extra + extra_len, "\n [		HT 1S2SS MCS0 ~ MCS15 : < [MCS0]=128 ~ [MCS7]=135 ~ [MCS15]=143 >");
+			extra_len += sprintf(extra + extra_len, "\n [		HT 3SS MCS16 ~ MCS32 : < [MCS16]=144 ~ [MCS23]=151 ~ [MCS32]=159 >");
+			extra_len += sprintf(extra + extra_len, "\n [		VHT 1SS MCS0 ~ MCS9 : < [MCS0]=160 ~ [MCS9]=169 >");
+			extra_len += sprintf(extra + extra_len, "\n [ txpower : 1~63 power index");
+			extra_len += sprintf(extra + extra_len, "\n [ ant : <A = 1, B = 2, C = 4, D = 8> ,2T ex: AB=3 BC=6 CD=12");
+			extra_len += sprintf(extra + extra_len, "\n [ txmode : < 0 = CONTINUOUS_TX, 1 = PACKET_TX, 2 = SINGLE_TONE_TX, 3 = CARRIER_SUPPRISSION_TX, 4 = SINGLE_CARRIER_TX>\n");
 			wrqu->data.length = strlen(extra);
 			return status;
 
 		} else {
 			RTW_INFO("Got format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode);
 			_rtw_memset(extra, 0, wrqu->data.length);
-			sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
+			extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
 			padapter->mppriv.channel = channel;
 			SetChannel(padapter);
 			pHalData->current_channel = channel;
@@ -1693,13 +1697,13 @@ int rtw_mp_tx(struct net_device *dev,
 				bandwidth = CHANNEL_WIDTH_40;
 			else if (bandwidth == 2)
 				bandwidth = CHANNEL_WIDTH_80;
-			sprintf(extra, "%s\nChange Current Bandwidth %d to Bandwidth %d", extra, padapter->mppriv.bandwidth , bandwidth);
+			extra_len += sprintf(extra + extra_len, "\nChange Current Bandwidth %d to Bandwidth %d", padapter->mppriv.bandwidth , bandwidth);
 			padapter->mppriv.bandwidth = (u8)bandwidth;
 			padapter->mppriv.preamble = sg;
 			SetBandwidth(padapter);
 			pHalData->current_channel_bw = bandwidth;
 
-			sprintf(extra, "%s\nSet power level :%d", extra, txpower);
+			extra_len += sprintf(extra + extra_len, "\nSet power level :%d", txpower);
 			padapter->mppriv.txpoweridx = (u8)txpower;
 			pMptCtx->TxPwrLevel[ODM_RF_PATH_A] = (u8)txpower;
 			pMptCtx->TxPwrLevel[ODM_RF_PATH_B] = (u8)txpower;
@@ -1722,13 +1726,13 @@ int rtw_mp_tx(struct net_device *dev,
 			RTW_INFO("%s: rate index=%d\n", __func__, rate);
 			if (rate >= MPT_RATE_LAST)
 				return -EINVAL;
-			sprintf(extra, "%s\nSet data rate to %d index %d", extra, padapter->mppriv.rateidx, rate);
+			extra_len += sprintf(extra + extra_len, "\nSet data rate to %d index %d", padapter->mppriv.rateidx, rate);
 
 			padapter->mppriv.rateidx = rate;
 			pMptCtx->mpt_rate_index = rate;
 			SetDataRate(padapter);
 
-			sprintf(extra, "%s\nSet Antenna Path :%d",  extra, ant);
+			extra_len += sprintf(extra + extra_len, "\nSet Antenna Path :%d", ant);
 			switch (ant) {
 			case 1:
 				antenna = ANTENNA_A;
@@ -1805,6 +1809,7 @@ int rtw_mp_rx(struct net_device *dev,
 	      struct iw_request_info *info,
 	      union iwreq_data *wrqu, char *extra)
 {
+	size_t extra_len;
 	PADAPTER padapter = rtw_netdev_priv(dev);
 	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(padapter);
 	struct mp_priv *pmp_priv = &padapter->mppriv;
@@ -1836,19 +1841,19 @@ int rtw_mp_rx(struct net_device *dev,
 	} else if (sscanf(extra, "ch=%d,bw=%d,ant=%d", &channel, &bandwidth, &ant) < 3) {
 		RTW_INFO("Invalid format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant);
 		_rtw_memset(extra, 0, wrqu->data.length);
-		sprintf(extra, "\n Please input correct format as bleow:\n");
-		sprintf(extra, "%s\t ch=%d,bw=%d,ant=%d\n", extra, channel, bandwidth, ant);
-		sprintf(extra, "%s\n [ ch : BGN = <1~14> , A or AC = <36~165> ]", extra);
-		sprintf(extra, "%s\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]", extra);
-		sprintf(extra, "%s\n [ ant : <A = 1, B = 2, C = 4, D = 8> ,2T ex: AB=3 BC=6 CD=12", extra);
-		wrqu->data.length = strlen(extra);
+		extra_len = sprintf(extra, "\n Please input correct format as bleow:\n");
+		extra_len += sprintf(extra + extra_len, "\t ch=%d,bw=%d,ant=%d\n", channel, bandwidth, ant);
+		extra_len += sprintf(extra + extra_len, "\n [ ch : BGN = <1~14> , A or AC = <36~165> ]");
+		extra_len += sprintf(extra + extra_len, "\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]");
+		extra_len += sprintf(extra + extra_len, "\n [ ant : <A = 1, B = 2, C = 4, D = 8> ,2T ex: AB=3 BC=6 CD=12");
+		wrqu->data.length = extra_len;
 		return 0;
 
 	} else {
 		bStartRx = 1;
 		RTW_INFO("Got format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant);
 		_rtw_memset(extra, 0, wrqu->data.length);
-		sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
+		extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
 		padapter->mppriv.channel = channel;
 		SetChannel(padapter);
 		pHalData->current_channel = channel;
@@ -1857,13 +1862,13 @@ int rtw_mp_rx(struct net_device *dev,
 			bandwidth = CHANNEL_WIDTH_40;
 		else if (bandwidth == 2)
 			bandwidth = CHANNEL_WIDTH_80;
-		sprintf(extra, "%s\nChange Current Bandwidth %d to Bandwidth %d", extra, padapter->mppriv.bandwidth , bandwidth);
+		extra_len += sprintf(extra + extra_len, "\nChange Current Bandwidth %d to Bandwidth %d", padapter->mppriv.bandwidth , bandwidth);
 		padapter->mppriv.bandwidth = (u8)bandwidth;
 		padapter->mppriv.preamble = sg;
 		SetBandwidth(padapter);
 		pHalData->current_channel_bw = bandwidth;
 
-		sprintf(extra, "%s\nSet Antenna Path :%d",  extra, ant);
+		extra_len += sprintf(extra + extra_len, "\nSet Antenna Path :%d", ant);
 		switch (ant) {
 		case 1:
 			antenna = ANTENNA_A;
@@ -1914,7 +1919,7 @@ int rtw_mp_rx(struct net_device *dev,
 		pHalData->antenna_tx_path = antenna;
 		SetAntenna(padapter);
 
-		sprintf(extra, "%s\nstart Rx", extra);
+		extra_len += sprintf(extra + extra_len, "\nstart Rx");
 		SetPacketRx(padapter, bStartRx, _FALSE);
 	}
 	wrqu->data.length = strlen(extra);
@@ -1956,6 +1961,7 @@ int rtw_efuse_mask_file(struct net_device *dev,
 	char *rtw_efuse_mask_file_path;
 	u8 Status;
 	PADAPTER padapter = rtw_netdev_priv(dev);
+	size_t extra_len;
 
 	_rtw_memset(maskfileBuffer, 0x00, sizeof(maskfileBuffer));
 
@@ -2006,11 +2012,11 @@ int rtw_efuse_mask_file(struct net_device *dev,
 		 } while (count < 64);
 
 		for (i = 0; i < count; i++)
-			sprintf(extra, "%s:%02x", extra, maskfileBuffer[i]);
+			extra_len += sprintf(extra + extra_len, ":%02x", maskfileBuffer[i]);
 
 		padapter->registrypriv.bFileMaskEfuse = _TRUE;
 
-		sprintf(extra, "%s\nLoad Efuse Mask data %d hex ok\n", extra, count);
+		extra_len += sprintf(extra + extra_len, "\nLoad Efuse Mask data %d hex ok\n", count);
 		wrqu->data.length = strlen(extra);
 		return 0;
 	}
@@ -2388,16 +2394,17 @@ int rtw_mp_SetBT(struct net_device *dev,
 	mptbt_BtControlProcess(padapter, &BtReq);
 
 	if (readtherm == 0) {
-		sprintf(extra, "BT thermal=");
+		size_t extra_len = sprintf(extra, "BT thermal=");
 		for (i = 4; i < pMptCtx->mptOutLen; i++) {
 			if ((pMptCtx->mptOutBuf[i] == 0x00) && (pMptCtx->mptOutBuf[i + 1] == 0x00))
 				goto exit;
 
-			sprintf(extra, "%s %d ", extra, (pMptCtx->mptOutBuf[i] & 0x1f));
+			extra_len += sprintf(extra + extra_len, " %d ", (pMptCtx->mptOutBuf[i] & 0x1f));
 		}
 	} else {
+		size_t extra_len = strlen(extra);
 		for (i = 4; i < pMptCtx->mptOutLen; i++)
-			sprintf(extra, "%s 0x%x ", extra, pMptCtx->mptOutBuf[i]);
+			extra_len += sprintf(extra + extra_len, " 0x%x ", pMptCtx->mptOutBuf[i]);
 	}
 
 exit:
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8188fu/core/rtw_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8188fu/core/rtw_mp.c
index e1a91cf8be4a05..2d0d22790a5d1b 100644
--- a/drivers/net/wireless/rockchip_wlan/rtl8188fu/core/rtw_mp.c
+++ b/drivers/net/wireless/rockchip_wlan/rtl8188fu/core/rtw_mp.c
@@ -1906,7 +1906,7 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data)
 {
 	u32 i, psd_pts=0, psd_start=0, psd_stop=0;
 	u32 psd_data=0;
-
+	size_t data_len = 0;
 
 #ifdef PLATFORM_LINUX
 	if (!netif_running(pAdapter->pnetdev)) {
@@ -1938,7 +1938,7 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data)
 		} else {
 			psd_data = rtw_GetPSDData(pAdapter, i);
 		}
-		sprintf(data, "%s%x ", data, psd_data);
+		data_len += sprintf(data + data_len, "%x ", psd_data);
 		i++;
 	}
 
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8188fu/os_dep/linux/ioctl_linux.c b/drivers/net/wireless/rockchip_wlan/rtl8188fu/os_dep/linux/ioctl_linux.c
index fa829ba161f520..dbd1a64f0654c1 100644
--- a/drivers/net/wireless/rockchip_wlan/rtl8188fu/os_dep/linux/ioctl_linux.c
+++ b/drivers/net/wireless/rockchip_wlan/rtl8188fu/os_dep/linux/ioctl_linux.c
@@ -9778,6 +9778,7 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 	#ifdef CONFIG_IOL
 	u8 org_fw_iol = padapter->registrypriv.fw_iol;// 0:Disable, 1:enable, 2:by usb speed
 	#endif
+	size_t extra_len;
 	
 	wrqu = (struct iw_point*)wdata;
 	pwrctrlpriv = adapter_to_pwrctl(padapter);
@@ -9838,23 +9839,23 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 	{
 		mapLen = EFUSE_MAP_SIZE;
 		
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < EFUSE_MAP_SIZE; i += 16)
 		{
 //			DBG_871X("0x%02x\t", i);
-			sprintf(extra, "%s0x%02x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%02x\t", i);
 			for (j=0; j<8; j++) {
 //				DBG_871X("%02X ", data[i+j]);
-				sprintf(extra, "%s%02X ", extra, PROMContent[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", PROMContent[i+j]);
 			}
 //			DBG_871X("\t");
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j<16; j++) {
 //				DBG_871X("%02X ", data[i+j]);
-				sprintf(extra, "%s%02X ", extra, PROMContent[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", PROMContent[i+j]);
 			}
 //			DBG_871X("\n");
-			sprintf(extra,"%s\n",extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 //		DBG_871X("\n");
 	}
@@ -9869,23 +9870,23 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		}
 
 //		DBG_871X("OFFSET\tVALUE(hex)\n");
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < EFUSE_MAP_SIZE; i += 16)
 		{
 //			DBG_871X("0x%02x\t", i);
-			sprintf(extra, "%s0x%02x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%02x\t", i);
 			for (j=0; j<8; j++) {
 //				DBG_871X("%02X ", data[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeEfuseInitMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeEfuseInitMap[i+j]);
 			}
 //			DBG_871X("\t");
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j<16; j++) {
 //				DBG_871X("%02X ", data[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeEfuseInitMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeEfuseInitMap[i+j]);
 			}
 //			DBG_871X("\n");
-			sprintf(extra,"%s\n",extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 //		DBG_871X("\n");
 	}
@@ -9928,9 +9929,10 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 //		DBG_871X("%s: data={", __FUNCTION__);
 		*extra = 0;
+		extra_len = 0;
 		for (i=0; i<cnts; i++) {
 //			DBG_871X("0x%02x ", data[i]);
-			sprintf(extra, "%s0x%02X ", extra, data[i]);
+			extra_len += sprintf(extra + extra_len, "0x%02X ", data[i]);
 		}
 //		DBG_871X("}\n");
 	}
@@ -9951,17 +9953,17 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 		_rtw_memset(extra,'\0',strlen(extra));
 
-		sprintf(extra, "\n0x00\t");
+		extra_len = sprintf(extra, "\n0x00\t");
 
 		for (i = 0; i < mapLen ; i++) {
-			sprintf(extra, "%s%02X", extra, rawdata[i]);
+			extra_len += sprintf(extra + extra_len, "%02X", rawdata[i]);
 			if ((i & 0xF) == 0xF) {
-				sprintf(extra, "%s\n", extra);
-				sprintf(extra, "%s0x%02x\t", extra, i+1);
+				extra_len += sprintf(extra + extra_len, "\n");
+				extra_len += sprintf(extra + extra_len, "0x%02x\t", i+1);
 			} else if ((i & 0x7) == 0x7) {
-				sprintf(extra, "%s \t", extra);
+				extra_len += sprintf(extra + extra_len, " \t");
 			} else {
-				sprintf(extra, "%s ", extra);
+				extra_len += sprintf(extra + extra_len, " ");
 			}
 		}
 
@@ -9977,22 +9979,22 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		}
 		_rtw_memset(extra,'\0',strlen(extra));
 		//		DBG_871X("%s: realraw={\n", __FUNCTION__);
-				sprintf(extra, "\n0x00\t");
+				extra_len = sprintf(extra, "\n0x00\t");
 				for (i= 512; i< mapLen; i++)
 				{
 		//			DBG_871X("%02X", rawdata[i]);
-					sprintf(extra, "%s%02X", extra, rawdata[i]);
+					extra_len += sprintf(extra + extra_len, "%02X", rawdata[i]);
 					if ((i & 0xF) == 0xF) {
 		//				DBG_871X("\n");
-						sprintf(extra, "%s\n", extra);
-						sprintf(extra, "%s0x%02x\t", extra, i+1);
+						extra_len += sprintf(extra + extra_len, "\n");
+						extra_len += sprintf(extra + extra_len, "0x%02x\t", i+1);
 					}
 					else if ((i & 0x7) == 0x7){
 		//				DBG_871X("\t");
-						sprintf(extra, "%s \t", extra);
+						extra_len += sprintf(extra + extra_len, " \t");
 					} else {
 		//				DBG_871X(" ");
-						sprintf(extra, "%s ", extra);
+						extra_len += sprintf(extra + extra_len, " ");
 					}
 				}
 		//		DBG_871X("}\n");
@@ -10023,14 +10025,15 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 //		DBG_871X("%s: MAC address={", __FUNCTION__);
 		*extra = 0;
+		extra_len = 0;
 		for (i=0; i<cnts; i++)
 		{
 //			DBG_871X("%02X", data[i]);
-			sprintf(extra, "%s%02X", extra, data[i]);
+			extra_len += sprintf(extra + extra_len, "%02X", data[i]);
 			if (i != (cnts-1))
 			{
 //				DBG_871X(":");
-				sprintf(extra,"%s:",extra);
+				extra_len += sprintf(extra + extra_len, ":");
 			}
 		}
 //		DBG_871X("}\n");
@@ -10085,14 +10088,15 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 //		DBG_871X("%s: {VID,PID}={", __FUNCTION__);
 		*extra = 0;
+		extra_len = 0;
 		for (i=0; i<cnts; i++)
 		{
 //			DBG_871X("0x%02x", data[i]);
-			sprintf(extra, "%s0x%02X", extra, data[i]);
+			extra_len += sprintf(extra + extra_len, "0x%02X", data[i]);
 			if (i != (cnts-1))
 			{
 //				DBG_871X(",");
-				sprintf(extra,"%s,",extra);
+				extra_len += sprintf(extra + extra_len, ",");
 			}
 		}
 //		DBG_871X("}\n");
@@ -10117,23 +10121,23 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		}
 
 //		DBG_871X("OFFSET\tVALUE(hex)\n");
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i=0; i<512; i+=16) // set 512 because the iwpriv's extra size have limit 0x7FF
 		{
 //			DBG_871X("0x%03x\t", i);
-			sprintf(extra, "%s0x%03x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%03x\t", i);
 			for (j=0; j<8; j++) {
 //				DBG_871X("%02X ", pEfuseHal->BTEfuseInitMap[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]);
 			}
 //			DBG_871X("\t");
-			sprintf(extra,"%s\t",extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j<16; j++) {
 //				DBG_871X("%02X ", pEfuseHal->BTEfuseInitMap[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]);
 			}
 //			DBG_871X("\n");
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 //		DBG_871X("\n");
 	}
@@ -10150,24 +10154,24 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		}
 
 //		DBG_871X("OFFSET\tVALUE(hex)\n");
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i=512; i<1024 ; i+=16)
 		{
 //			DBG_871X("0x%03x\t", i);
-			sprintf(extra, "%s0x%03x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%03x\t", i);
 			for (j=0; j<8; j++)
 			{
 //				DBG_871X("%02X ", data[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]);
 			}
 //			DBG_871X("\t");
-			sprintf(extra,"%s\t",extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j<16; j++) {
 //				DBG_871X("%02X ", data[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]);
 			}
 //			DBG_871X("\n");
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 //		DBG_871X("\n");
 	}
@@ -10209,11 +10213,12 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		}
 
 		*extra = 0;
+		extra_len = 0;
 //		DBG_871X("%s: bt efuse data={", __FUNCTION__);
 		for (i=0; i<cnts; i++)
 		{
 //			DBG_871X("0x%02x ", data[i]);
-			sprintf(extra, "%s 0x%02X ", extra, data[i]);
+			extra_len += sprintf(extra + extra_len, " 0x%02X ", data[i]);
 		}
 //		DBG_871X("}\n");
 		DBG_871X(FUNC_ADPT_FMT ": BT MAC=[%s]\n", FUNC_ADPT_ARG(padapter), extra);
@@ -10221,69 +10226,69 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 	else if (strcmp(tmp[0], "btffake") == 0)
 	{
 //		DBG_871X("OFFSET\tVALUE(hex)\n");
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i=0; i<512; i+=16)
 		{
 //			DBG_871X("0x%03x\t", i);
-			sprintf(extra, "%s0x%03x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%03x\t", i);
 			for (j=0; j<8; j++) {
 //				DBG_871X("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
 			}
 //			DBG_871X("\t");
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j<16; j++) {
 //				DBG_871X("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
 			}
 //			DBG_871X("\n");
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 //		DBG_871X("\n");
 	}
 	else if (strcmp(tmp[0],"btbfake") == 0)
 	{
 //		DBG_871X("OFFSET\tVALUE(hex)\n");
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i=512; i<1024; i+=16)
 		{
 //			DBG_871X("0x%03x\t", i);
-			sprintf(extra, "%s0x%03x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%03x\t", i);
 			for (j=0; j<8; j++) {
 //				DBG_871X("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
 			}
 //			DBG_871X("\t");
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j<16; j++) {
 //				DBG_871X("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
 			}
 //			DBG_871X("\n");
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 //		DBG_871X("\n");
 	}
 	else if (strcmp(tmp[0],"wlrfkmap")== 0)
 	{
 //		DBG_871X("OFFSET\tVALUE(hex)\n");
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i=0; i<EFUSE_MAP_SIZE; i+=16)
 		{
 //			DBG_871X("\t0x%02x\t", i);
-			sprintf(extra, "%s0x%02x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%02x\t", i);
 			for (j=0; j<8; j++) {
 //				DBG_871X("%02X ", pEfuseHal->fakeEfuseModifiedMap[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeEfuseModifiedMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeEfuseModifiedMap[i+j]);
 			}
 //			DBG_871X("\t");
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j<16; j++) {
 //				DBG_871X("%02X ", pEfuseHal->fakeEfuseModifiedMap[i+j]);
-				sprintf(extra, "%s %02X", extra, pEfuseHal->fakeEfuseModifiedMap[i+j]);
+				extra_len += sprintf(extra + extra_len, " %02X", pEfuseHal->fakeEfuseModifiedMap[i+j]);
 			}
 //			DBG_871X("\n");
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 //		DBG_871X("\n");
 
@@ -10311,9 +10316,10 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		
 		//		DBG_871X("%s: data={", __FUNCTION__);
 			*extra = 0;
+			extra_len = 0;
 			for (i=0; i<cnts; i++) {
 					DBG_871X("wlrfkrmap = 0x%02x \n", pEfuseHal->fakeEfuseModifiedMap[addr+i]);
-					sprintf(extra, "%s0x%02X ", extra, pEfuseHal->fakeEfuseModifiedMap[addr+i]);
+					extra_len += sprintf(extra + extra_len, "0x%02X ", pEfuseHal->fakeEfuseModifiedMap[addr+i]);
 			}
 	}
 	else if (strcmp(tmp[0],"btrfkrmap")== 0)
@@ -10339,9 +10345,10 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		
 		//		DBG_871X("%s: data={", __FUNCTION__);
 			*extra = 0;
+			extra_len = 0;
 			for (i=0; i<cnts; i++) {
 					DBG_871X("wlrfkrmap = 0x%02x \n", pEfuseHal->fakeBTEfuseModifiedMap[addr+i]);
-					sprintf(extra, "%s0x%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[addr+i]);
+					extra_len += sprintf(extra + extra_len, "0x%02X ", pEfuseHal->fakeBTEfuseModifiedMap[addr+i]);
 			}
 	}
 	else
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8188fu/os_dep/linux/ioctl_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8188fu/os_dep/linux/ioctl_mp.c
index a3997958572a66..11b61af4e8e7f7 100644
--- a/drivers/net/wireless/rockchip_wlan/rtl8188fu/os_dep/linux/ioctl_mp.c
+++ b/drivers/net/wireless/rockchip_wlan/rtl8188fu/os_dep/linux/ioctl_mp.c
@@ -198,7 +198,7 @@ int rtw_mp_read_reg(struct net_device *dev,
 				if (*pnext != '\0') {
 					/*strtout = simple_strtoul(pnext , &ptmp, 16);*/
 					ret = sscanf(pnext, "%x", &strtout);
-					sprintf(extra, "%s %d" , extra , strtout);
+					sprintf(extra + strlen(extra), " %d", strtout);
 				} else
 					break;
 				pch = pnext;
@@ -230,7 +230,7 @@ int rtw_mp_read_reg(struct net_device *dev,
 				pnext++;
 				if (*pnext != '\0') {
 					ret = sscanf(pnext, "%x", &strtout);
-					sprintf(extra, "%s %d" , extra , strtout);
+					sprintf(extra + strlen(extra), " %d", strtout);
 				} else
 					break;
 				pch = pnext;
@@ -341,20 +341,23 @@ int rtw_mp_read_rf(struct net_device *dev,
 	pch = tmp;
 	DBG_871X("pch=%s", pch);
 
-	while (*pch != '\0') {
-		pnext = strpbrk(pch, " ");
-		if (!pnext)
-			break;
-		pnext++;
-		if (*pnext != '\0') {
-			/*strtou =simple_strtoul(pnext , &ptmp, 16);*/
-			ret = sscanf(pnext, "%x", &strtou);
-			sprintf(extra, "%s %d" , extra , strtou);
-		} else
-			break;
-		pch = pnext;
+	{
+		size_t extra_len = strlen(extra);
+		while (*pch != '\0') {
+			pnext = strpbrk(pch, " ");
+			if (!pnext)
+				break;
+			pnext++;
+			if (*pnext != '\0') {
+				/*strtou =simple_strtoul(pnext , &ptmp, 16);*/
+				ret = sscanf(pnext, "%x", &strtou);
+				extra_len += sprintf(extra + extra_len, " %d", strtou);
+			} else
+				break;
+			pch = pnext;
+		}
+		wrqu->length = extra_len;
 	}
-	wrqu->length = strlen(extra);
 
 	return 0;
 }
@@ -1383,7 +1386,7 @@ int rtw_mp_pretx_proc(PADAPTER padapter, u8 bStartTest, char *extra)
 							pmp_priv->mode = MP_ON;
 							sprintf(extra, "Stop continuous Tx");
 						} else if (pmp_priv->tx.stop == 1) {
-							sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500 count=%u\n", extra, pmp_priv->tx.count);
+							sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500 count=%u\n", pmp_priv->tx.count);
 							pmp_priv->tx.stop = 0;
 							SetPacketTx(padapter);
 						} else {
@@ -1392,26 +1395,26 @@ int rtw_mp_pretx_proc(PADAPTER padapter, u8 bStartTest, char *extra)
 						return 0;
 		case MP_SINGLE_TONE_TX:
 						if (bStartTest != 0)
-							sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra);
+							sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.");
 						SetSingleToneTx(padapter, (u8)bStartTest);
 						break;
 		case MP_CONTINUOUS_TX:
 						if (bStartTest != 0)
-							sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra);
+							sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.");
 						SetContinuousTx(padapter, (u8)bStartTest);
 						break;
 		case MP_CARRIER_SUPPRISSION_TX:
 						if (bStartTest != 0) {
 							if (HwRateToMPTRate(pmp_priv->rateidx) <= MPT_RATE_11M)
-								sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra);
+								sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.");
 							else
-								sprintf(extra, "%s\nSpecify carrier suppression but not CCK rate", extra);
+								sprintf(extra + strlen(extra), "\nSpecify carrier suppression but not CCK rate");
 						}
 						SetCarrierSuppressionTx(padapter, (u8)bStartTest);
 						break;
 		case MP_SINGLE_CARRIER_TX:
 					if (bStartTest != 0)
-							sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra);
+							sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.");
 						SetSingleCarrierTx(padapter, (u8)bStartTest);
 						break;
 
@@ -1463,6 +1466,7 @@ int rtw_mp_tx(struct net_device *dev,
 		u32 bandwidth = 0, sg = 0, channel = 6, txpower = 40, rate = 108, ant = 0, txmode = 1, count = 0;
 		u8 i = 0, j = 0, bStartTest = 1, status = 0, Idx = 0, tmpU1B = 0;
 		u16 antenna = 0;
+		size_t extra_len;
 
 		if (copy_from_user(extra, wrqu->data.pointer, wrqu->data.length))
 			return -EFAULT;
@@ -1489,14 +1493,14 @@ int rtw_mp_tx(struct net_device *dev,
 				return 0;
 		} else if (strncmp(extra, "setting", 7) == 0) {
 				_rtw_memset(extra, 0, wrqu->data.length);
-				sprintf(extra, "Current Setting :\n Channel:%d", pmp_priv->channel);
-				sprintf(extra, "%s\n Bandwidth:%d", extra, pmp_priv->bandwidth);
-				sprintf(extra, "%s\n Rate index:%d", extra, pmp_priv->rateidx);
-				sprintf(extra, "%s\n TxPower index:%d", extra, pmp_priv->txpoweridx);
-				sprintf(extra, "%s\n Antenna TxPath:%d", extra, pmp_priv->antenna_tx);
-				sprintf(extra, "%s\n Antenna RxPath:%d", extra, pmp_priv->antenna_rx);
-				sprintf(extra, "%s\n MP Mode:%d", extra, pmp_priv->mode);
-				wrqu->data.length = strlen(extra);
+				extra_len = sprintf(extra, "Current Setting :\n Channel:%d", pmp_priv->channel);
+				extra_len += sprintf(extra + extra_len, "\n Bandwidth:%d", pmp_priv->bandwidth);
+				extra_len += sprintf(extra + extra_len, "\n Rate index:%d", pmp_priv->rateidx);
+				extra_len += sprintf(extra + extra_len, "\n TxPower index:%d", pmp_priv->txpoweridx);
+				extra_len += sprintf(extra + extra_len, "\n Antenna TxPath:%d", pmp_priv->antenna_tx);
+				extra_len += sprintf(extra + extra_len, "\n Antenna RxPath:%d", pmp_priv->antenna_rx);
+				extra_len += sprintf(extra + extra_len, "\n MP Mode:%d", pmp_priv->mode);
+				wrqu->data.length = extra_len;
 				return 0;
 #ifdef CONFIG_MP_VHT_HW_TX_MODE
 		} else if (strncmp(extra, "pmact", 5) == 0) {
@@ -1633,25 +1637,25 @@ int rtw_mp_tx(struct net_device *dev,
 			if (sscanf(extra, "ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d", &channel, &bandwidth, &rate, &txpower, &ant, &txmode) < 6) {
 					DBG_871X("Invalid format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode);
 					_rtw_memset(extra, 0, wrqu->data.length);
-					sprintf(extra, "\n Please input correct format as bleow:\n");
-					sprintf(extra, "%s\t ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d\n", extra, channel, bandwidth, rate, txpower, ant, txmode);
-					sprintf(extra, "%s\n [ ch : BGN = <1~14> , A or AC = <36~165> ]", extra);
-					sprintf(extra, "%s\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]", extra);
-					sprintf(extra, "%s\n [ rate :	CCK: 1 2 5.5 11M X 2 = < 2 4 11 22 >]", extra);
-					sprintf(extra, "%s\n [		OFDM: 6 9 12 18 24 36 48 54M X 2 = < 12 18 24 36 48 72 96 108>", extra);
-					sprintf(extra, "%s\n [		HT 1S2SS MCS0 ~ MCS15 : < [MCS0]=128 ~ [MCS7]=135 ~ [MCS15]=143 >", extra);
-					sprintf(extra, "%s\n [		HT 3SS MCS16 ~ MCS32 : < [MCS16]=144 ~ [MCS23]=151 ~ [MCS32]=159 >", extra);
-					sprintf(extra, "%s\n [		VHT 1SS MCS0 ~ MCS9 : < [MCS0]=160 ~ [MCS9]=169 >", extra);
-					sprintf(extra, "%s\n [ txpower : 1~63 power index", extra);
-					sprintf(extra, "%s\n [ ant : <A = 1, B = 2, C = 4, D = 8> ,2T ex: AB=3 BC=6 CD=12", extra);
-					sprintf(extra, "%s\n [ txmode : < 0 = CONTINUOUS_TX, 1 = PACKET_TX, 2 = SINGLE_TONE_TX, 3 = CARRIER_SUPPRISSION_TX, 4 = SINGLE_CARRIER_TX>\n", extra);
-					wrqu->data.length = strlen(extra);
+					extra_len = sprintf(extra, "\n Please input correct format as bleow:\n");
+					extra_len += sprintf(extra + extra_len, "\t ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d\n", channel, bandwidth, rate, txpower, ant, txmode);
+					extra_len += sprintf(extra + extra_len, "\n [ ch : BGN = <1~14> , A or AC = <36~165> ]");
+					extra_len += sprintf(extra + extra_len, "\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]");
+					extra_len += sprintf(extra + extra_len, "\n [ rate :	CCK: 1 2 5.5 11M X 2 = < 2 4 11 22 >]");
+					extra_len += sprintf(extra + extra_len, "\n [		OFDM: 6 9 12 18 24 36 48 54M X 2 = < 12 18 24 36 48 72 96 108>");
+					extra_len += sprintf(extra + extra_len, "\n [		HT 1S2SS MCS0 ~ MCS15 : < [MCS0]=128 ~ [MCS7]=135 ~ [MCS15]=143 >");
+					extra_len += sprintf(extra + extra_len, "\n [		HT 3SS MCS16 ~ MCS32 : < [MCS16]=144 ~ [MCS23]=151 ~ [MCS32]=159 >");
+					extra_len += sprintf(extra + extra_len, "\n [		VHT 1SS MCS0 ~ MCS9 : < [MCS0]=160 ~ [MCS9]=169 >");
+					extra_len += sprintf(extra + extra_len, "\n [ txpower : 1~63 power index");
+					extra_len += sprintf(extra + extra_len, "\n [ ant : <A = 1, B = 2, C = 4, D = 8> ,2T ex: AB=3 BC=6 CD=12");
+					extra_len += sprintf(extra + extra_len, "\n [ txmode : < 0 = CONTINUOUS_TX, 1 = PACKET_TX, 2 = SINGLE_TONE_TX, 3 = CARRIER_SUPPRISSION_TX, 4 = SINGLE_CARRIER_TX>\n");
+					wrqu->data.length = extra_len;
 					return status;
 
 			} else {
 				DBG_871X("Got format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode);
 				_rtw_memset(extra, 0, wrqu->data.length);
-				sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
+				extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
 				padapter->mppriv.channel = channel;
 				SetChannel(padapter);
 				pHalData->CurrentChannel = channel;
@@ -1660,13 +1664,13 @@ int rtw_mp_tx(struct net_device *dev,
 					bandwidth = CHANNEL_WIDTH_40;
 				else if (bandwidth == 2)
 					bandwidth = CHANNEL_WIDTH_80;
-				sprintf(extra, "%s\nChange Current Bandwidth %d to Bandwidth %d", extra, padapter->mppriv.bandwidth , bandwidth);
+				extra_len += sprintf(extra + extra_len, "\nChange Current Bandwidth %d to Bandwidth %d", padapter->mppriv.bandwidth , bandwidth);
 				padapter->mppriv.bandwidth = (u8)bandwidth;
 				padapter->mppriv.preamble = sg;
 				SetBandwidth(padapter);
 				pHalData->CurrentChannelBW = bandwidth;
 
-				sprintf(extra, "%s\nSet power level :%d", extra, txpower);
+				extra_len += sprintf(extra + extra_len, "\nSet power level :%d", txpower);
 				padapter->mppriv.txpoweridx = (u8)txpower;
 				pMptCtx->TxPwrLevel[ODM_RF_PATH_A] = (u8)txpower;
 				pMptCtx->TxPwrLevel[ODM_RF_PATH_B] = (u8)txpower;
@@ -1689,13 +1693,13 @@ int rtw_mp_tx(struct net_device *dev,
 				DBG_871X("%s: rate index=%d\n", __func__, rate);
 				if (rate >= MPT_RATE_LAST)
 					return -EINVAL;
-				sprintf(extra, "%s\nSet data rate to %d index %d", extra, padapter->mppriv.rateidx, rate);
+				extra_len += sprintf(extra + extra_len, "\nSet data rate to %d index %d", padapter->mppriv.rateidx, rate);
 
 				padapter->mppriv.rateidx = rate;
 				pMptCtx->MptRateIndex = rate;
 				SetDataRate(padapter);
 
-				sprintf(extra, "%s\nSet Antenna Path :%d",  extra, ant);
+				extra_len += sprintf(extra + extra_len, "\nSet Antenna Path :%d", ant);
 				switch (ant) {
 				case 1:
 					antenna = ANTENNA_A;
@@ -1781,6 +1785,7 @@ int rtw_mp_rx(struct net_device *dev,
 	u32 bandwidth = 0, sg = 0, channel = 6, ant = 0;
 	u16 antenna = 0;
 	u8 bStartRx = 0;
+	size_t extra_len;
 
 	if (copy_from_user(extra, wrqu->data.pointer, wrqu->data.length))
 			return -EFAULT;
@@ -1804,19 +1809,19 @@ int rtw_mp_rx(struct net_device *dev,
 	} else if (sscanf(extra, "ch=%d,bw=%d,ant=%d", &channel, &bandwidth, &ant) < 3) {
 		DBG_871X("Invalid format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant);
 		_rtw_memset(extra, 0, wrqu->data.length);
-		sprintf(extra, "\n Please input correct format as bleow:\n");
-		sprintf(extra, "%s\t ch=%d,bw=%d,ant=%d\n", extra, channel, bandwidth, ant);
-		sprintf(extra, "%s\n [ ch : BGN = <1~14> , A or AC = <36~165> ]", extra);
-		sprintf(extra, "%s\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]", extra);
-		sprintf(extra, "%s\n [ ant : <A = 1, B = 2, C = 4, D = 8> ,2T ex: AB=3 BC=6 CD=12", extra);
-		wrqu->data.length = strlen(extra);
+		extra_len = sprintf(extra, "\n Please input correct format as bleow:\n");
+		extra_len += sprintf(extra + extra_len, "\t ch=%d,bw=%d,ant=%d\n", channel, bandwidth, ant);
+		extra_len += sprintf(extra + extra_len, "\n [ ch : BGN = <1~14> , A or AC = <36~165> ]");
+		extra_len += sprintf(extra + extra_len, "\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]");
+		extra_len += sprintf(extra + extra_len, "\n [ ant : <A = 1, B = 2, C = 4, D = 8> ,2T ex: AB=3 BC=6 CD=12");
+		wrqu->data.length = extra_len;
 		return 0;
 
 	} else {
 		bStartRx = 1;
 		DBG_871X("Got format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant);
 		_rtw_memset(extra, 0, wrqu->data.length);
-		sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
+		extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
 		padapter->mppriv.channel = channel;
 		SetChannel(padapter);
 		pHalData->CurrentChannel = channel;
@@ -1825,13 +1830,13 @@ int rtw_mp_rx(struct net_device *dev,
 			bandwidth = CHANNEL_WIDTH_40;
 		else if (bandwidth == 2)
 			bandwidth = CHANNEL_WIDTH_80;
-		sprintf(extra, "%s\nChange Current Bandwidth %d to Bandwidth %d", extra, padapter->mppriv.bandwidth , bandwidth);
+		extra_len += sprintf(extra + extra_len, "\nChange Current Bandwidth %d to Bandwidth %d", padapter->mppriv.bandwidth , bandwidth);
 		padapter->mppriv.bandwidth = (u8)bandwidth;
 		padapter->mppriv.preamble = sg;
 		SetBandwidth(padapter);
 		pHalData->CurrentChannelBW = bandwidth;
 
-		sprintf(extra, "%s\nSet Antenna Path :%d",  extra, ant);
+		extra_len += sprintf(extra + extra_len, "\nSet Antenna Path :%d", ant);
 		switch (ant) {
 		case 1:
 			antenna = ANTENNA_A;
@@ -1882,7 +1887,7 @@ int rtw_mp_rx(struct net_device *dev,
 		pHalData->AntennaTxPath = antenna;
 		SetAntenna(padapter);
 
-		sprintf(extra, "%s\nstart Rx", extra);
+		extra_len += sprintf(extra + extra_len, "\nstart Rx");
 		SetPacketRx(padapter, bStartRx, _FALSE);
 	}
 	wrqu->data.length = strlen(extra);
@@ -2310,16 +2315,17 @@ int rtw_mp_SetBT(struct net_device *dev,
 	mptbt_BtControlProcess(padapter, &BtReq);
 
 	if (readtherm == 0) {
-		sprintf(extra, "BT thermal=");
+		size_t extra_len = sprintf(extra, "BT thermal=");
 		for (i = 4; i < pMptCtx->mptOutLen; i++) {
 			if ((pMptCtx->mptOutBuf[i] == 0x00) && (pMptCtx->mptOutBuf[i + 1] == 0x00))
 				goto exit;
 
-			sprintf(extra, "%s %d ", extra, (pMptCtx->mptOutBuf[i] & 0x1f));
+			extra_len += sprintf(extra + extra_len, " %d ", (pMptCtx->mptOutBuf[i] & 0x1f));
 		}
 	} else {
+		size_t extra_len = strlen(extra);
 		for (i = 4; i < pMptCtx->mptOutLen; i++)
-			sprintf(extra, "%s 0x%x ", extra, pMptCtx->mptOutBuf[i]);
+			extra_len += sprintf(extra + extra_len, " 0x%x ", pMptCtx->mptOutBuf[i]);
 	}
 
 exit:
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8189es/core/rtw_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8189es/core/rtw_mp.c
index b7b7da5889e02f..0fe9b0a1cdc0ef 100644
--- a/drivers/net/wireless/rockchip_wlan/rtl8189es/core/rtw_mp.c
+++ b/drivers/net/wireless/rockchip_wlan/rtl8189es/core/rtw_mp.c
@@ -1912,7 +1912,7 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data)
 {
 	u32 i, psd_pts=0, psd_start=0, psd_stop=0;
 	u32 psd_data=0;
-
+	size_t data_len = 0;
 
 #ifdef PLATFORM_LINUX
 	if (!netif_running(pAdapter->pnetdev)) {
@@ -1944,7 +1944,7 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data)
 		} else {
 			psd_data = rtw_GetPSDData(pAdapter, i);
 		}
-		sprintf(data, "%s%x ", data, psd_data);
+		data_len += sprintf(data + data_len, "%x ", psd_data);
 		i++;
 	}
 
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8189es/os_dep/linux/ioctl_linux.c b/drivers/net/wireless/rockchip_wlan/rtl8189es/os_dep/linux/ioctl_linux.c
index b260fab148eae3..7d1aff77979b8d 100644
--- a/drivers/net/wireless/rockchip_wlan/rtl8189es/os_dep/linux/ioctl_linux.c
+++ b/drivers/net/wireless/rockchip_wlan/rtl8189es/os_dep/linux/ioctl_linux.c
@@ -9876,6 +9876,7 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 	#ifdef CONFIG_IOL
 	u8 org_fw_iol = padapter->registrypriv.fw_iol;// 0:Disable, 1:enable, 2:by usb speed
 	#endif
+	size_t extra_len;
 	
 	wrqu = (struct iw_point*)wdata;
 	pwrctrlpriv = adapter_to_pwrctl(padapter);
@@ -9936,23 +9937,23 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 	{
 		mapLen = EFUSE_MAP_SIZE;
 		
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < EFUSE_MAP_SIZE; i += 16)
 		{
 //			DBG_871X("0x%02x\t", i);
-			sprintf(extra, "%s0x%02x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%02x\t", i);
 			for (j=0; j<8; j++) {
 //				DBG_871X("%02X ", data[i+j]);
-				sprintf(extra, "%s%02X ", extra, PROMContent[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", PROMContent[i+j]);
 			}
 //			DBG_871X("\t");
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j<16; j++) {
 //				DBG_871X("%02X ", data[i+j]);
-				sprintf(extra, "%s%02X ", extra, PROMContent[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", PROMContent[i+j]);
 			}
 //			DBG_871X("\n");
-			sprintf(extra,"%s\n",extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 //		DBG_871X("\n");
 	}
@@ -9994,18 +9995,18 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		} else
 			order = 0;
 
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < cnt; i += 16) {
-			sprintf(extra, "%s0x%02x\t", extra, shift + i);
+			extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i);
 			for (j = 0; j < 8; j++)
-				sprintf(extra, "%s%02X ", extra, efuse[i+j]);
-			sprintf(extra, "%s\t", extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", efuse[i+j]);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j < 16; j++)
-				sprintf(extra, "%s%02X ", extra, efuse[i+j]);
-			sprintf(extra,"%s\n",extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", efuse[i+j]);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 		if ((shift + cnt) < mapLen)
-			sprintf(extra, "%s\t...more\n", extra);
+			extra_len += sprintf(extra + extra_len, "\t...more\n");
 	}
 	else if (strcmp(tmp[0], "rmap") == 0)
 	{
@@ -10046,9 +10047,10 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 //		DBG_871X("%s: data={", __FUNCTION__);
 		*extra = 0;
+		extra_len = 0;
 		for (i=0; i<cnts; i++) {
 //			DBG_871X("0x%02x ", data[i]);
-			sprintf(extra, "%s0x%02X ", extra, data[i]);
+			extra_len += sprintf(extra + extra_len, "0x%02X ", data[i]);
 		}
 //		DBG_871X("}\n");
 	}
@@ -10069,17 +10071,17 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 		_rtw_memset(extra,'\0',strlen(extra));
 
-				sprintf(extra, "\n0x00\t");
+				extra_len = sprintf(extra, "\n0x00\t");
 
 		for (i = 0; i < mapLen ; i++) {
-					sprintf(extra, "%s%02X", extra, rawdata[i]);
+					extra_len += sprintf(extra + extra_len, "%02X", rawdata[i]);
 					if ((i & 0xF) == 0xF) {
-						sprintf(extra, "%s\n", extra);
-						sprintf(extra, "%s0x%02x\t", extra, i+1);
+						extra_len += sprintf(extra + extra_len, "\n");
+						extra_len += sprintf(extra + extra_len, "0x%02x\t", i+1);
 			} else if ((i & 0x7) == 0x7) {
-						sprintf(extra, "%s \t", extra);
+						extra_len += sprintf(extra + extra_len, " \t");
 					} else {
-						sprintf(extra, "%s ", extra);
+						extra_len += sprintf(extra + extra_len, " ");
 					}
 				}
 
@@ -10095,22 +10097,22 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		}
 		_rtw_memset(extra,'\0',strlen(extra));
 		//		DBG_871X("%s: realraw={\n", __FUNCTION__);
-				sprintf(extra, "\n0x00\t");
+				extra_len = sprintf(extra, "\n0x00\t");
 				for (i= 512; i< mapLen; i++)
 				{
 		//			DBG_871X("%02X", rawdata[i]);
-					sprintf(extra, "%s%02X", extra, rawdata[i]);
+					extra_len += sprintf(extra + extra_len, "%02X", rawdata[i]);
 					if ((i & 0xF) == 0xF) {
 		//				DBG_871X("\n");
-						sprintf(extra, "%s\n", extra);
-						sprintf(extra, "%s0x%02x\t", extra, i+1);
+						extra_len += sprintf(extra + extra_len, "\n");
+						extra_len += sprintf(extra + extra_len, "0x%02x\t", i+1);
 					}
 					else if ((i & 0x7) == 0x7){
 		//				DBG_871X("\t");
-						sprintf(extra, "%s \t", extra);
+						extra_len += sprintf(extra + extra_len, " \t");
 					} else {
 		//				DBG_871X(" ");
-						sprintf(extra, "%s ", extra);
+						extra_len += sprintf(extra + extra_len, " ");
 					}
 				}
 		//		DBG_871X("}\n");
@@ -10141,14 +10143,15 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 //		DBG_871X("%s: MAC address={", __FUNCTION__);
 		*extra = 0;
+		extra_len = 0;
 		for (i=0; i<cnts; i++)
 		{
 //			DBG_871X("%02X", data[i]);
-			sprintf(extra, "%s%02X", extra, data[i]);
+			extra_len += sprintf(extra + extra_len, "%02X", data[i]);
 			if (i != (cnts-1))
 			{
 //				DBG_871X(":");
-				sprintf(extra,"%s:",extra);
+				extra_len += sprintf(extra + extra_len, ":");
 			}
 		}
 //		DBG_871X("}\n");
@@ -10197,14 +10200,15 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 //		DBG_871X("%s: {VID,PID}={", __FUNCTION__);
 		*extra = 0;
+		extra_len = 0;
 		for (i=0; i<cnts; i++)
 		{
 //			DBG_871X("0x%02x", data[i]);
-			sprintf(extra, "%s0x%02X", extra, data[i]);
+			extra_len += sprintf(extra + extra_len, "0x%02X", data[i]);
 			if (i != (cnts-1))
 			{
 //				DBG_871X(",");
-				sprintf(extra,"%s,",extra);
+				extra_len += sprintf(extra + extra_len, ",");
 			}
 		}
 //		DBG_871X("}\n");
@@ -10226,23 +10230,23 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		}
 
 //		DBG_871X("OFFSET\tVALUE(hex)\n");
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i=0; i<512; i+=16) // set 512 because the iwpriv's extra size have limit 0x7FF
 		{
 //			DBG_871X("0x%03x\t", i);
-			sprintf(extra, "%s0x%03x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%03x\t", i);
 			for (j=0; j<8; j++) {
 //				DBG_871X("%02X ", pEfuseHal->BTEfuseInitMap[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]);
 			}
 //			DBG_871X("\t");
-			sprintf(extra,"%s\t",extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j<16; j++) {
 //				DBG_871X("%02X ", pEfuseHal->BTEfuseInitMap[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]);
 			}
 //			DBG_871X("\n");
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 //		DBG_871X("\n");
 	}
@@ -10259,24 +10263,24 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		}
 
 //		DBG_871X("OFFSET\tVALUE(hex)\n");
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i=512; i<1024 ; i+=16)
 		{
 //			DBG_871X("0x%03x\t", i);
-			sprintf(extra, "%s0x%03x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%03x\t", i);
 			for (j=0; j<8; j++)
 			{
 //				DBG_871X("%02X ", data[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]);
 			}
 //			DBG_871X("\t");
-			sprintf(extra,"%s\t",extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j<16; j++) {
 //				DBG_871X("%02X ", data[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]);
 			}
 //			DBG_871X("\n");
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 //		DBG_871X("\n");
 	}
@@ -10318,11 +10322,12 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		}
 
 		*extra = 0;
+		extra_len = 0;
 //		DBG_871X("%s: bt efuse data={", __FUNCTION__);
 		for (i=0; i<cnts; i++)
 		{
 //			DBG_871X("0x%02x ", data[i]);
-			sprintf(extra, "%s 0x%02X ", extra, data[i]);
+			extra_len += sprintf(extra + extra_len, " 0x%02X ", data[i]);
 		}
 //		DBG_871X("}\n");
 		DBG_871X(FUNC_ADPT_FMT ": BT MAC=[%s]\n", FUNC_ADPT_ARG(padapter), extra);
@@ -10330,69 +10335,69 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 	else if (strcmp(tmp[0], "btffake") == 0)
 	{
 //		DBG_871X("OFFSET\tVALUE(hex)\n");
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i=0; i<512; i+=16)
 		{
 //			DBG_871X("0x%03x\t", i);
-			sprintf(extra, "%s0x%03x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%03x\t", i);
 			for (j=0; j<8; j++) {
 //				DBG_871X("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
 			}
 //			DBG_871X("\t");
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j<16; j++) {
 //				DBG_871X("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
 			}
 //			DBG_871X("\n");
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 //		DBG_871X("\n");
 	}
 	else if (strcmp(tmp[0],"btbfake") == 0)
 	{
 //		DBG_871X("OFFSET\tVALUE(hex)\n");
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i=512; i<1024; i+=16)
 		{
 //			DBG_871X("0x%03x\t", i);
-			sprintf(extra, "%s0x%03x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%03x\t", i);
 			for (j=0; j<8; j++) {
 //				DBG_871X("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
 			}
 //			DBG_871X("\t");
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j<16; j++) {
 //				DBG_871X("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
 			}
 //			DBG_871X("\n");
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 //		DBG_871X("\n");
 	}
 	else if (strcmp(tmp[0],"wlrfkmap")== 0)
 	{
 //		DBG_871X("OFFSET\tVALUE(hex)\n");
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i=0; i<EFUSE_MAP_SIZE; i+=16)
 		{
 //			DBG_871X("\t0x%02x\t", i);
-			sprintf(extra, "%s0x%02x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%02x\t", i);
 			for (j=0; j<8; j++) {
 //				DBG_871X("%02X ", pEfuseHal->fakeEfuseModifiedMap[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeEfuseModifiedMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeEfuseModifiedMap[i+j]);
 			}
 //			DBG_871X("\t");
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j<16; j++) {
 //				DBG_871X("%02X ", pEfuseHal->fakeEfuseModifiedMap[i+j]);
-				sprintf(extra, "%s %02X", extra, pEfuseHal->fakeEfuseModifiedMap[i+j]);
+				extra_len += sprintf(extra + extra_len, " %02X", pEfuseHal->fakeEfuseModifiedMap[i+j]);
 			}
 //			DBG_871X("\n");
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 //		DBG_871X("\n");
 
@@ -10420,9 +10425,10 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		
 		//		DBG_871X("%s: data={", __FUNCTION__);
 			*extra = 0;
+			extra_len = 0;
 			for (i=0; i<cnts; i++) {
 					DBG_871X("wlrfkrmap = 0x%02x \n", pEfuseHal->fakeEfuseModifiedMap[addr+i]);
-					sprintf(extra, "%s0x%02X ", extra, pEfuseHal->fakeEfuseModifiedMap[addr+i]);
+					extra_len += sprintf(extra + extra_len, "0x%02X ", pEfuseHal->fakeEfuseModifiedMap[addr+i]);
 			}
 	}
 	else if (strcmp(tmp[0],"btrfkrmap")== 0)
@@ -10448,9 +10454,10 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		
 		//		DBG_871X("%s: data={", __FUNCTION__);
 			*extra = 0;
+			extra_len = 0;
 			for (i=0; i<cnts; i++) {
 					DBG_871X("wlrfkrmap = 0x%02x \n", pEfuseHal->fakeBTEfuseModifiedMap[addr+i]);
-					sprintf(extra, "%s0x%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[addr+i]);
+					extra_len += sprintf(extra + extra_len, "0x%02X ", pEfuseHal->fakeBTEfuseModifiedMap[addr+i]);
 			}
 	}
 	else
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8189es/os_dep/linux/ioctl_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8189es/os_dep/linux/ioctl_mp.c
index 08aa41a2525c9c..46442d16b0a7c9 100644
--- a/drivers/net/wireless/rockchip_wlan/rtl8189es/os_dep/linux/ioctl_mp.c
+++ b/drivers/net/wireless/rockchip_wlan/rtl8189es/os_dep/linux/ioctl_mp.c
@@ -197,7 +197,7 @@ int rtw_mp_read_reg(struct net_device *dev,
 				if (*pnext != '\0') {
 					/*strtout = simple_strtoul(pnext , &ptmp, 16);*/
 					ret = sscanf(pnext, "%x", &strtout);
-					sprintf(extra, "%s %d" , extra , strtout);
+					sprintf(extra + strlen(extra), " %d", strtout);
 				} else
 					break;
 				pch = pnext;
@@ -229,7 +229,7 @@ int rtw_mp_read_reg(struct net_device *dev,
 				pnext++;
 				if (*pnext != '\0') {
 					ret = sscanf(pnext, "%x", &strtout);
-					sprintf(extra, "%s %d" , extra , strtout);
+					sprintf(extra + strlen(extra), " %d", strtout);
 				} else
 					break;
 				pch = pnext;
@@ -340,20 +340,23 @@ int rtw_mp_read_rf(struct net_device *dev,
 	pch = tmp;
 	DBG_871X("pch=%s", pch);
 
-	while (*pch != '\0') {
-		pnext = strpbrk(pch, " ");
-		if (!pnext)
-			break;
-		pnext++;
-		if (*pnext != '\0') {
-			/*strtou =simple_strtoul(pnext , &ptmp, 16);*/
-			ret = sscanf(pnext, "%x", &strtou);
-			sprintf(extra, "%s %d" , extra , strtou);
-		} else
-			break;
-		pch = pnext;
+	{
+		size_t extra_len = strlen(extra);
+		while (*pch != '\0') {
+			pnext = strpbrk(pch, " ");
+			if (!pnext)
+				break;
+			pnext++;
+			if (*pnext != '\0') {
+				/*strtou =simple_strtoul(pnext , &ptmp, 16);*/
+				ret = sscanf(pnext, "%x", &strtou);
+				extra_len += sprintf(extra + extra_len, " %d", strtou);
+			} else
+				break;
+			pch = pnext;
+		}
+		wrqu->length = extra_len;
 	}
-	wrqu->length = strlen(extra);
 
 	return 0;
 }
@@ -1366,7 +1369,7 @@ int rtw_mp_pretx_proc(PADAPTER padapter, u8 bStartTest, char *extra)
 							pmp_priv->mode = MP_ON;
 							sprintf(extra, "Stop continuous Tx");
 						} else if (pmp_priv->tx.stop == 1) {
-							sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500 count=%u\n", extra, pmp_priv->tx.count);
+							sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500 count=%u\n", pmp_priv->tx.count);
 							pmp_priv->tx.stop = 0;
 							SetPacketTx(padapter);
 						} else {
@@ -1375,26 +1378,26 @@ int rtw_mp_pretx_proc(PADAPTER padapter, u8 bStartTest, char *extra)
 						return 0;
 		case MP_SINGLE_TONE_TX:
 						if (bStartTest != 0)
-							sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra);
+							sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.");
 						SetSingleToneTx(padapter, (u8)bStartTest);
 						break;
 		case MP_CONTINUOUS_TX:
 						if (bStartTest != 0)
-							sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra);
+							sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.");
 						SetContinuousTx(padapter, (u8)bStartTest);
 						break;
 		case MP_CARRIER_SUPPRISSION_TX:
 						if (bStartTest != 0) {
 							if (pmp_priv->rateidx <= MPT_RATE_11M)
-								sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra);
+								sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.");
 							else
-								sprintf(extra, "%s\nSpecify carrier suppression but not CCK rate", extra);
+								sprintf(extra + strlen(extra), "\nSpecify carrier suppression but not CCK rate");
 						}
 						SetCarrierSuppressionTx(padapter, (u8)bStartTest);
 						break;
 		case MP_SINGLE_CARRIER_TX:
 					if (bStartTest != 0)
-							sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra);
+							sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.");
 						SetSingleCarrierTx(padapter, (u8)bStartTest);
 						break;
 
@@ -1445,6 +1448,7 @@ int rtw_mp_tx(struct net_device *dev,
 		u32 bandwidth = 0, sg = 0, channel = 6, txpower = 40, rate = 108, ant = 0, txmode = 1, count = 0;
 		u8 i = 0, j = 0, bStartTest = 1, status = 0;
 		u16 antenna = 0;
+		size_t extra_len;
 
 		if (copy_from_user(extra, wrqu->data.pointer, wrqu->data.length))
 			return -EFAULT;
@@ -1464,39 +1468,39 @@ int rtw_mp_tx(struct net_device *dev,
 				return 0;
 		} else if (strncmp(extra, "setting", 5) == 0) {
 				_rtw_memset(extra, 0, wrqu->data.length);
-				sprintf(extra, "Current Setting :\n Channel:%d", pmp_priv->channel);
-				sprintf(extra, "%s\n Bandwidth:%d", extra, pmp_priv->bandwidth);
-				sprintf(extra, "%s\n Rate index:%d", extra, pmp_priv->rateidx);
-				sprintf(extra, "%s\n TxPower index:%d", extra, pmp_priv->txpoweridx);
-				sprintf(extra, "%s\n Antenna TxPath:%d", extra, pmp_priv->antenna_tx);
-				sprintf(extra, "%s\n Antenna RxPath:%d", extra, pmp_priv->antenna_rx);
-				sprintf(extra, "%s\n MP Mode:%d", extra, pmp_priv->mode);
-				wrqu->data.length = strlen(extra);
+				extra_len = sprintf(extra, "Current Setting :\n Channel:%d", pmp_priv->channel);
+				extra_len += sprintf(extra + extra_len, "\n Bandwidth:%d", pmp_priv->bandwidth);
+				extra_len += sprintf(extra + extra_len, "\n Rate index:%d", pmp_priv->rateidx);
+				extra_len += sprintf(extra + extra_len, "\n TxPower index:%d", pmp_priv->txpoweridx);
+				extra_len += sprintf(extra + extra_len, "\n Antenna TxPath:%d", pmp_priv->antenna_tx);
+				extra_len += sprintf(extra + extra_len, "\n Antenna RxPath:%d", pmp_priv->antenna_rx);
+				extra_len += sprintf(extra + extra_len, "\n MP Mode:%d", pmp_priv->mode);
+				wrqu->data.length = extra_len;
 				return 0;
 		} else {
 
 			if (sscanf(extra, "ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d", &channel, &bandwidth, &rate, &txpower, &ant, &txmode) < 6) {
 					DBG_871X("Invalid format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode);
 					_rtw_memset(extra, 0, wrqu->data.length);
-					sprintf(extra, "\n Please input correct format as bleow:\n");
-					sprintf(extra, "%s\t ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d\n", extra, channel, bandwidth, rate, txpower, ant, txmode);
-					sprintf(extra, "%s\n [ ch : BGN = <1~14> , A or AC = <36~165> ]", extra);
-					sprintf(extra, "%s\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]", extra);
-					sprintf(extra, "%s\n [ rate :	CCK: 1 2 5.5 11M X 2 = < 2 4 11 22 >]", extra);
-					sprintf(extra, "%s\n [		OFDM: 6 9 12 18 24 36 48 54M X 2 = < 12 18 24 36 48 72 96 108>", extra);
-					sprintf(extra, "%s\n [		HT 1S2SS MCS0 ~ MCS15 : < [MCS0]=128 ~ [MCS7]=135 ~ [MCS15]=143 >", extra);
-					sprintf(extra, "%s\n [		HT 3SS MCS16 ~ MCS32 : < [MCS16]=144 ~ [MCS23]=151 ~ [MCS32]=159 >", extra);
-					sprintf(extra, "%s\n [		VHT 1SS MCS0 ~ MCS9 : < [MCS0]=160 ~ [MCS9]=169 >", extra);
-					sprintf(extra, "%s\n [ txpower : 1~63 power index", extra);
-					sprintf(extra, "%s\n [ ant : <A = 1, B = 2, C = 4, D = 8> ,2T ex: AB=3 BC=6 CD=12", extra);
-					sprintf(extra, "%s\n [ txmode : < 0 = CONTINUOUS_TX, 1 = PACKET_TX, 2 = SINGLE_TONE_TX, 3 = CARRIER_SUPPRISSION_TX, 4 = SINGLE_CARRIER_TX>\n", extra);
-					wrqu->data.length = strlen(extra);
+					extra_len = sprintf(extra, "\n Please input correct format as bleow:\n");
+					extra_len += sprintf(extra + extra_len, "\t ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d\n", channel, bandwidth, rate, txpower, ant, txmode);
+					extra_len += sprintf(extra + extra_len, "\n [ ch : BGN = <1~14> , A or AC = <36~165> ]");
+					extra_len += sprintf(extra + extra_len, "\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]");
+					extra_len += sprintf(extra + extra_len, "\n [ rate :	CCK: 1 2 5.5 11M X 2 = < 2 4 11 22 >]");
+					extra_len += sprintf(extra + extra_len, "\n [		OFDM: 6 9 12 18 24 36 48 54M X 2 = < 12 18 24 36 48 72 96 108>");
+					extra_len += sprintf(extra + extra_len, "\n [		HT 1S2SS MCS0 ~ MCS15 : < [MCS0]=128 ~ [MCS7]=135 ~ [MCS15]=143 >");
+					extra_len += sprintf(extra + extra_len, "\n [		HT 3SS MCS16 ~ MCS32 : < [MCS16]=144 ~ [MCS23]=151 ~ [MCS32]=159 >");
+					extra_len += sprintf(extra + extra_len, "\n [		VHT 1SS MCS0 ~ MCS9 : < [MCS0]=160 ~ [MCS9]=169 >");
+					extra_len += sprintf(extra + extra_len, "\n [ txpower : 1~63 power index");
+					extra_len += sprintf(extra + extra_len, "\n [ ant : <A = 1, B = 2, C = 4, D = 8> ,2T ex: AB=3 BC=6 CD=12");
+					extra_len += sprintf(extra + extra_len, "\n [ txmode : < 0 = CONTINUOUS_TX, 1 = PACKET_TX, 2 = SINGLE_TONE_TX, 3 = CARRIER_SUPPRISSION_TX, 4 = SINGLE_CARRIER_TX>\n");
+					wrqu->data.length = extra_len;
 					return status;
 
 			} else {
 				DBG_871X("Got format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode);
 				_rtw_memset(extra, 0, wrqu->data.length);
-				sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
+				extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
 				padapter->mppriv.channel = channel;
 				SetChannel(padapter);
 				pHalData->CurrentChannel = channel;
@@ -1505,13 +1509,13 @@ int rtw_mp_tx(struct net_device *dev,
 					bandwidth = CHANNEL_WIDTH_40;
 				else if (bandwidth == 2)
 					bandwidth = CHANNEL_WIDTH_80;
-				sprintf(extra, "%s\nChange Current Bandwidth %d to Bandwidth %d", extra, padapter->mppriv.bandwidth , bandwidth);
+				extra_len += sprintf(extra + extra_len, "\nChange Current Bandwidth %d to Bandwidth %d", padapter->mppriv.bandwidth , bandwidth);
 				padapter->mppriv.bandwidth = (u8)bandwidth;
 				padapter->mppriv.preamble = sg;
 				SetBandwidth(padapter);
 				pHalData->CurrentChannelBW = bandwidth;
 
-				sprintf(extra, "%s\nSet power level :%d", extra, txpower);
+				extra_len += sprintf(extra + extra_len, "\nSet power level :%d", txpower);
 				padapter->mppriv.txpoweridx = (u8)txpower;
 				pMptCtx->TxPwrLevel[ODM_RF_PATH_A] = (u8)txpower;
 				pMptCtx->TxPwrLevel[ODM_RF_PATH_B] = (u8)txpower;
@@ -1534,13 +1538,13 @@ int rtw_mp_tx(struct net_device *dev,
 				DBG_871X("%s: rate index=%d\n", __func__, rate);
 				if (rate >= MPT_RATE_LAST)
 					return -EINVAL;
-				sprintf(extra, "%s\nSet data rate to %d index %d", extra, padapter->mppriv.rateidx, rate);
+				extra_len += sprintf(extra + extra_len, "\nSet data rate to %d index %d", padapter->mppriv.rateidx, rate);
 
 				padapter->mppriv.rateidx = rate;
 				pMptCtx->MptRateIndex = rate;
 				SetDataRate(padapter);
 
-				sprintf(extra, "%s\nSet Antenna Path :%d",  extra, ant);
+				extra_len += sprintf(extra + extra_len, "\nSet Antenna Path :%d", ant);
 				switch (ant) {
 				case 1:
 					antenna = ANTENNA_A;
@@ -1626,6 +1630,7 @@ int rtw_mp_rx(struct net_device *dev,
 	u32 bandwidth = 0, sg = 0, channel = 6, ant = 0;
 	u16 antenna = 0;
 	u8 bStartRx = 0;
+	size_t extra_len;
 
 	if (copy_from_user(extra, wrqu->data.pointer, wrqu->data.length))
 			return -EFAULT;
@@ -1641,19 +1646,19 @@ int rtw_mp_rx(struct net_device *dev,
 	} else if (sscanf(extra, "ch=%d,bw=%d,ant=%d", &channel, &bandwidth, &ant) < 3) {
 		DBG_871X("Invalid format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant);
 		_rtw_memset(extra, 0, wrqu->data.length);
-		sprintf(extra, "\n Please input correct format as bleow:\n");
-		sprintf(extra, "%s\t ch=%d,bw=%d,ant=%d\n", extra, channel, bandwidth, ant);
-		sprintf(extra, "%s\n [ ch : BGN = <1~14> , A or AC = <36~165> ]", extra);
-		sprintf(extra, "%s\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]", extra);
-		sprintf(extra, "%s\n [ ant : <A = 1, B = 2, C = 4, D = 8> ,2T ex: AB=3 BC=6 CD=12", extra);
-		wrqu->data.length = strlen(extra);
+		extra_len = sprintf(extra, "\n Please input correct format as bleow:\n");
+		extra_len += sprintf(extra + extra_len, "\t ch=%d,bw=%d,ant=%d\n", channel, bandwidth, ant);
+		extra_len += sprintf(extra + extra_len, "\n [ ch : BGN = <1~14> , A or AC = <36~165> ]");
+		extra_len += sprintf(extra + extra_len, "\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]");
+		extra_len += sprintf(extra + extra_len, "\n [ ant : <A = 1, B = 2, C = 4, D = 8> ,2T ex: AB=3 BC=6 CD=12");
+		wrqu->data.length = extra_len;
 		return 0;
 
 	} else {
 		bStartRx = 1;
 		DBG_871X("Got format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant);
 		_rtw_memset(extra, 0, wrqu->data.length);
-		sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
+		extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
 		padapter->mppriv.channel = channel;
 		SetChannel(padapter);
 		pHalData->CurrentChannel = channel;
@@ -1662,13 +1667,13 @@ int rtw_mp_rx(struct net_device *dev,
 			bandwidth = CHANNEL_WIDTH_40;
 		else if (bandwidth == 2)
 			bandwidth = CHANNEL_WIDTH_80;
-		sprintf(extra, "%s\nChange Current Bandwidth %d to Bandwidth %d", extra, padapter->mppriv.bandwidth , bandwidth);
+		extra_len += sprintf(extra + extra_len, "\nChange Current Bandwidth %d to Bandwidth %d", padapter->mppriv.bandwidth , bandwidth);
 		padapter->mppriv.bandwidth = (u8)bandwidth;
 		padapter->mppriv.preamble = sg;
 		SetBandwidth(padapter);
 		pHalData->CurrentChannelBW = bandwidth;
 
-		sprintf(extra, "%s\nSet Antenna Path :%d",  extra, ant);
+		extra_len += sprintf(extra + extra_len, "\nSet Antenna Path :%d", ant);
 		switch (ant) {
 		case 1:
 			antenna = ANTENNA_A;
@@ -1719,7 +1724,7 @@ int rtw_mp_rx(struct net_device *dev,
 		pHalData->AntennaTxPath = antenna;
 		SetAntenna(padapter);
 
-		sprintf(extra, "%s\nstart Rx", extra);
+		extra_len += sprintf(extra + extra_len, "\nstart Rx");
 		SetPacketRx(padapter, bStartRx, _FALSE);
 	}
 	wrqu->data.length = strlen(extra);
@@ -2147,16 +2152,17 @@ int rtw_mp_SetBT(struct net_device *dev,
 	mptbt_BtControlProcess(padapter, &BtReq);
 
 	if (readtherm == 0) {
-		sprintf(extra, "BT thermal=");
+		size_t extra_len = sprintf(extra, "BT thermal=");
 		for (i = 4; i < pMptCtx->mptOutLen; i++) {
 			if ((pMptCtx->mptOutBuf[i] == 0x00) && (pMptCtx->mptOutBuf[i + 1] == 0x00))
 				goto exit;
 
-			sprintf(extra, "%s %d ", extra, (pMptCtx->mptOutBuf[i] & 0x1f));
+			extra_len += sprintf(extra + extra_len, " %d ", (pMptCtx->mptOutBuf[i] & 0x1f));
 		}
 	} else {
+		size_t extra_len = strlen(extra);
 		for (i = 4; i < pMptCtx->mptOutLen; i++)
-			sprintf(extra, "%s 0x%x ", extra, pMptCtx->mptOutBuf[i]);
+			extra_len += sprintf(extra + extra_len, " 0x%x ", pMptCtx->mptOutBuf[i]);
 	}
 
 exit:
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8189fs/core/rtw_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8189fs/core/rtw_mp.c
index ed3b7338f3bf57..9c8d4509a2df4f 100644
--- a/drivers/net/wireless/rockchip_wlan/rtl8189fs/core/rtw_mp.c
+++ b/drivers/net/wireless/rockchip_wlan/rtl8189fs/core/rtw_mp.c
@@ -2170,14 +2170,17 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data)
 
 	data[0] = '\0';
 
-	i = psd_start;
-	while (i < psd_stop) {
-		if (i >= psd_pts)
-			psd_data = rtw_GetPSDData(pAdapter, i - psd_pts);
-		else
-			psd_data = rtw_GetPSDData(pAdapter, i);
-		sprintf(data, "%s%x ", data, psd_data);
-		i++;
+	{
+		size_t extra_len = strlen(data);
+		i = psd_start;
+		while (i < psd_stop) {
+			if (i >= psd_pts)
+				psd_data = rtw_GetPSDData(pAdapter, i - psd_pts);
+			else
+				psd_data = rtw_GetPSDData(pAdapter, i);
+			extra_len += sprintf(data + extra_len, "%x ", psd_data);
+			i++;
+		}
 	}
 
 #ifdef CONFIG_LONG_DELAY_ISSUE
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8189fs/os_dep/linux/ioctl_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8189fs/os_dep/linux/ioctl_mp.c
index 0e482ebeda72de..84404cb32b485a 100644
--- a/drivers/net/wireless/rockchip_wlan/rtl8189fs/os_dep/linux/ioctl_mp.c
+++ b/drivers/net/wireless/rockchip_wlan/rtl8189fs/os_dep/linux/ioctl_mp.c
@@ -1799,7 +1799,7 @@ int rtw_mp_tx(struct net_device *dev,
 			char *pextra = extra;
 			RTW_INFO("Got format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode);
 			_rtw_memset(extra, 0, wrqu->data.length);
-			sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
+			extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
 			padapter->mppriv.channel = channel;
 			SetChannel(padapter);
 			pHalData->current_channel = channel;
@@ -1922,6 +1922,7 @@ int rtw_mp_rx(struct net_device *dev,
 	      struct iw_request_info *info,
 	      union iwreq_data *wrqu, char *extra)
 {
+	size_t extra_len;
 	PADAPTER padapter = rtw_netdev_priv(dev);
 	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(padapter);
 	struct mp_priv *pmp_priv = &padapter->mppriv;
@@ -1966,7 +1967,7 @@ int rtw_mp_rx(struct net_device *dev,
 		bStartRx = 1;
 		RTW_INFO("Got format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant);
 		_rtw_memset(extra, 0, wrqu->data.length);
-		sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
+		extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
 		padapter->mppriv.channel = channel;
 		SetChannel(padapter);
 		pHalData->current_channel = channel;
@@ -2138,6 +2139,7 @@ int rtw_efuse_mask_file(struct net_device *dev,
 	char *rtw_efuse_mask_file_path;
 	u8 Status;
 	PADAPTER padapter = rtw_netdev_priv(dev);
+	size_t extra_len;
 
 	_rtw_memset(maskfileBuffer, 0x00, sizeof(maskfileBuffer));
 
@@ -2189,11 +2191,11 @@ int rtw_efuse_mask_file(struct net_device *dev,
 		 } while (count < 64);
 
 		for (i = 0; i < count; i++)
-			sprintf(extra, "%s:%02x", extra, maskfileBuffer[i]);
+			extra_len += sprintf(extra + extra_len, ":%02x", maskfileBuffer[i]);
 
 		padapter->registrypriv.bFileMaskEfuse = _TRUE;
 
-		sprintf(extra, "%s\nLoad Efuse Mask data %d hex ok\n", extra, count);
+		extra_len += sprintf(extra + extra_len, "\nLoad Efuse Mask data %d hex ok\n", count);
 		wrqu->data.length = strlen(extra);
 		return 0;
 	}
@@ -2616,16 +2618,17 @@ int rtw_mp_SetBT(struct net_device *dev,
 	mptbt_BtControlProcess(padapter, &BtReq);
 
 	if (readtherm == 0) {
-		sprintf(extra, "BT thermal=");
+		size_t extra_len = sprintf(extra, "BT thermal=");
 		for (i = 4; i < pMptCtx->mptOutLen; i++) {
 			if ((pMptCtx->mptOutBuf[i] == 0x00) && (pMptCtx->mptOutBuf[i + 1] == 0x00))
 				goto exit;
 
-			sprintf(extra, "%s %d ", extra, (pMptCtx->mptOutBuf[i] & 0x1f));
+			extra_len += sprintf(extra + extra_len, " %d ", (pMptCtx->mptOutBuf[i] & 0x1f));
 		}
 	} else {
+		size_t extra_len = strlen(extra);
 		for (i = 4; i < pMptCtx->mptOutLen; i++)
-			sprintf(extra, "%s 0x%x ", extra, pMptCtx->mptOutBuf[i]);
+			extra_len += sprintf(extra + extra_len, " 0x%x ", pMptCtx->mptOutBuf[i]);
 	}
 
 exit:
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723bs/core/rtw_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8723bs/core/rtw_mp.c
index a16da9b60103d2..39384d584f3873 100644
--- a/drivers/net/wireless/rockchip_wlan/rtl8723bs/core/rtw_mp.c
+++ b/drivers/net/wireless/rockchip_wlan/rtl8723bs/core/rtw_mp.c
@@ -2093,14 +2093,17 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data)
 
 	data[0] = '\0';
 
-	i = psd_start;
-	while (i < psd_stop) {
-		if (i >= psd_pts)
-			psd_data = rtw_GetPSDData(pAdapter, i - psd_pts);
-		else
-			psd_data = rtw_GetPSDData(pAdapter, i);
-		sprintf(data, "%s%x ", data, psd_data);
-		i++;
+	{
+		size_t extra_len = strlen(data);
+		i = psd_start;
+		while (i < psd_stop) {
+			if (i >= psd_pts)
+				psd_data = rtw_GetPSDData(pAdapter, i - psd_pts);
+			else
+				psd_data = rtw_GetPSDData(pAdapter, i);
+			extra_len += sprintf(data + extra_len, "%x ", psd_data);
+			i++;
+		}
 	}
 
 #ifdef CONFIG_LONG_DELAY_ISSUE
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723bs/os_dep/linux/ioctl_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8723bs/os_dep/linux/ioctl_mp.c
index ad2bb026739ad7..4f098330fcdef1 100644
--- a/drivers/net/wireless/rockchip_wlan/rtl8723bs/os_dep/linux/ioctl_mp.c
+++ b/drivers/net/wireless/rockchip_wlan/rtl8723bs/os_dep/linux/ioctl_mp.c
@@ -1719,7 +1719,7 @@ int rtw_mp_tx(struct net_device *dev,
 			char *pextra = extra;
 			RTW_INFO("Got format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode);
 			_rtw_memset(extra, 0, wrqu->data.length);
-			sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
+			extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
 			padapter->mppriv.channel = channel;
 			SetChannel(padapter);
 			pHalData->current_channel = channel;
@@ -1842,6 +1842,7 @@ int rtw_mp_rx(struct net_device *dev,
 	      struct iw_request_info *info,
 	      union iwreq_data *wrqu, char *extra)
 {
+	size_t extra_len;
 	PADAPTER padapter = rtw_netdev_priv(dev);
 	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(padapter);
 	struct mp_priv *pmp_priv = &padapter->mppriv;
@@ -1886,7 +1887,7 @@ int rtw_mp_rx(struct net_device *dev,
 		bStartRx = 1;
 		RTW_INFO("Got format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant);
 		_rtw_memset(extra, 0, wrqu->data.length);
-		sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
+		extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
 		padapter->mppriv.channel = channel;
 		SetChannel(padapter);
 		pHalData->current_channel = channel;
@@ -2049,6 +2050,7 @@ int rtw_efuse_mask_file(struct net_device *dev,
 	char *rtw_efuse_mask_file_path;
 	u8 Status;
 	PADAPTER padapter = rtw_netdev_priv(dev);
+	size_t extra_len;
 
 	_rtw_memset(maskfileBuffer, 0x00, sizeof(maskfileBuffer));
 
@@ -2100,11 +2102,11 @@ int rtw_efuse_mask_file(struct net_device *dev,
 		 } while (count < 64);
 
 		for (i = 0; i < count; i++)
-			sprintf(extra, "%s:%02x", extra, maskfileBuffer[i]);
+			extra_len += sprintf(extra + extra_len, ":%02x", maskfileBuffer[i]);
 
 		padapter->registrypriv.bFileMaskEfuse = _TRUE;
 
-		sprintf(extra, "%s\nLoad Efuse Mask data %d hex ok\n", extra, count);
+		extra_len += sprintf(extra + extra_len, "\nLoad Efuse Mask data %d hex ok\n", count);
 		wrqu->data.length = strlen(extra);
 		return 0;
 	}
@@ -2522,16 +2524,17 @@ int rtw_mp_SetBT(struct net_device *dev,
 	mptbt_BtControlProcess(padapter, &BtReq);
 
 	if (readtherm == 0) {
-		sprintf(extra, "BT thermal=");
+		size_t extra_len = sprintf(extra, "BT thermal=");
 		for (i = 4; i < pMptCtx->mptOutLen; i++) {
 			if ((pMptCtx->mptOutBuf[i] == 0x00) && (pMptCtx->mptOutBuf[i + 1] == 0x00))
 				goto exit;
 
-			sprintf(extra, "%s %d ", extra, (pMptCtx->mptOutBuf[i] & 0x1f));
+			extra_len += sprintf(extra + extra_len, " %d ", (pMptCtx->mptOutBuf[i] & 0x1f));
 		}
 	} else {
+		size_t extra_len = strlen(extra);
 		for (i = 4; i < pMptCtx->mptOutLen; i++)
-			sprintf(extra, "%s 0x%x ", extra, pMptCtx->mptOutBuf[i]);
+			extra_len += sprintf(extra + extra_len, " 0x%x ", pMptCtx->mptOutBuf[i]);
 	}
 
 exit:
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723bu/core/rtw_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8723bu/core/rtw_mp.c
index 970ad98bb5f7a4..357c15ddb446b1 100755
--- a/drivers/net/wireless/rockchip_wlan/rtl8723bu/core/rtw_mp.c
+++ b/drivers/net/wireless/rockchip_wlan/rtl8723bu/core/rtw_mp.c
@@ -1909,7 +1909,7 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data)
 {
 	u32 i, psd_pts=0, psd_start=0, psd_stop=0;
 	u32 psd_data=0;
-
+	size_t data_len = 0;
 
 #ifdef PLATFORM_LINUX
 	if (!netif_running(pAdapter->pnetdev)) {
@@ -1941,7 +1941,7 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data)
 		} else {
 			psd_data = rtw_GetPSDData(pAdapter, i);
 		}
-		sprintf(data, "%s%x ", data, psd_data);
+		data_len += sprintf(data + data_len, "%x ", psd_data);
 		i++;
 	}
 
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723bu/os_dep/linux/ioctl_linux.c b/drivers/net/wireless/rockchip_wlan/rtl8723bu/os_dep/linux/ioctl_linux.c
index 22bb5c2439b89d..785cf61bfe18e3 100755
--- a/drivers/net/wireless/rockchip_wlan/rtl8723bu/os_dep/linux/ioctl_linux.c
+++ b/drivers/net/wireless/rockchip_wlan/rtl8723bu/os_dep/linux/ioctl_linux.c
@@ -9776,6 +9776,7 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 	u16 i=0, j=0, mapLen=0, addr=0, cnts=0;
 	u16 max_available_len = 0, raw_cursize = 0, raw_maxsize = 0;
 	int err;
+	size_t extra_len;
 	#ifdef CONFIG_IOL
 	u8 org_fw_iol = padapter->registrypriv.fw_iol;// 0:Disable, 1:enable, 2:by usb speed
 	#endif
@@ -9839,23 +9840,23 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 	{
 		mapLen = EFUSE_MAP_SIZE;
 		
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < EFUSE_MAP_SIZE; i += 16)
 		{
 //			DBG_871X("0x%02x\t", i);
-			sprintf(extra, "%s0x%02x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%02x\t", i);
 			for (j=0; j<8; j++) {
 //				DBG_871X("%02X ", data[i+j]);
-				sprintf(extra, "%s%02X ", extra, PROMContent[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", PROMContent[i+j]);
 			}
 //			DBG_871X("\t");
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j<16; j++) {
 //				DBG_871X("%02X ", data[i+j]);
-				sprintf(extra, "%s%02X ", extra, PROMContent[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", PROMContent[i+j]);
 			}
 //			DBG_871X("\n");
-			sprintf(extra,"%s\n",extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 //		DBG_871X("\n");
 	}
@@ -9870,23 +9871,23 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		}
 
 //		DBG_871X("OFFSET\tVALUE(hex)\n");
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < EFUSE_MAP_SIZE; i += 16)
 		{
 //			DBG_871X("0x%02x\t", i);
-			sprintf(extra, "%s0x%02x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%02x\t", i);
 			for (j=0; j<8; j++) {
 //				DBG_871X("%02X ", data[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeEfuseInitMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeEfuseInitMap[i+j]);
 			}
 //			DBG_871X("\t");
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j<16; j++) {
 //				DBG_871X("%02X ", data[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeEfuseInitMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeEfuseInitMap[i+j]);
 			}
 //			DBG_871X("\n");
-			sprintf(extra,"%s\n",extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 //		DBG_871X("\n");
 	}
@@ -9929,9 +9930,10 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 //		DBG_871X("%s: data={", __FUNCTION__);
 		*extra = 0;
+		extra_len = 0;
 		for (i=0; i<cnts; i++) {
 //			DBG_871X("0x%02x ", data[i]);
-			sprintf(extra, "%s0x%02X ", extra, data[i]);
+			extra_len += sprintf(extra + extra_len, "0x%02X ", data[i]);
 		}
 //		DBG_871X("}\n");
 	}
@@ -9952,17 +9954,16 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 		_rtw_memset(extra,'\0',strlen(extra));
 
-		sprintf(extra, "\n0x00\t");
+		extra_len = sprintf(extra, "\n0x00\t");
 
 		for (i = 0; i < mapLen ; i++) {
-			sprintf(extra, "%s%02X", extra, rawdata[i]);
+			extra_len += sprintf(extra + extra_len, "%02X", rawdata[i]);
 			if ((i & 0xF) == 0xF) {
-				sprintf(extra, "%s\n", extra);
-				sprintf(extra, "%s0x%02x\t", extra, i+1);
+				extra_len += sprintf(extra + extra_len, "\n0x%02x\t", i+1);
 			} else if ((i & 0x7) == 0x7) {
-				sprintf(extra, "%s \t", extra);
+				extra_len += sprintf(extra + extra_len, " \t");
 			} else {
-				sprintf(extra, "%s ", extra);
+				extra_len += sprintf(extra + extra_len, " ");
 			}
 		}
 
@@ -9978,22 +9979,21 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		}
 		_rtw_memset(extra,'\0',strlen(extra));
 		//		DBG_871X("%s: realraw={\n", __FUNCTION__);
-				sprintf(extra, "\n0x00\t");
+				extra_len = sprintf(extra, "\n0x00\t");
 				for (i= 512; i< mapLen; i++)
 				{
 		//			DBG_871X("%02X", rawdata[i]);
-					sprintf(extra, "%s%02X", extra, rawdata[i]);
+					extra_len += sprintf(extra + extra_len, "%02X", rawdata[i]);
 					if ((i & 0xF) == 0xF) {
 		//				DBG_871X("\n");
-						sprintf(extra, "%s\n", extra);
-						sprintf(extra, "%s0x%02x\t", extra, i+1);
+						extra_len += sprintf(extra + extra_len, "\n0x%02x\t", i+1);
 					}
 					else if ((i & 0x7) == 0x7){
 		//				DBG_871X("\t");
-						sprintf(extra, "%s \t", extra);
+						extra_len += sprintf(extra + extra_len, " \t");
 					} else {
 		//				DBG_871X(" ");
-						sprintf(extra, "%s ", extra);
+						extra_len += sprintf(extra + extra_len, " ");
 					}
 				}
 		//		DBG_871X("}\n");
@@ -10024,14 +10024,15 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 //		DBG_871X("%s: MAC address={", __FUNCTION__);
 		*extra = 0;
+		extra_len = 0;
 		for (i=0; i<cnts; i++)
 		{
 //			DBG_871X("%02X", data[i]);
-			sprintf(extra, "%s%02X", extra, data[i]);
+			extra_len += sprintf(extra + extra_len, "%02X", data[i]);
 			if (i != (cnts-1))
 			{
 //				DBG_871X(":");
-				sprintf(extra,"%s:",extra);
+				extra_len += sprintf(extra + extra_len, ":");
 			}
 		}
 //		DBG_871X("}\n");
@@ -10086,14 +10087,15 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 //		DBG_871X("%s: {VID,PID}={", __FUNCTION__);
 		*extra = 0;
+		extra_len = 0;
 		for (i=0; i<cnts; i++)
 		{
 //			DBG_871X("0x%02x", data[i]);
-			sprintf(extra, "%s0x%02X", extra, data[i]);
+			extra_len += sprintf(extra + extra_len, "0x%02X", data[i]);
 			if (i != (cnts-1))
 			{
 //				DBG_871X(",");
-				sprintf(extra,"%s,",extra);
+				extra_len += sprintf(extra + extra_len, ",");
 			}
 		}
 //		DBG_871X("}\n");
@@ -10118,23 +10120,23 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		}
 
 //		DBG_871X("OFFSET\tVALUE(hex)\n");
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i=0; i<512; i+=16) // set 512 because the iwpriv's extra size have limit 0x7FF
 		{
 //			DBG_871X("0x%03x\t", i);
-			sprintf(extra, "%s0x%03x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%03x\t", i);
 			for (j=0; j<8; j++) {
 //				DBG_871X("%02X ", pEfuseHal->BTEfuseInitMap[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]);
 			}
 //			DBG_871X("\t");
-			sprintf(extra,"%s\t",extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j<16; j++) {
 //				DBG_871X("%02X ", pEfuseHal->BTEfuseInitMap[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]);
 			}
 //			DBG_871X("\n");
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 //		DBG_871X("\n");
 	}
@@ -10151,24 +10153,24 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		}
 
 //		DBG_871X("OFFSET\tVALUE(hex)\n");
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i=512; i<1024 ; i+=16)
 		{
 //			DBG_871X("0x%03x\t", i);
-			sprintf(extra, "%s0x%03x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%03x\t", i);
 			for (j=0; j<8; j++)
 			{
 //				DBG_871X("%02X ", data[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]);
 			}
 //			DBG_871X("\t");
-			sprintf(extra,"%s\t",extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j<16; j++) {
 //				DBG_871X("%02X ", data[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]);
 			}
 //			DBG_871X("\n");
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 //		DBG_871X("\n");
 	}
@@ -10210,11 +10212,12 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		}
 
 		*extra = 0;
+		extra_len = 0;
 //		DBG_871X("%s: bt efuse data={", __FUNCTION__);
 		for (i=0; i<cnts; i++)
 		{
 //			DBG_871X("0x%02x ", data[i]);
-			sprintf(extra, "%s 0x%02X ", extra, data[i]);
+			extra_len += sprintf(extra + extra_len, " 0x%02X ", data[i]);
 		}
 //		DBG_871X("}\n");
 		DBG_871X(FUNC_ADPT_FMT ": BT MAC=[%s]\n", FUNC_ADPT_ARG(padapter), extra);
@@ -10222,69 +10225,69 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 	else if (strcmp(tmp[0], "btffake") == 0)
 	{
 //		DBG_871X("OFFSET\tVALUE(hex)\n");
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i=0; i<512; i+=16)
 		{
 //			DBG_871X("0x%03x\t", i);
-			sprintf(extra, "%s0x%03x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%03x\t", i);
 			for (j=0; j<8; j++) {
 //				DBG_871X("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
 			}
 //			DBG_871X("\t");
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j<16; j++) {
 //				DBG_871X("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
 			}
 //			DBG_871X("\n");
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 //		DBG_871X("\n");
 	}
 	else if (strcmp(tmp[0],"btbfake") == 0)
 	{
 //		DBG_871X("OFFSET\tVALUE(hex)\n");
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i=512; i<1024; i+=16)
 		{
 //			DBG_871X("0x%03x\t", i);
-			sprintf(extra, "%s0x%03x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%03x\t", i);
 			for (j=0; j<8; j++) {
 //				DBG_871X("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
 			}
 //			DBG_871X("\t");
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j<16; j++) {
 //				DBG_871X("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
 			}
 //			DBG_871X("\n");
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 //		DBG_871X("\n");
 	}
 	else if (strcmp(tmp[0],"wlrfkmap")== 0)
 	{
 //		DBG_871X("OFFSET\tVALUE(hex)\n");
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i=0; i<EFUSE_MAP_SIZE; i+=16)
 		{
 //			DBG_871X("\t0x%02x\t", i);
-			sprintf(extra, "%s0x%02x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%02x\t", i);
 			for (j=0; j<8; j++) {
 //				DBG_871X("%02X ", pEfuseHal->fakeEfuseModifiedMap[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeEfuseModifiedMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeEfuseModifiedMap[i+j]);
 			}
 //			DBG_871X("\t");
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j<16; j++) {
 //				DBG_871X("%02X ", pEfuseHal->fakeEfuseModifiedMap[i+j]);
-				sprintf(extra, "%s %02X", extra, pEfuseHal->fakeEfuseModifiedMap[i+j]);
+				extra_len += sprintf(extra + extra_len, " %02X", pEfuseHal->fakeEfuseModifiedMap[i+j]);
 			}
 //			DBG_871X("\n");
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 //		DBG_871X("\n");
 
@@ -10312,9 +10315,10 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		
 		//		DBG_871X("%s: data={", __FUNCTION__);
 			*extra = 0;
+			extra_len = 0;
 			for (i=0; i<cnts; i++) {
 					DBG_871X("wlrfkrmap = 0x%02x \n", pEfuseHal->fakeEfuseModifiedMap[addr+i]);
-					sprintf(extra, "%s0x%02X ", extra, pEfuseHal->fakeEfuseModifiedMap[addr+i]);
+					extra_len += sprintf(extra + extra_len, "0x%02X ", pEfuseHal->fakeEfuseModifiedMap[addr+i]);
 			}
 	}
 	else if (strcmp(tmp[0],"btrfkrmap")== 0)
@@ -10340,9 +10344,10 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		
 		//		DBG_871X("%s: data={", __FUNCTION__);
 			*extra = 0;
+			extra_len = 0;
 			for (i=0; i<cnts; i++) {
 					DBG_871X("wlrfkrmap = 0x%02x \n", pEfuseHal->fakeBTEfuseModifiedMap[addr+i]);
-					sprintf(extra, "%s0x%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[addr+i]);
+					extra_len += sprintf(extra + extra_len, "0x%02X ", pEfuseHal->fakeBTEfuseModifiedMap[addr+i]);
 			}
 	}
 	else
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723bu/os_dep/linux/ioctl_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8723bu/os_dep/linux/ioctl_mp.c
index 96f1e4ee1c9e50..13f7f39add77b8 100644
--- a/drivers/net/wireless/rockchip_wlan/rtl8723bu/os_dep/linux/ioctl_mp.c
+++ b/drivers/net/wireless/rockchip_wlan/rtl8723bu/os_dep/linux/ioctl_mp.c
@@ -198,7 +198,7 @@ int rtw_mp_read_reg(struct net_device *dev,
 				if (*pnext != '\0') {
 					/*strtout = simple_strtoul(pnext , &ptmp, 16);*/
 					ret = sscanf(pnext, "%x", &strtout);
-					sprintf(extra, "%s %d" , extra , strtout);
+					sprintf(extra + strlen(extra), " %d", strtout);
 				} else
 					break;
 				pch = pnext;
@@ -230,7 +230,7 @@ int rtw_mp_read_reg(struct net_device *dev,
 				pnext++;
 				if (*pnext != '\0') {
 					ret = sscanf(pnext, "%x", &strtout);
-					sprintf(extra, "%s %d" , extra , strtout);
+					sprintf(extra + strlen(extra), " %d", strtout);
 				} else
 					break;
 				pch = pnext;
@@ -341,20 +341,23 @@ int rtw_mp_read_rf(struct net_device *dev,
 	pch = tmp;
 	DBG_871X("pch=%s", pch);
 
-	while (*pch != '\0') {
-		pnext = strpbrk(pch, " ");
-		if (!pnext)
-			break;
-		pnext++;
-		if (*pnext != '\0') {
-			/*strtou =simple_strtoul(pnext , &ptmp, 16);*/
-			ret = sscanf(pnext, "%x", &strtou);
-			sprintf(extra, "%s %d" , extra , strtou);
-		} else
-			break;
-		pch = pnext;
+	{
+		size_t extra_len = strlen(extra);
+		while (*pch != '\0') {
+			pnext = strpbrk(pch, " ");
+			if (!pnext)
+				break;
+			pnext++;
+			if (*pnext != '\0') {
+				/*strtou =simple_strtoul(pnext , &ptmp, 16);*/
+				ret = sscanf(pnext, "%x", &strtou);
+				extra_len += sprintf(extra + extra_len, " %d", strtou);
+			} else
+				break;
+			pch = pnext;
+		}
+		wrqu->length = extra_len;
 	}
-	wrqu->length = strlen(extra);
 
 	return 0;
 }
@@ -1384,7 +1387,7 @@ int rtw_mp_pretx_proc(PADAPTER padapter, u8 bStartTest, char *extra)
 							pmp_priv->mode = MP_ON;
 							sprintf(extra, "Stop continuous Tx");
 						} else if (pmp_priv->tx.stop == 1) {
-							sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500 count=%u\n", extra, pmp_priv->tx.count);
+							sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500 count=%u\n", pmp_priv->tx.count);
 							pmp_priv->tx.stop = 0;
 							SetPacketTx(padapter);
 						} else {
@@ -1393,26 +1396,26 @@ int rtw_mp_pretx_proc(PADAPTER padapter, u8 bStartTest, char *extra)
 						return 0;
 		case MP_SINGLE_TONE_TX:
 						if (bStartTest != 0)
-							sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra);
+							sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.");
 						SetSingleToneTx(padapter, (u8)bStartTest);
 						break;
 		case MP_CONTINUOUS_TX:
 						if (bStartTest != 0)
-							sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra);
+							sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.");
 						SetContinuousTx(padapter, (u8)bStartTest);
 						break;
 		case MP_CARRIER_SUPPRISSION_TX:
 						if (bStartTest != 0) {
 							if (HwRateToMPTRate(pmp_priv->rateidx) <= MPT_RATE_11M)
-								sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra);
+								sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.");
 							else
-								sprintf(extra, "%s\nSpecify carrier suppression but not CCK rate", extra);
+								sprintf(extra + strlen(extra), "\nSpecify carrier suppression but not CCK rate");
 						}
 						SetCarrierSuppressionTx(padapter, (u8)bStartTest);
 						break;
 		case MP_SINGLE_CARRIER_TX:
 					if (bStartTest != 0)
-							sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra);
+							sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.");
 						SetSingleCarrierTx(padapter, (u8)bStartTest);
 						break;
 
@@ -1464,6 +1467,7 @@ int rtw_mp_tx(struct net_device *dev,
 		u32 bandwidth = 0, sg = 0, channel = 6, txpower = 40, rate = 108, ant = 0, txmode = 1, count = 0;
 		u8 i = 0, j = 0, bStartTest = 1, status = 0, Idx = 0, tmpU1B = 0;
 		u16 antenna = 0;
+		size_t extra_len;
 
 		if (copy_from_user(extra, wrqu->data.pointer, wrqu->data.length))
 			return -EFAULT;
@@ -1490,14 +1494,14 @@ int rtw_mp_tx(struct net_device *dev,
 				return 0;
 		} else if (strncmp(extra, "setting", 7) == 0) {
 				_rtw_memset(extra, 0, wrqu->data.length);
-				sprintf(extra, "Current Setting :\n Channel:%d", pmp_priv->channel);
-				sprintf(extra, "%s\n Bandwidth:%d", extra, pmp_priv->bandwidth);
-				sprintf(extra, "%s\n Rate index:%d", extra, pmp_priv->rateidx);
-				sprintf(extra, "%s\n TxPower index:%d", extra, pmp_priv->txpoweridx);
-				sprintf(extra, "%s\n Antenna TxPath:%d", extra, pmp_priv->antenna_tx);
-				sprintf(extra, "%s\n Antenna RxPath:%d", extra, pmp_priv->antenna_rx);
-				sprintf(extra, "%s\n MP Mode:%d", extra, pmp_priv->mode);
-				wrqu->data.length = strlen(extra);
+				extra_len = sprintf(extra, "Current Setting :\n Channel:%d", pmp_priv->channel);
+				extra_len += sprintf(extra + extra_len, "\n Bandwidth:%d", pmp_priv->bandwidth);
+				extra_len += sprintf(extra + extra_len, "\n Rate index:%d", pmp_priv->rateidx);
+				extra_len += sprintf(extra + extra_len, "\n TxPower index:%d", pmp_priv->txpoweridx);
+				extra_len += sprintf(extra + extra_len, "\n Antenna TxPath:%d", pmp_priv->antenna_tx);
+				extra_len += sprintf(extra + extra_len, "\n Antenna RxPath:%d", pmp_priv->antenna_rx);
+				extra_len += sprintf(extra + extra_len, "\n MP Mode:%d", pmp_priv->mode);
+				wrqu->data.length = extra_len;
 				return 0;
 #ifdef CONFIG_MP_VHT_HW_TX_MODE
 		} else if (strncmp(extra, "pmact", 5) == 0) {
@@ -1634,25 +1638,25 @@ int rtw_mp_tx(struct net_device *dev,
 			if (sscanf(extra, "ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d", &channel, &bandwidth, &rate, &txpower, &ant, &txmode) < 6) {
 					DBG_871X("Invalid format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode);
 					_rtw_memset(extra, 0, wrqu->data.length);
-					sprintf(extra, "\n Please input correct format as bleow:\n");
-					sprintf(extra, "%s\t ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d\n", extra, channel, bandwidth, rate, txpower, ant, txmode);
-					sprintf(extra, "%s\n [ ch : BGN = <1~14> , A or AC = <36~165> ]", extra);
-					sprintf(extra, "%s\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]", extra);
-					sprintf(extra, "%s\n [ rate :	CCK: 1 2 5.5 11M X 2 = < 2 4 11 22 >]", extra);
-					sprintf(extra, "%s\n [		OFDM: 6 9 12 18 24 36 48 54M X 2 = < 12 18 24 36 48 72 96 108>", extra);
-					sprintf(extra, "%s\n [		HT 1S2SS MCS0 ~ MCS15 : < [MCS0]=128 ~ [MCS7]=135 ~ [MCS15]=143 >", extra);
-					sprintf(extra, "%s\n [		HT 3SS MCS16 ~ MCS32 : < [MCS16]=144 ~ [MCS23]=151 ~ [MCS32]=159 >", extra);
-					sprintf(extra, "%s\n [		VHT 1SS MCS0 ~ MCS9 : < [MCS0]=160 ~ [MCS9]=169 >", extra);
-					sprintf(extra, "%s\n [ txpower : 1~63 power index", extra);
-					sprintf(extra, "%s\n [ ant : <A = 1, B = 2, C = 4, D = 8> ,2T ex: AB=3 BC=6 CD=12", extra);
-					sprintf(extra, "%s\n [ txmode : < 0 = CONTINUOUS_TX, 1 = PACKET_TX, 2 = SINGLE_TONE_TX, 3 = CARRIER_SUPPRISSION_TX, 4 = SINGLE_CARRIER_TX>\n", extra);
-					wrqu->data.length = strlen(extra);
+					extra_len = sprintf(extra, "\n Please input correct format as bleow:\n");
+					extra_len += sprintf(extra + extra_len, "\t ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d\n", channel, bandwidth, rate, txpower, ant, txmode);
+					extra_len += sprintf(extra + extra_len, "\n [ ch : BGN = <1~14> , A or AC = <36~165> ]");
+					extra_len += sprintf(extra + extra_len, "\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]");
+					extra_len += sprintf(extra + extra_len, "\n [ rate :	CCK: 1 2 5.5 11M X 2 = < 2 4 11 22 >]");
+					extra_len += sprintf(extra + extra_len, "\n [		OFDM: 6 9 12 18 24 36 48 54M X 2 = < 12 18 24 36 48 72 96 108>");
+					extra_len += sprintf(extra + extra_len, "\n [		HT 1S2SS MCS0 ~ MCS15 : < [MCS0]=128 ~ [MCS7]=135 ~ [MCS15]=143 >");
+					extra_len += sprintf(extra + extra_len, "\n [		HT 3SS MCS16 ~ MCS32 : < [MCS16]=144 ~ [MCS23]=151 ~ [MCS32]=159 >");
+					extra_len += sprintf(extra + extra_len, "\n [		VHT 1SS MCS0 ~ MCS9 : < [MCS0]=160 ~ [MCS9]=169 >");
+					extra_len += sprintf(extra + extra_len, "\n [ txpower : 1~63 power index");
+					extra_len += sprintf(extra + extra_len, "\n [ ant : <A = 1, B = 2, C = 4, D = 8> ,2T ex: AB=3 BC=6 CD=12");
+					extra_len += sprintf(extra + extra_len, "\n [ txmode : < 0 = CONTINUOUS_TX, 1 = PACKET_TX, 2 = SINGLE_TONE_TX, 3 = CARRIER_SUPPRISSION_TX, 4 = SINGLE_CARRIER_TX>\n");
+					wrqu->data.length = extra_len;
 					return status;
 
 			} else {
 				DBG_871X("Got format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode);
 				_rtw_memset(extra, 0, wrqu->data.length);
-				sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
+				extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
 				padapter->mppriv.channel = channel;
 				SetChannel(padapter);
 				pHalData->CurrentChannel = channel;
@@ -1661,13 +1665,14 @@ int rtw_mp_tx(struct net_device *dev,
 					bandwidth = CHANNEL_WIDTH_40;
 				else if (bandwidth == 2)
 					bandwidth = CHANNEL_WIDTH_80;
-				sprintf(extra, "%s\nChange Current Bandwidth %d to Bandwidth %d", extra, padapter->mppriv.bandwidth , bandwidth);
+				extra_len = strlen(extra);
+				extra_len += sprintf(extra + extra_len, "\nChange Current Bandwidth %d to Bandwidth %d", padapter->mppriv.bandwidth , bandwidth);
 				padapter->mppriv.bandwidth = (u8)bandwidth;
 				padapter->mppriv.preamble = sg;
 				SetBandwidth(padapter);
 				pHalData->CurrentChannelBW = bandwidth;
 
-				sprintf(extra, "%s\nSet power level :%d", extra, txpower);
+				extra_len += sprintf(extra + extra_len, "\nSet power level :%d", txpower);
 				padapter->mppriv.txpoweridx = (u8)txpower;
 				pMptCtx->TxPwrLevel[ODM_RF_PATH_A] = (u8)txpower;
 				pMptCtx->TxPwrLevel[ODM_RF_PATH_B] = (u8)txpower;
@@ -1690,13 +1695,13 @@ int rtw_mp_tx(struct net_device *dev,
 				DBG_871X("%s: rate index=%d\n", __func__, rate);
 				if (rate >= MPT_RATE_LAST)
 					return -EINVAL;
-				sprintf(extra, "%s\nSet data rate to %d index %d", extra, padapter->mppriv.rateidx, rate);
+				extra_len += sprintf(extra + extra_len, "\nSet data rate to %d index %d", padapter->mppriv.rateidx, rate);
 
 				padapter->mppriv.rateidx = rate;
 				pMptCtx->MptRateIndex = rate;
 				SetDataRate(padapter);
 
-				sprintf(extra, "%s\nSet Antenna Path :%d",  extra, ant);
+				extra_len += sprintf(extra + extra_len, "\nSet Antenna Path :%d", ant);
 				switch (ant) {
 				case 1:
 					antenna = ANTENNA_A;
@@ -1782,6 +1787,7 @@ int rtw_mp_rx(struct net_device *dev,
 	u32 bandwidth = 0, sg = 0, channel = 6, ant = 0;
 	u16 antenna = 0;
 	u8 bStartRx = 0;
+	size_t extra_len;
 
 	if (copy_from_user(extra, wrqu->data.pointer, wrqu->data.length))
 			return -EFAULT;
@@ -1805,19 +1811,19 @@ int rtw_mp_rx(struct net_device *dev,
 	} else if (sscanf(extra, "ch=%d,bw=%d,ant=%d", &channel, &bandwidth, &ant) < 3) {
 		DBG_871X("Invalid format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant);
 		_rtw_memset(extra, 0, wrqu->data.length);
-		sprintf(extra, "\n Please input correct format as bleow:\n");
-		sprintf(extra, "%s\t ch=%d,bw=%d,ant=%d\n", extra, channel, bandwidth, ant);
-		sprintf(extra, "%s\n [ ch : BGN = <1~14> , A or AC = <36~165> ]", extra);
-		sprintf(extra, "%s\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]", extra);
-		sprintf(extra, "%s\n [ ant : <A = 1, B = 2, C = 4, D = 8> ,2T ex: AB=3 BC=6 CD=12", extra);
-		wrqu->data.length = strlen(extra);
+		extra_len = sprintf(extra, "\n Please input correct format as bleow:\n");
+		extra_len += sprintf(extra + extra_len, "\t ch=%d,bw=%d,ant=%d\n", channel, bandwidth, ant);
+		extra_len += sprintf(extra + extra_len, "\n [ ch : BGN = <1~14> , A or AC = <36~165> ]");
+		extra_len += sprintf(extra + extra_len, "\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]");
+		extra_len += sprintf(extra + extra_len, "\n [ ant : <A = 1, B = 2, C = 4, D = 8> ,2T ex: AB=3 BC=6 CD=12");
+		wrqu->data.length = extra_len;
 		return 0;
 
 	} else {
 		bStartRx = 1;
 		DBG_871X("Got format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant);
 		_rtw_memset(extra, 0, wrqu->data.length);
-		sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
+		extra_len += sprintf(extra + extra_len, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
 		padapter->mppriv.channel = channel;
 		SetChannel(padapter);
 		pHalData->CurrentChannel = channel;
@@ -1826,13 +1832,13 @@ int rtw_mp_rx(struct net_device *dev,
 			bandwidth = CHANNEL_WIDTH_40;
 		else if (bandwidth == 2)
 			bandwidth = CHANNEL_WIDTH_80;
-		sprintf(extra, "%s\nChange Current Bandwidth %d to Bandwidth %d", extra, padapter->mppriv.bandwidth , bandwidth);
+		extra_len += sprintf(extra + extra_len, "\nChange Current Bandwidth %d to Bandwidth %d", padapter->mppriv.bandwidth , bandwidth);
 		padapter->mppriv.bandwidth = (u8)bandwidth;
 		padapter->mppriv.preamble = sg;
 		SetBandwidth(padapter);
 		pHalData->CurrentChannelBW = bandwidth;
 
-		sprintf(extra, "%s\nSet Antenna Path :%d",  extra, ant);
+		extra_len += sprintf(extra + extra_len, "\nSet Antenna Path :%d", ant);
 		switch (ant) {
 		case 1:
 			antenna = ANTENNA_A;
@@ -1883,10 +1889,10 @@ int rtw_mp_rx(struct net_device *dev,
 		pHalData->AntennaTxPath = antenna;
 		SetAntenna(padapter);
 
-		sprintf(extra, "%s\nstart Rx", extra);
+		extra_len += sprintf(extra + extra_len, "\nstart Rx");
 		SetPacketRx(padapter, bStartRx, _FALSE);
 	}
-	wrqu->data.length = strlen(extra);
+	wrqu->data.length = extra_len;
 	return 0;
 }
 
@@ -2014,6 +2020,7 @@ int rtw_mp_SetBT(struct net_device *dev,
 	int testmode = 1, ready = 1, trxparam = 1, setgen = 1, getgen = 1, testctrl = 1, testbt = 1, readtherm = 1, setbtmac = 1;
 	u32 i = 0, ii = 0, jj = 0, kk = 0, cnts = 0, status = 0;
 	PRT_MP_FIRMWARE pBTFirmware = NULL;
+	size_t extra_len;
 
 	if (copy_from_user(extra, wrqu->data.pointer, wrqu->data.length))
 		return -EFAULT;
@@ -2310,17 +2317,18 @@ int rtw_mp_SetBT(struct net_device *dev,
 
 	mptbt_BtControlProcess(padapter, &BtReq);
 
+	extra_len = strlen(extra);
 	if (readtherm == 0) {
 		sprintf(extra, "BT thermal=");
 		for (i = 4; i < pMptCtx->mptOutLen; i++) {
 			if ((pMptCtx->mptOutBuf[i] == 0x00) && (pMptCtx->mptOutBuf[i + 1] == 0x00))
 				goto exit;
 
-			sprintf(extra, "%s %d ", extra, (pMptCtx->mptOutBuf[i] & 0x1f));
+			extra_len += sprintf(extra + extra_len, " %d ", (pMptCtx->mptOutBuf[i] & 0x1f));
 		}
 	} else {
 		for (i = 4; i < pMptCtx->mptOutLen; i++)
-			sprintf(extra, "%s 0x%x ", extra, pMptCtx->mptOutBuf[i]);
+			extra_len += sprintf(extra + extra_len, " 0x%x ", pMptCtx->mptOutBuf[i]);
 	}
 
 exit:
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723cs/core/rtw_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8723cs/core/rtw_mp.c
index 87ced9ab018035..a08b26f0f87f41 100644
--- a/drivers/net/wireless/rockchip_wlan/rtl8723cs/core/rtw_mp.c
+++ b/drivers/net/wireless/rockchip_wlan/rtl8723cs/core/rtw_mp.c
@@ -2119,14 +2119,17 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data)
 
 	data[0] = '\0';
 
-	i = psd_start;
-	while (i < psd_stop) {
-		if (i >= psd_pts)
-			psd_data = rtw_GetPSDData(pAdapter, i - psd_pts);
-		else
-			psd_data = rtw_GetPSDData(pAdapter, i);
-		sprintf(data, "%s%x ", data, psd_data);
-		i++;
+	{
+		size_t extra_len = strlen(data);
+		i = psd_start;
+		while (i < psd_stop) {
+			if (i >= psd_pts)
+				psd_data = rtw_GetPSDData(pAdapter, i - psd_pts);
+			else
+				psd_data = rtw_GetPSDData(pAdapter, i);
+			extra_len += sprintf(data + extra_len, "%x ", psd_data);
+			i++;
+		}
 	}
 
 #ifdef CONFIG_LONG_DELAY_ISSUE
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723cs/os_dep/linux/ioctl_linux.c b/drivers/net/wireless/rockchip_wlan/rtl8723cs/os_dep/linux/ioctl_linux.c
index 268dee6f511324..0120a3aa52ad87 100644
--- a/drivers/net/wireless/rockchip_wlan/rtl8723cs/os_dep/linux/ioctl_linux.c
+++ b/drivers/net/wireless/rockchip_wlan/rtl8723cs/os_dep/linux/ioctl_linux.c
@@ -9034,6 +9034,7 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 #ifdef CONFIG_IOL
 	u8 org_fw_iol = padapter->registrypriv.fw_iol;/* 0:Disable, 1:enable, 2:by usb speed */
 #endif
+	size_t extra_len;
 
 	wrqu = (struct iw_point *)wdata;
 	pwrctrlpriv = adapter_to_pwrctl(padapter);
@@ -9105,18 +9106,18 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		} else
 			drvmaporder = 0;
 
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < cnt; i += 16) {
-			sprintf(extra, "%s0x%02x\t", extra, shift + i);
+			extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i);
 			for (j = 0; j < 8; j++)
-				sprintf(extra, "%s%02X ", extra, efuse[i + j]);
-			sprintf(extra, "%s\t", extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j < 16; j++)
-				sprintf(extra, "%s%02X ", extra, efuse[i + j]);
-			sprintf(extra, "%s\n", extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 		if ((shift + cnt) < mapLen)
-			sprintf(extra, "%s\t...more (left:%d/%d)\n", extra, mapLen-(shift + cnt), mapLen);
+			extra_len += sprintf(extra + extra_len, "\t...more (left:%d/%d)\n", mapLen-(shift + cnt), mapLen);
 
 	} else if (strcmp(tmp[0], "realmap") == 0) {
 		static u8 order = 0;
@@ -9155,18 +9156,18 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		} else
 			order = 0;
 
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < cnt; i += 16) {
-			sprintf(extra, "%s0x%02x\t", extra, shift + i);
+			extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i);
 			for (j = 0; j < 8; j++)
-				sprintf(extra, "%s%02X ", extra, efuse[i + j]);
-			sprintf(extra, "%s\t", extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j < 16; j++)
-				sprintf(extra, "%s%02X ", extra, efuse[i + j]);
-			sprintf(extra, "%s\n", extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 		if ((shift + cnt) < mapLen)
-			sprintf(extra, "%s\t...more (left:%d/%d)\n", extra, mapLen-(shift + cnt), mapLen);
+			extra_len += sprintf(extra + extra_len, "\t...more (left:%d/%d)\n", mapLen-(shift + cnt), mapLen);
 	} else if (strcmp(tmp[0], "rmap") == 0) {
 		if ((tmp[1] == NULL) || (tmp[2] == NULL)) {
 			RTW_INFO("%s: rmap Fail!! Parameters error!\n", __FUNCTION__);
@@ -9201,9 +9202,10 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 		/*		RTW_INFO("%s: data={", __FUNCTION__); */
 		*extra = 0;
+		extra_len = 0;
 		for (i = 0; i < cnts; i++) {
 			/*			RTW_INFO("0x%02x ", data[i]); */
-			sprintf(extra, "%s0x%02X ", extra, data[i]);
+			extra_len += sprintf(extra + extra_len, "0x%02X ", data[i]);
 		}
 		/*		RTW_INFO("}\n"); */
 	} else if (strcmp(tmp[0], "realraw") == 0) {
@@ -9232,18 +9234,18 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		} else
 			raw_order = 0;
 
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < cnt; i += 16) {
-			sprintf(extra, "%s0x%02x\t", extra, shift + i);
+			extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i);
 			for (j = 0; j < 8; j++)
-				sprintf(extra, "%s%02X ", extra, rawdata[i + j]);
-			sprintf(extra, "%s\t", extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", rawdata[i + j]);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j < 16; j++)
-				sprintf(extra, "%s%02X ", extra, rawdata[i + j]);
-			sprintf(extra, "%s\n", extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", rawdata[i + j]);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 		if ((shift + cnt) < mapLen)
-			sprintf(extra, "%s\t...more (left:%d/%d)\n", extra, mapLen-(shift + cnt), mapLen);
+			extra_len += sprintf(extra + extra_len, "\t...more (left:%d/%d)\n", mapLen-(shift + cnt), mapLen);
 
 	} else if (strcmp(tmp[0], "btrealraw") == 0) {
 		static u8 bt_raw_order = 0;
@@ -9279,18 +9281,18 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		} else
 			bt_raw_order = 0;
 
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < cnt; i += 16) {
-			sprintf(extra, "%s0x%02x\t", extra, shift + i);
+			extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i);
 			for (j = 0; j < 8; j++)
-				sprintf(extra, "%s%02X ", extra, rawdata[i + j]);
-			sprintf(extra, "%s\t", extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", rawdata[i + j]);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j < 16; j++)
-				sprintf(extra, "%s%02X ", extra, rawdata[i + j]);
-			sprintf(extra, "%s\n", extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", rawdata[i + j]);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 		if ((shift + cnt) < mapLen)
-			sprintf(extra, "%s\t...more (left:%d/%d)\n", extra, mapLen-(shift + cnt), mapLen);
+			extra_len += sprintf(extra + extra_len, "\t...more (left:%d/%d)\n", mapLen-(shift + cnt), mapLen);
 
 	} else if (strcmp(tmp[0], "mac") == 0) {
 		if (hal_efuse_macaddr_offset(padapter) == -1) {
@@ -9316,12 +9318,13 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 		/*		RTW_INFO("%s: MAC address={", __FUNCTION__); */
 		*extra = 0;
+		extra_len = 0;
 		for (i = 0; i < cnts; i++) {
 			/*			RTW_INFO("%02X", data[i]); */
-			sprintf(extra, "%s%02X", extra, data[i]);
+			extra_len += sprintf(extra + extra_len, "%02X", data[i]);
 			if (i != (cnts - 1)) {
 				/*				RTW_INFO(":"); */
-				sprintf(extra, "%s:", extra);
+				extra_len += sprintf(extra + extra_len, ":");
 			}
 		}
 		/*		RTW_INFO("}\n"); */
@@ -9379,12 +9382,13 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 		/*		RTW_INFO("%s: {VID,PID}={", __FUNCTION__); */
 		*extra = 0;
+		extra_len = 0;
 		for (i = 0; i < cnts; i++) {
 			/*			RTW_INFO("0x%02x", data[i]); */
-			sprintf(extra, "%s0x%02X", extra, data[i]);
+			extra_len += sprintf(extra + extra_len, "0x%02X", data[i]);
 			if (i != (cnts - 1)) {
 				/*				RTW_INFO(","); */
-				sprintf(extra, "%s,", extra);
+				extra_len += sprintf(extra + extra_len, ",");
 			}
 		}
 		/*		RTW_INFO("}\n"); */
@@ -9412,22 +9416,22 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		}
 
 		/*		RTW_INFO("OFFSET\tVALUE(hex)\n"); */
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < 512; i += 16) { /* set 512 because the iwpriv's extra size have limit 0x7FF */
 			/*			RTW_INFO("0x%03x\t", i); */
-			sprintf(extra, "%s0x%03x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%03x\t", i);
 			for (j = 0; j < 8; j++) {
 				/*				RTW_INFO("%02X ", pEfuseHal->BTEfuseInitMap[i+j]); */
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i + j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i + j]);
 			}
 			/*			RTW_INFO("\t"); */
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j < 16; j++) {
 				/*				RTW_INFO("%02X ", pEfuseHal->BTEfuseInitMap[i+j]); */
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i + j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i + j]);
 			}
 			/*			RTW_INFO("\n"); */
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 		/*		RTW_INFO("\n"); */
 	} else if (strcmp(tmp[0], "btbmap") == 0) {
@@ -9441,22 +9445,22 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		}
 
 		/*		RTW_INFO("OFFSET\tVALUE(hex)\n"); */
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 512; i < 1024 ; i += 16) {
 			/*			RTW_INFO("0x%03x\t", i); */
-			sprintf(extra, "%s0x%03x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%03x\t", i);
 			for (j = 0; j < 8; j++) {
 				/*				RTW_INFO("%02X ", data[i+j]); */
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i + j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i + j]);
 			}
 			/*			RTW_INFO("\t"); */
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j < 16; j++) {
 				/*				RTW_INFO("%02X ", data[i+j]); */
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i + j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i + j]);
 			}
 			/*			RTW_INFO("\n"); */
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 		/*		RTW_INFO("\n"); */
 	} else if (strcmp(tmp[0], "btrmap") == 0) {
@@ -9504,51 +9508,52 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		}
 
 		*extra = 0;
+		extra_len = 0;
 		/*		RTW_INFO("%s: bt efuse data={", __FUNCTION__); */
 		for (i = 0; i < cnts; i++) {
 			/*			RTW_INFO("0x%02x ", data[i]); */
-			sprintf(extra, "%s 0x%02X ", extra, data[i]);
+			extra_len += sprintf(extra + extra_len, " 0x%02X ", data[i]);
 		}
 		/*		RTW_INFO("}\n"); */
 		RTW_INFO(FUNC_ADPT_FMT ": BT MAC=[%s]\n", FUNC_ADPT_ARG(padapter), extra);
 	} else if (strcmp(tmp[0], "btffake") == 0) {
 		/*		RTW_INFO("OFFSET\tVALUE(hex)\n"); */
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < 512; i += 16) {
 			/*			RTW_INFO("0x%03x\t", i); */
-			sprintf(extra, "%s0x%03x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%03x\t", i);
 			for (j = 0; j < 8; j++) {
 				/*				RTW_INFO("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); */
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i + j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i + j]);
 			}
 			/*			RTW_INFO("\t"); */
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j < 16; j++) {
 				/*				RTW_INFO("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); */
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i + j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i + j]);
 			}
 			/*			RTW_INFO("\n"); */
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 		/*		RTW_INFO("\n"); */
 	} else if (strcmp(tmp[0], "btbfake") == 0) {
 		/*		RTW_INFO("OFFSET\tVALUE(hex)\n"); */
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 512; i < 1024; i += 16) {
 			/*			RTW_INFO("0x%03x\t", i); */
-			sprintf(extra, "%s0x%03x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%03x\t", i);
 			for (j = 0; j < 8; j++) {
 				/*				RTW_INFO("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); */
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i + j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i + j]);
 			}
 			/*			RTW_INFO("\t"); */
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j < 16; j++) {
 				/*				RTW_INFO("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); */
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i + j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i + j]);
 			}
 			/*			RTW_INFO("\n"); */
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 		/*		RTW_INFO("\n"); */
 	} else if (strcmp(tmp[0], "wlrfkmap") == 0) {
@@ -9569,18 +9574,18 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		} else
 			fk_order = 0;
 
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < cnt; i += 16) {
-			sprintf(extra, "%s0x%02x\t", extra, shift + i);
+			extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i);
 			for (j = 0; j < 8; j++)
-				sprintf(extra, "%s%02X ", extra, efuse[i + j]);
-			sprintf(extra, "%s\t", extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j < 16; j++)
-				sprintf(extra, "%s%02X ", extra, efuse[i + j]);
-			sprintf(extra, "%s\n", extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 		if ((shift + cnt) < mapLen)
-			sprintf(extra, "%s\t...more\n", extra);
+			extra_len += sprintf(extra + extra_len, "\t...more\n");
 
 	} else if (strcmp(tmp[0], "wlrfkrmap") == 0) {
 		if ((tmp[1] == NULL) || (tmp[2] == NULL)) {
@@ -9602,9 +9607,10 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 		/*		RTW_INFO("%s: data={", __FUNCTION__); */
 		*extra = 0;
+		extra_len = 0;
 		for (i = 0; i < cnts; i++) {
 			RTW_INFO("wlrfkrmap = 0x%02x\n", pEfuseHal->fakeEfuseModifiedMap[addr + i]);
-			sprintf(extra, "%s0x%02X ", extra, pEfuseHal->fakeEfuseModifiedMap[addr + i]);
+			extra_len += sprintf(extra + extra_len, "0x%02X ", pEfuseHal->fakeEfuseModifiedMap[addr + i]);
 		}
 	} else if (strcmp(tmp[0], "btrfkrmap") == 0) {
 		if ((tmp[1] == NULL) || (tmp[2] == NULL)) {
@@ -9626,9 +9632,10 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 		/*		RTW_INFO("%s: data={", __FUNCTION__); */
 		*extra = 0;
+		extra_len = 0;
 		for (i = 0; i < cnts; i++) {
 			RTW_INFO("wlrfkrmap = 0x%02x\n", pEfuseHal->fakeBTEfuseModifiedMap[addr + i]);
-			sprintf(extra, "%s0x%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[addr + i]);
+			extra_len += sprintf(extra + extra_len, "0x%02X ", pEfuseHal->fakeBTEfuseModifiedMap[addr + i]);
 		}
 	} else if (strcmp(tmp[0], "mask") == 0) {
 		*extra = 0;
@@ -9638,9 +9645,9 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		if (padapter->registrypriv.bFileMaskEfuse == _TRUE)
 			_rtw_memcpy(mask_buf, maskfileBuffer, mask_len);
 
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < mask_len; i++)
-			sprintf(extra, "%s0x%02X\n", extra, mask_buf[i]);
+			extra_len += sprintf(extra + extra_len, "0x%02X\n", mask_buf[i]);
 
 	} else
 		sprintf(extra, "Command not found!");
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723cs/os_dep/linux/ioctl_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8723cs/os_dep/linux/ioctl_mp.c
index 47b48aac288c71..ca2681a9077bd3 100644
--- a/drivers/net/wireless/rockchip_wlan/rtl8723cs/os_dep/linux/ioctl_mp.c
+++ b/drivers/net/wireless/rockchip_wlan/rtl8723cs/os_dep/linux/ioctl_mp.c
@@ -198,7 +198,7 @@ int rtw_mp_read_reg(struct net_device *dev,
 			if (*pnext != '\0') {
 				/*strtout = simple_strtoul(pnext , &ptmp, 16);*/
 				ret = sscanf(pnext, "%x", &strtout);
-				sprintf(extra, "%s %d" , extra , strtout);
+				sprintf(extra + strlen(extra), " %d", strtout);
 			} else
 				break;
 			pch = pnext;
@@ -230,7 +230,7 @@ int rtw_mp_read_reg(struct net_device *dev,
 			pnext++;
 			if (*pnext != '\0') {
 				ret = sscanf(pnext, "%x", &strtout);
-				sprintf(extra, "%s %d" , extra , strtout);
+				sprintf(extra + strlen(extra), " %d", strtout);
 			} else
 				break;
 			pch = pnext;
@@ -341,20 +341,23 @@ int rtw_mp_read_rf(struct net_device *dev,
 	pch = tmp;
 	RTW_INFO("pch=%s", pch);
 
-	while (*pch != '\0') {
-		pnext = strpbrk(pch, " ");
-		if (!pnext)
-			break;
-		pnext++;
-		if (*pnext != '\0') {
-			/*strtou =simple_strtoul(pnext , &ptmp, 16);*/
-			ret = sscanf(pnext, "%x", &strtou);
-			sprintf(extra, "%s %d" , extra , strtou);
-		} else
-			break;
-		pch = pnext;
+	{
+		size_t extra_len = strlen(extra);
+		while (*pch != '\0') {
+			pnext = strpbrk(pch, " ");
+			if (!pnext)
+				break;
+			pnext++;
+			if (*pnext != '\0') {
+				/*strtou =simple_strtoul(pnext , &ptmp, 16);*/
+				ret = sscanf(pnext, "%x", &strtou);
+				extra_len += sprintf(extra + extra_len, " %d", strtou);
+			} else
+				break;
+			pch = pnext;
+		}
+		wrqu->length = extra_len;
 	}
-	wrqu->length = strlen(extra);
 
 	return 0;
 }
@@ -1417,7 +1420,7 @@ int rtw_mp_pretx_proc(PADAPTER padapter, u8 bStartTest, char *extra)
 			pmp_priv->mode = MP_ON;
 			sprintf(extra, "Stop continuous Tx");
 		} else if (pmp_priv->tx.stop == 1) {
-			sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500 count=%u\n", extra, pmp_priv->tx.count);
+			sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500 count=%u\n", pmp_priv->tx.count);
 			pmp_priv->tx.stop = 0;
 			SetPacketTx(padapter);
 		} else
@@ -1425,26 +1428,26 @@ int rtw_mp_pretx_proc(PADAPTER padapter, u8 bStartTest, char *extra)
 		return 0;
 	case MP_SINGLE_TONE_TX:
 		if (bStartTest != 0)
-			sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra);
+			sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.");
 		SetSingleToneTx(padapter, (u8)bStartTest);
 		break;
 	case MP_CONTINUOUS_TX:
 		if (bStartTest != 0)
-			sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra);
+			sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.");
 		SetContinuousTx(padapter, (u8)bStartTest);
 		break;
 	case MP_CARRIER_SUPPRISSION_TX:
 		if (bStartTest != 0) {
 			if (HwRateToMPTRate(pmp_priv->rateidx) <= MPT_RATE_11M)
-				sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra);
+				sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.");
 			else
-				sprintf(extra, "%s\nSpecify carrier suppression but not CCK rate", extra);
+				sprintf(extra + strlen(extra), "\nSpecify carrier suppression but not CCK rate");
 		}
 		SetCarrierSuppressionTx(padapter, (u8)bStartTest);
 		break;
 	case MP_SINGLE_CARRIER_TX:
 		if (bStartTest != 0)
-			sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra);
+			sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.");
 		SetSingleCarrierTx(padapter, (u8)bStartTest);
 		break;
 
@@ -1496,6 +1499,7 @@ int rtw_mp_tx(struct net_device *dev,
 	u32 bandwidth = 0, sg = 0, channel = 6, txpower = 40, rate = 108, ant = 0, txmode = 1, count = 0;
 	u8 i = 0, j = 0, bStartTest = 1, status = 0, Idx = 0, tmpU1B = 0;
 	u16 antenna = 0;
+	size_t extra_len;
 
 	if (copy_from_user(extra, wrqu->data.pointer, wrqu->data.length))
 		return -EFAULT;
@@ -1522,13 +1526,13 @@ int rtw_mp_tx(struct net_device *dev,
 		return 0;
 	} else if (strncmp(extra, "setting", 7) == 0) {
 		_rtw_memset(extra, 0, wrqu->data.length);
-		sprintf(extra, "Current Setting :\n Channel:%d", pmp_priv->channel);
-		sprintf(extra, "%s\n Bandwidth:%d", extra, pmp_priv->bandwidth);
-		sprintf(extra, "%s\n Rate index:%d", extra, pmp_priv->rateidx);
-		sprintf(extra, "%s\n TxPower index:%d", extra, pmp_priv->txpoweridx);
-		sprintf(extra, "%s\n Antenna TxPath:%d", extra, pmp_priv->antenna_tx);
-		sprintf(extra, "%s\n Antenna RxPath:%d", extra, pmp_priv->antenna_rx);
-		sprintf(extra, "%s\n MP Mode:%d", extra, pmp_priv->mode);
+		extra_len = sprintf(extra, "Current Setting :\n Channel:%d", pmp_priv->channel);
+		extra_len += sprintf(extra + extra_len, "\n Bandwidth:%d", pmp_priv->bandwidth);
+		extra_len += sprintf(extra + extra_len, "\n Rate index:%d", pmp_priv->rateidx);
+		extra_len += sprintf(extra + extra_len, "\n TxPower index:%d", pmp_priv->txpoweridx);
+		extra_len += sprintf(extra + extra_len, "\n Antenna TxPath:%d", pmp_priv->antenna_tx);
+		extra_len += sprintf(extra + extra_len, "\n Antenna RxPath:%d", pmp_priv->antenna_rx);
+		extra_len += sprintf(extra + extra_len, "\n MP Mode:%d", pmp_priv->mode);
 		wrqu->data.length = strlen(extra);
 		return 0;
 #ifdef CONFIG_MP_VHT_HW_TX_MODE
@@ -1666,25 +1670,25 @@ int rtw_mp_tx(struct net_device *dev,
 		if (sscanf(extra, "ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d", &channel, &bandwidth, &rate, &txpower, &ant, &txmode) < 6) {
 			RTW_INFO("Invalid format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode);
 			_rtw_memset(extra, 0, wrqu->data.length);
-			sprintf(extra, "\n Please input correct format as bleow:\n");
-			sprintf(extra, "%s\t ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d\n", extra, channel, bandwidth, rate, txpower, ant, txmode);
-			sprintf(extra, "%s\n [ ch : BGN = <1~14> , A or AC = <36~165> ]", extra);
-			sprintf(extra, "%s\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]", extra);
-			sprintf(extra, "%s\n [ rate :	CCK: 1 2 5.5 11M X 2 = < 2 4 11 22 >]", extra);
-			sprintf(extra, "%s\n [		OFDM: 6 9 12 18 24 36 48 54M X 2 = < 12 18 24 36 48 72 96 108>", extra);
-			sprintf(extra, "%s\n [		HT 1S2SS MCS0 ~ MCS15 : < [MCS0]=128 ~ [MCS7]=135 ~ [MCS15]=143 >", extra);
-			sprintf(extra, "%s\n [		HT 3SS MCS16 ~ MCS32 : < [MCS16]=144 ~ [MCS23]=151 ~ [MCS32]=159 >", extra);
-			sprintf(extra, "%s\n [		VHT 1SS MCS0 ~ MCS9 : < [MCS0]=160 ~ [MCS9]=169 >", extra);
-			sprintf(extra, "%s\n [ txpower : 1~63 power index", extra);
-			sprintf(extra, "%s\n [ ant : <A = 1, B = 2, C = 4, D = 8> ,2T ex: AB=3 BC=6 CD=12", extra);
-			sprintf(extra, "%s\n [ txmode : < 0 = CONTINUOUS_TX, 1 = PACKET_TX, 2 = SINGLE_TONE_TX, 3 = CARRIER_SUPPRISSION_TX, 4 = SINGLE_CARRIER_TX>\n", extra);
+			extra_len = sprintf(extra, "\n Please input correct format as bleow:\n");
+			extra_len += sprintf(extra + extra_len, "\t ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d\n", channel, bandwidth, rate, txpower, ant, txmode);
+			extra_len += sprintf(extra + extra_len, "\n [ ch : BGN = <1~14> , A or AC = <36~165> ]");
+			extra_len += sprintf(extra + extra_len, "\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]");
+			extra_len += sprintf(extra + extra_len, "\n [ rate :	CCK: 1 2 5.5 11M X 2 = < 2 4 11 22 >]");
+			extra_len += sprintf(extra + extra_len, "\n [		OFDM: 6 9 12 18 24 36 48 54M X 2 = < 12 18 24 36 48 72 96 108>");
+			extra_len += sprintf(extra + extra_len, "\n [		HT 1S2SS MCS0 ~ MCS15 : < [MCS0]=128 ~ [MCS7]=135 ~ [MCS15]=143 >");
+			extra_len += sprintf(extra + extra_len, "\n [		HT 3SS MCS16 ~ MCS32 : < [MCS16]=144 ~ [MCS23]=151 ~ [MCS32]=159 >");
+			extra_len += sprintf(extra + extra_len, "\n [		VHT 1SS MCS0 ~ MCS9 : < [MCS0]=160 ~ [MCS9]=169 >");
+			extra_len += sprintf(extra + extra_len, "\n [ txpower : 1~63 power index");
+			extra_len += sprintf(extra + extra_len, "\n [ ant : <A = 1, B = 2, C = 4, D = 8> ,2T ex: AB=3 BC=6 CD=12");
+			extra_len += sprintf(extra + extra_len, "\n [ txmode : < 0 = CONTINUOUS_TX, 1 = PACKET_TX, 2 = SINGLE_TONE_TX, 3 = CARRIER_SUPPRISSION_TX, 4 = SINGLE_CARRIER_TX>\n");
 			wrqu->data.length = strlen(extra);
 			return status;
 
 		} else {
 			RTW_INFO("Got format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode);
 			_rtw_memset(extra, 0, wrqu->data.length);
-			sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
+			extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
 			padapter->mppriv.channel = channel;
 			SetChannel(padapter);
 			pHalData->current_channel = channel;
@@ -1693,13 +1697,13 @@ int rtw_mp_tx(struct net_device *dev,
 				bandwidth = CHANNEL_WIDTH_40;
 			else if (bandwidth == 2)
 				bandwidth = CHANNEL_WIDTH_80;
-			sprintf(extra, "%s\nChange Current Bandwidth %d to Bandwidth %d", extra, padapter->mppriv.bandwidth , bandwidth);
+			extra_len += sprintf(extra + extra_len, "\nChange Current Bandwidth %d to Bandwidth %d", padapter->mppriv.bandwidth , bandwidth);
 			padapter->mppriv.bandwidth = (u8)bandwidth;
 			padapter->mppriv.preamble = sg;
 			SetBandwidth(padapter);
 			pHalData->current_channel_bw = bandwidth;
 
-			sprintf(extra, "%s\nSet power level :%d", extra, txpower);
+			extra_len += sprintf(extra + extra_len, "\nSet power level :%d", txpower);
 			padapter->mppriv.txpoweridx = (u8)txpower;
 			pMptCtx->TxPwrLevel[ODM_RF_PATH_A] = (u8)txpower;
 			pMptCtx->TxPwrLevel[ODM_RF_PATH_B] = (u8)txpower;
@@ -1722,13 +1726,13 @@ int rtw_mp_tx(struct net_device *dev,
 			RTW_INFO("%s: rate index=%d\n", __func__, rate);
 			if (rate >= MPT_RATE_LAST)
 				return -EINVAL;
-			sprintf(extra, "%s\nSet data rate to %d index %d", extra, padapter->mppriv.rateidx, rate);
+			extra_len += sprintf(extra + extra_len, "\nSet data rate to %d index %d", padapter->mppriv.rateidx, rate);
 
 			padapter->mppriv.rateidx = rate;
 			pMptCtx->mpt_rate_index = rate;
 			SetDataRate(padapter);
 
-			sprintf(extra, "%s\nSet Antenna Path :%d",  extra, ant);
+			extra_len += sprintf(extra + extra_len, "\nSet Antenna Path :%d", ant);
 			switch (ant) {
 			case 1:
 				antenna = ANTENNA_A;
@@ -1805,6 +1809,7 @@ int rtw_mp_rx(struct net_device *dev,
 	      struct iw_request_info *info,
 	      union iwreq_data *wrqu, char *extra)
 {
+	size_t extra_len;
 	PADAPTER padapter = rtw_netdev_priv(dev);
 	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(padapter);
 	struct mp_priv *pmp_priv = &padapter->mppriv;
@@ -1836,19 +1841,19 @@ int rtw_mp_rx(struct net_device *dev,
 	} else if (sscanf(extra, "ch=%d,bw=%d,ant=%d", &channel, &bandwidth, &ant) < 3) {
 		RTW_INFO("Invalid format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant);
 		_rtw_memset(extra, 0, wrqu->data.length);
-		sprintf(extra, "\n Please input correct format as bleow:\n");
-		sprintf(extra, "%s\t ch=%d,bw=%d,ant=%d\n", extra, channel, bandwidth, ant);
-		sprintf(extra, "%s\n [ ch : BGN = <1~14> , A or AC = <36~165> ]", extra);
-		sprintf(extra, "%s\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]", extra);
-		sprintf(extra, "%s\n [ ant : <A = 1, B = 2, C = 4, D = 8> ,2T ex: AB=3 BC=6 CD=12", extra);
-		wrqu->data.length = strlen(extra);
+		extra_len = sprintf(extra, "\n Please input correct format as bleow:\n");
+		extra_len += sprintf(extra + extra_len, "\t ch=%d,bw=%d,ant=%d\n", channel, bandwidth, ant);
+		extra_len += sprintf(extra + extra_len, "\n [ ch : BGN = <1~14> , A or AC = <36~165> ]");
+		extra_len += sprintf(extra + extra_len, "\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]");
+		extra_len += sprintf(extra + extra_len, "\n [ ant : <A = 1, B = 2, C = 4, D = 8> ,2T ex: AB=3 BC=6 CD=12");
+		wrqu->data.length = extra_len;
 		return 0;
 
 	} else {
 		bStartRx = 1;
 		RTW_INFO("Got format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant);
 		_rtw_memset(extra, 0, wrqu->data.length);
-		sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
+		extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
 		padapter->mppriv.channel = channel;
 		SetChannel(padapter);
 		pHalData->current_channel = channel;
@@ -1857,13 +1862,13 @@ int rtw_mp_rx(struct net_device *dev,
 			bandwidth = CHANNEL_WIDTH_40;
 		else if (bandwidth == 2)
 			bandwidth = CHANNEL_WIDTH_80;
-		sprintf(extra, "%s\nChange Current Bandwidth %d to Bandwidth %d", extra, padapter->mppriv.bandwidth , bandwidth);
+		extra_len += sprintf(extra + extra_len, "\nChange Current Bandwidth %d to Bandwidth %d", padapter->mppriv.bandwidth , bandwidth);
 		padapter->mppriv.bandwidth = (u8)bandwidth;
 		padapter->mppriv.preamble = sg;
 		SetBandwidth(padapter);
 		pHalData->current_channel_bw = bandwidth;
 
-		sprintf(extra, "%s\nSet Antenna Path :%d",  extra, ant);
+		extra_len += sprintf(extra + extra_len, "\nSet Antenna Path :%d", ant);
 		switch (ant) {
 		case 1:
 			antenna = ANTENNA_A;
@@ -1914,7 +1919,7 @@ int rtw_mp_rx(struct net_device *dev,
 		pHalData->antenna_tx_path = antenna;
 		SetAntenna(padapter);
 
-		sprintf(extra, "%s\nstart Rx", extra);
+		extra_len += sprintf(extra + extra_len, "\nstart Rx");
 		SetPacketRx(padapter, bStartRx, _FALSE);
 	}
 	wrqu->data.length = strlen(extra);
@@ -1956,6 +1961,7 @@ int rtw_efuse_mask_file(struct net_device *dev,
 	char *rtw_efuse_mask_file_path;
 	u8 Status;
 	PADAPTER padapter = rtw_netdev_priv(dev);
+	size_t extra_len;
 
 	_rtw_memset(maskfileBuffer, 0x00, sizeof(maskfileBuffer));
 
@@ -2006,11 +2012,11 @@ int rtw_efuse_mask_file(struct net_device *dev,
 		 } while (count < 64);
 
 		for (i = 0; i < count; i++)
-			sprintf(extra, "%s:%02x", extra, maskfileBuffer[i]);
+			extra_len += sprintf(extra + extra_len, ":%02x", maskfileBuffer[i]);
 
 		padapter->registrypriv.bFileMaskEfuse = _TRUE;
 
-		sprintf(extra, "%s\nLoad Efuse Mask data %d hex ok\n", extra, count);
+		extra_len += sprintf(extra + extra_len, "\nLoad Efuse Mask data %d hex ok\n", count);
 		wrqu->data.length = strlen(extra);
 		return 0;
 	}
@@ -2388,16 +2394,17 @@ int rtw_mp_SetBT(struct net_device *dev,
 	mptbt_BtControlProcess(padapter, &BtReq);
 
 	if (readtherm == 0) {
-		sprintf(extra, "BT thermal=");
+		size_t extra_len = sprintf(extra, "BT thermal=");
 		for (i = 4; i < pMptCtx->mptOutLen; i++) {
 			if ((pMptCtx->mptOutBuf[i] == 0x00) && (pMptCtx->mptOutBuf[i + 1] == 0x00))
 				goto exit;
 
-			sprintf(extra, "%s %d ", extra, (pMptCtx->mptOutBuf[i] & 0x1f));
+			extra_len += sprintf(extra + extra_len, " %d ", (pMptCtx->mptOutBuf[i] & 0x1f));
 		}
 	} else {
+		size_t extra_len = strlen(extra);
 		for (i = 4; i < pMptCtx->mptOutLen; i++)
-			sprintf(extra, "%s 0x%x ", extra, pMptCtx->mptOutBuf[i]);
+			extra_len += sprintf(extra + extra_len, " 0x%x ", pMptCtx->mptOutBuf[i]);
 	}
 
 exit:
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723ds/core/rtw_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8723ds/core/rtw_mp.c
index 548a293b73ff20..3c48e1f674dc0d 100644
--- a/drivers/net/wireless/rockchip_wlan/rtl8723ds/core/rtw_mp.c
+++ b/drivers/net/wireless/rockchip_wlan/rtl8723ds/core/rtw_mp.c
@@ -2444,14 +2444,17 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data)
 
 	data[0] = '\0';
 
-	i = psd_start;
-	while (i < psd_stop) {
-		if (i >= psd_pts)
-			psd_data = rtw_GetPSDData(pAdapter, i - psd_pts);
-		else
-			psd_data = rtw_GetPSDData(pAdapter, i);
-		sprintf(data, "%s%x ", data, psd_data);
-		i++;
+	{
+		size_t extra_len = strlen(data);
+		i = psd_start;
+		while (i < psd_stop) {
+			if (i >= psd_pts)
+				psd_data = rtw_GetPSDData(pAdapter, i - psd_pts);
+			else
+				psd_data = rtw_GetPSDData(pAdapter, i);
+			extra_len += sprintf(data + extra_len, "%x ", psd_data);
+			i++;
+		}
 	}
 
 #ifdef CONFIG_LONG_DELAY_ISSUE
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723ds/os_dep/linux/ioctl_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8723ds/os_dep/linux/ioctl_mp.c
index afd10ab97fd8e0..9fa849e322125a 100644
--- a/drivers/net/wireless/rockchip_wlan/rtl8723ds/os_dep/linux/ioctl_mp.c
+++ b/drivers/net/wireless/rockchip_wlan/rtl8723ds/os_dep/linux/ioctl_mp.c
@@ -551,6 +551,7 @@ int rtw_mp_txpower_index(struct net_device *dev,
 	char input[wrqu->length + 1];
 	u32 rfpath;
 	u32 txpower_inx;
+	size_t extra_len;
 
 	if (wrqu->length > 128)
 		return -EFAULT;
@@ -571,15 +572,15 @@ int rtw_mp_txpower_index(struct net_device *dev,
 		sprintf(extra, "patha=%d", txpower_inx);
 		if (phal_data->rf_type > RF_1T2R) {
 			txpower_inx = mpt_ProQueryCalTxPower(padapter, 1);
-			sprintf(extra, "%s,pathb=%d", extra, txpower_inx);
+			extra_len += sprintf(extra + extra_len, ",pathb=%d", txpower_inx);
 		}
 		if (phal_data->rf_type > RF_2T4R) {
 			txpower_inx = mpt_ProQueryCalTxPower(padapter, 2);
-			sprintf(extra, "%s,pathc=%d", extra, txpower_inx);
+			extra_len += sprintf(extra + extra_len, ",pathc=%d", txpower_inx);
 		}
 		if (phal_data->rf_type > RF_3T4R) {
 			txpower_inx = mpt_ProQueryCalTxPower(padapter, 3);
-			sprintf(extra, "%s,pathd=%d", extra, txpower_inx);
+			extra_len += sprintf(extra + extra_len, ",pathd=%d", txpower_inx);
 		}
 	}
 	wrqu->length = strlen(extra);
@@ -1821,7 +1822,7 @@ int rtw_mp_tx(struct net_device *dev,
 			char *pextra = extra;
 			RTW_INFO("Got format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode);
 			_rtw_memset(extra, 0, wrqu->data.length);
-			sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
+			extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
 			padapter->mppriv.channel = channel;
 			SetChannel(padapter);
 			pHalData->current_channel = channel;
@@ -1944,6 +1945,7 @@ int rtw_mp_rx(struct net_device *dev,
 	      struct iw_request_info *info,
 	      union iwreq_data *wrqu, char *extra)
 {
+	size_t extra_len;
 	PADAPTER padapter = rtw_netdev_priv(dev);
 	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(padapter);
 	struct mp_priv *pmp_priv = &padapter->mppriv;
@@ -1987,7 +1989,7 @@ int rtw_mp_rx(struct net_device *dev,
 		bStartRx = 1;
 		RTW_INFO("Got format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant);
 		_rtw_memset(extra, 0, wrqu->data.length);
-		sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
+		extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
 		padapter->mppriv.channel = channel;
 		SetChannel(padapter);
 		pHalData->current_channel = channel;
@@ -2158,6 +2160,7 @@ int rtw_efuse_mask_file(struct net_device *dev,
 	char *rtw_efuse_mask_file_path;
 	u8 Status;
 	PADAPTER padapter = rtw_netdev_priv(dev);
+	size_t extra_len;
 
 	_rtw_memset(maskfileBuffer, 0x00, sizeof(maskfileBuffer));
 
@@ -2208,11 +2211,11 @@ int rtw_efuse_mask_file(struct net_device *dev,
 		 } while (count < 64);
 
 		for (i = 0; i < count; i++)
-			sprintf(extra, "%s:%02x", extra, maskfileBuffer[i]);
+			extra_len += sprintf(extra + extra_len, ":%02x", maskfileBuffer[i]);
 
 		padapter->registrypriv.bFileMaskEfuse = _TRUE;
 
-		sprintf(extra, "%s\nLoad Efuse Mask data %d hex ok\n", extra, count);
+		extra_len += sprintf(extra + extra_len, "\nLoad Efuse Mask data %d hex ok\n", count);
 		wrqu->data.length = strlen(extra);
 		return 0;
 	}
@@ -2635,16 +2638,17 @@ int rtw_mp_SetBT(struct net_device *dev,
 	mptbt_BtControlProcess(padapter, &BtReq);
 
 	if (readtherm == 0) {
-		sprintf(extra, "BT thermal=");
+		size_t extra_len = sprintf(extra, "BT thermal=");
 		for (i = 4; i < pMptCtx->mptOutLen; i++) {
 			if ((pMptCtx->mptOutBuf[i] == 0x00) && (pMptCtx->mptOutBuf[i + 1] == 0x00))
 				goto exit;
 
-			sprintf(extra, "%s %d ", extra, (pMptCtx->mptOutBuf[i] & 0x1f));
+			extra_len += sprintf(extra + extra_len, " %d ", (pMptCtx->mptOutBuf[i] & 0x1f));
 		}
 	} else {
+		size_t extra_len = strlen(extra);
 		for (i = 4; i < pMptCtx->mptOutLen; i++)
-			sprintf(extra, "%s 0x%x ", extra, pMptCtx->mptOutBuf[i]);
+			extra_len += sprintf(extra + extra_len, " 0x%x ", pMptCtx->mptOutBuf[i]);
 	}
 
 exit:
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8822be/core/rtw_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8822be/core/rtw_mp.c
index 98054d1338a2d5..590b4ac8782595 100644
--- a/drivers/net/wireless/rockchip_wlan/rtl8822be/core/rtw_mp.c
+++ b/drivers/net/wireless/rockchip_wlan/rtl8822be/core/rtw_mp.c
@@ -2076,14 +2076,17 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data)
 
 	data[0] = '\0';
 
-	i = psd_start;
-	while (i < psd_stop) {
-		if (i >= psd_pts)
-			psd_data = rtw_GetPSDData(pAdapter, i - psd_pts);
-		else
-			psd_data = rtw_GetPSDData(pAdapter, i);
-		sprintf(data, "%s%x ", data, psd_data);
-		i++;
+	{
+		size_t extra_len = strlen(data);
+		i = psd_start;
+		while (i < psd_stop) {
+			if (i >= psd_pts)
+				psd_data = rtw_GetPSDData(pAdapter, i - psd_pts);
+			else
+				psd_data = rtw_GetPSDData(pAdapter, i);
+			extra_len += sprintf(data + extra_len, "%x ", psd_data);
+			i++;
+		}
 	}
 
 #ifdef CONFIG_LONG_DELAY_ISSUE
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8822be/os_dep/linux/ioctl_linux.c b/drivers/net/wireless/rockchip_wlan/rtl8822be/os_dep/linux/ioctl_linux.c
index be44a62c438b56..d80c366700b642 100644
--- a/drivers/net/wireless/rockchip_wlan/rtl8822be/os_dep/linux/ioctl_linux.c
+++ b/drivers/net/wireless/rockchip_wlan/rtl8822be/os_dep/linux/ioctl_linux.c
@@ -9059,6 +9059,7 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 #ifdef CONFIG_IOL
 	u8 org_fw_iol = padapter->registrypriv.fw_iol;/* 0:Disable, 1:enable, 2:by usb speed */
 #endif
+	size_t extra_len;
 
 	wrqu = (struct iw_point *)wdata;
 	pwrctrlpriv = adapter_to_pwrctl(padapter);
@@ -9114,22 +9115,22 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 	} else if (strcmp(tmp[0], "drvmap") == 0) {
 		EFUSE_GetEfuseDefinition(padapter, EFUSE_WIFI, TYPE_EFUSE_MAP_LEN, (void *)&mapLen, _FALSE);
 
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < mapLen; i += 16) {
 			/*RTW_INFO("0x%02x\t", i);*/
-			sprintf(extra, "%s0x%02x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%02x\t", i);
 			for (j = 0; j < 8; j++) {
 				/*				RTW_INFO("%02X ", data[i+j]); */
-				sprintf(extra, "%s%02X ", extra, PROMContent[i + j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", PROMContent[i + j]);
 			}
 			/*			RTW_INFO("\t"); */
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j < 16; j++) {
 				/*				RTW_INFO("%02X ", data[i+j]); */
-				sprintf(extra, "%s%02X ", extra, PROMContent[i + j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", PROMContent[i + j]);
 			}
 			/*			RTW_INFO("\n"); */
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 		/*		RTW_INFO("\n"); */
 	} else if (strcmp(tmp[0], "realmap") == 0) {
@@ -9169,18 +9170,18 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		} else
 			order = 0;
 
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < cnt; i += 16) {
-			sprintf(extra, "%s0x%02x\t", extra, shift + i);
+			extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i);
 			for (j = 0; j < 8; j++)
-				sprintf(extra, "%s%02X ", extra, efuse[i + j]);
-			sprintf(extra, "%s\t", extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j < 16; j++)
-				sprintf(extra, "%s%02X ", extra, efuse[i + j]);
-			sprintf(extra, "%s\n", extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 		if ((shift + cnt) < mapLen)
-			sprintf(extra, "%s\t...more\n", extra);
+			extra_len += sprintf(extra + extra_len, "\t...more\n");
 	} else if (strcmp(tmp[0], "rmap") == 0) {
 		if ((tmp[1] == NULL) || (tmp[2] == NULL)) {
 			RTW_INFO("%s: rmap Fail!! Parameters error!\n", __FUNCTION__);
@@ -9215,9 +9216,10 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 		/*		RTW_INFO("%s: data={", __FUNCTION__); */
 		*extra = 0;
+		extra_len = 0;
 		for (i = 0; i < cnts; i++) {
 			/*			RTW_INFO("0x%02x ", data[i]); */
-			sprintf(extra, "%s0x%02X ", extra, data[i]);
+			extra_len += sprintf(extra + extra_len, "0x%02X ", data[i]);
 		}
 		/*		RTW_INFO("}\n"); */
 	} else if (strcmp(tmp[0], "realraw") == 0) {
@@ -9244,18 +9246,18 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		} else
 			raw_order = 0;
 
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < cnt; i += 16) {
-			sprintf(extra, "%s0x%02x\t", extra, shift + i);
+			extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i);
 			for (j = 0; j < 8; j++)
-				sprintf(extra, "%s%02X ", extra, rawdata[i + j]);
-			sprintf(extra, "%s\t", extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", rawdata[i + j]);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j < 16; j++)
-				sprintf(extra, "%s%02X ", extra, rawdata[i + j]);
-			sprintf(extra, "%s\n", extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", rawdata[i + j]);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 		if ((shift + cnt) < mapLen)
-			sprintf(extra, "%s\t...more (left:%d/%d)\n", extra, mapLen-(shift + cnt), mapLen);
+			extra_len += sprintf(extra + extra_len, "\t...more (left:%d/%d)\n", mapLen-(shift + cnt), mapLen);
 
 	} else if (strcmp(tmp[0], "btrealraw") == 0) {
 		static u8 bt_raw_order = 0;
@@ -9290,19 +9292,19 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		} else
 			bt_raw_order = 0;
 
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < cnt; i += 16) {
-			sprintf(extra, "%s0x%02x\t", extra, shift + i);
+			extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i);
 			for (j = 0; j < 8; j++)
-				sprintf(extra, "%s%02X ", extra, rawdata[i + j]);
-			sprintf(extra, "%s\t", extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", rawdata[i + j]);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j < 16; j++)
-				sprintf(extra, "%s%02X ", extra, rawdata[i + j]);
-			sprintf(extra, "%s\n", extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", rawdata[i + j]);
+			extra_len += sprintf(extra + extra_len, "\n");
 
 		}
 		if ((shift + cnt) < mapLen)
-			sprintf(extra, "%s\t...more (left:%d/%d)\n", extra, mapLen-(shift + cnt), mapLen);
+			extra_len += sprintf(extra + extra_len, "\t...more (left:%d/%d)\n", mapLen-(shift + cnt), mapLen);
 	} else if (strcmp(tmp[0], "mac") == 0) {
 		if (hal_efuse_macaddr_offset(padapter) == -1) {
 			err = -EFAULT;
@@ -9327,12 +9329,13 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 		/*		RTW_INFO("%s: MAC address={", __FUNCTION__); */
 		*extra = 0;
+		extra_len = 0;
 		for (i = 0; i < cnts; i++) {
 			/*			RTW_INFO("%02X", data[i]); */
-			sprintf(extra, "%s%02X", extra, data[i]);
+			extra_len += sprintf(extra + extra_len, "%02X", data[i]);
 			if (i != (cnts - 1)) {
 				/*				RTW_INFO(":"); */
-				sprintf(extra, "%s:", extra);
+				extra_len += sprintf(extra + extra_len, ":");
 			}
 		}
 		/*		RTW_INFO("}\n"); */
@@ -9390,12 +9393,13 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 		/*		RTW_INFO("%s: {VID,PID}={", __FUNCTION__); */
 		*extra = 0;
+		extra_len = 0;
 		for (i = 0; i < cnts; i++) {
 			/*			RTW_INFO("0x%02x", data[i]); */
-			sprintf(extra, "%s0x%02X", extra, data[i]);
+			extra_len += sprintf(extra + extra_len, "0x%02X", data[i]);
 			if (i != (cnts - 1)) {
 				/*				RTW_INFO(","); */
-				sprintf(extra, "%s,", extra);
+				extra_len += sprintf(extra + extra_len, ",");
 			}
 		}
 		/*		RTW_INFO("}\n"); */
@@ -9423,22 +9427,22 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		}
 
 		/*		RTW_INFO("OFFSET\tVALUE(hex)\n"); */
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < 512; i += 16) { /* set 512 because the iwpriv's extra size have limit 0x7FF */
 			/*			RTW_INFO("0x%03x\t", i); */
-			sprintf(extra, "%s0x%03x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%03x\t", i);
 			for (j = 0; j < 8; j++) {
 				/*				RTW_INFO("%02X ", pEfuseHal->BTEfuseInitMap[i+j]); */
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i + j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i + j]);
 			}
 			/*			RTW_INFO("\t"); */
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j < 16; j++) {
 				/*				RTW_INFO("%02X ", pEfuseHal->BTEfuseInitMap[i+j]); */
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i + j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i + j]);
 			}
 			/*			RTW_INFO("\n"); */
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 		/*		RTW_INFO("\n"); */
 	} else if (strcmp(tmp[0], "btbmap") == 0) {
@@ -9452,22 +9456,22 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		}
 
 		/*		RTW_INFO("OFFSET\tVALUE(hex)\n"); */
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 512; i < 1024 ; i += 16) {
 			/*			RTW_INFO("0x%03x\t", i); */
-			sprintf(extra, "%s0x%03x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%03x\t", i);
 			for (j = 0; j < 8; j++) {
 				/*				RTW_INFO("%02X ", data[i+j]); */
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i + j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i + j]);
 			}
 			/*			RTW_INFO("\t"); */
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j < 16; j++) {
 				/*				RTW_INFO("%02X ", data[i+j]); */
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i + j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i + j]);
 			}
 			/*			RTW_INFO("\n"); */
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 		/*		RTW_INFO("\n"); */
 	} else if (strcmp(tmp[0], "btrmap") == 0) {
@@ -9517,51 +9521,52 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		}
 
 		*extra = 0;
+		extra_len = 0;
 		/*		RTW_INFO("%s: bt efuse data={", __FUNCTION__); */
 		for (i = 0; i < cnts; i++) {
 			/*			RTW_INFO("0x%02x ", data[i]); */
-			sprintf(extra, "%s 0x%02X ", extra, data[i]);
+			extra_len += sprintf(extra + extra_len, " 0x%02X ", data[i]);
 		}
 		/*		RTW_INFO("}\n"); */
 		RTW_INFO(FUNC_ADPT_FMT ": BT MAC=[%s]\n", FUNC_ADPT_ARG(padapter), extra);
 	} else if (strcmp(tmp[0], "btffake") == 0) {
 		/*		RTW_INFO("OFFSET\tVALUE(hex)\n"); */
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < 512; i += 16) {
 			/*			RTW_INFO("0x%03x\t", i); */
-			sprintf(extra, "%s0x%03x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%03x\t", i);
 			for (j = 0; j < 8; j++) {
 				/*				RTW_INFO("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); */
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i + j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i + j]);
 			}
 			/*			RTW_INFO("\t"); */
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j < 16; j++) {
 				/*				RTW_INFO("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); */
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i + j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i + j]);
 			}
 			/*			RTW_INFO("\n"); */
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 		/*		RTW_INFO("\n"); */
 	} else if (strcmp(tmp[0], "btbfake") == 0) {
 		/*		RTW_INFO("OFFSET\tVALUE(hex)\n"); */
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 512; i < 1024; i += 16) {
 			/*			RTW_INFO("0x%03x\t", i); */
-			sprintf(extra, "%s0x%03x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%03x\t", i);
 			for (j = 0; j < 8; j++) {
 				/*				RTW_INFO("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); */
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i + j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i + j]);
 			}
 			/*			RTW_INFO("\t"); */
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j < 16; j++) {
 				/*				RTW_INFO("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]); */
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i + j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i + j]);
 			}
 			/*			RTW_INFO("\n"); */
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 		/*		RTW_INFO("\n"); */
 	} else if (strcmp(tmp[0], "wlrfkmap") == 0) {
@@ -9582,18 +9587,18 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		} else
 			fk_order = 0;
 
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < cnt; i += 16) {
-			sprintf(extra, "%s0x%02x\t", extra, shift + i);
+			extra_len += sprintf(extra + extra_len, "0x%02x\t", shift + i);
 			for (j = 0; j < 8; j++)
-				sprintf(extra, "%s%02X ", extra, efuse[i + j]);
-			sprintf(extra, "%s\t", extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j < 16; j++)
-				sprintf(extra, "%s%02X ", extra, efuse[i + j]);
-			sprintf(extra, "%s\n", extra);
+				extra_len += sprintf(extra + extra_len, "%02X ", efuse[i + j]);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 		if ((shift + cnt) < mapLen)
-			sprintf(extra, "%s\t...more\n", extra);
+			extra_len += sprintf(extra + extra_len, "\t...more\n");
 
 	} else if (strcmp(tmp[0], "wlrfkrmap") == 0) {
 		if ((tmp[1] == NULL) || (tmp[2] == NULL)) {
@@ -9615,9 +9620,10 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 		/*		RTW_INFO("%s: data={", __FUNCTION__); */
 		*extra = 0;
+		extra_len = 0;
 		for (i = 0; i < cnts; i++) {
 			RTW_INFO("wlrfkrmap = 0x%02x\n", pEfuseHal->fakeEfuseModifiedMap[addr + i]);
-			sprintf(extra, "%s0x%02X ", extra, pEfuseHal->fakeEfuseModifiedMap[addr + i]);
+			extra_len += sprintf(extra + extra_len, "0x%02X ", pEfuseHal->fakeEfuseModifiedMap[addr + i]);
 		}
 	} else if (strcmp(tmp[0], "btrfkrmap") == 0) {
 		if ((tmp[1] == NULL) || (tmp[2] == NULL)) {
@@ -9639,9 +9645,10 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 		/*		RTW_INFO("%s: data={", __FUNCTION__); */
 		*extra = 0;
+		extra_len = 0;
 		for (i = 0; i < cnts; i++) {
 			RTW_INFO("wlrfkrmap = 0x%02x\n", pEfuseHal->fakeBTEfuseModifiedMap[addr + i]);
-			sprintf(extra, "%s0x%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[addr + i]);
+			extra_len += sprintf(extra + extra_len, "0x%02X ", pEfuseHal->fakeBTEfuseModifiedMap[addr + i]);
 		}
 	} else
 		sprintf(extra, "Command not found!");
diff --git a/drivers/net/wireless/rockchip_wlan/rtl8822be/os_dep/linux/ioctl_mp.c b/drivers/net/wireless/rockchip_wlan/rtl8822be/os_dep/linux/ioctl_mp.c
index ce3484d36fd141..c304e81e0a575a 100644
--- a/drivers/net/wireless/rockchip_wlan/rtl8822be/os_dep/linux/ioctl_mp.c
+++ b/drivers/net/wireless/rockchip_wlan/rtl8822be/os_dep/linux/ioctl_mp.c
@@ -198,7 +198,7 @@ int rtw_mp_read_reg(struct net_device *dev,
 			if (*pnext != '\0') {
 				/*strtout = simple_strtoul(pnext , &ptmp, 16);*/
 				ret = sscanf(pnext, "%x", &strtout);
-				sprintf(extra, "%s %d" , extra , strtout);
+				sprintf(extra + strlen(extra), " %d", strtout);
 			} else
 				break;
 			pch = pnext;
@@ -230,7 +230,7 @@ int rtw_mp_read_reg(struct net_device *dev,
 			pnext++;
 			if (*pnext != '\0') {
 				ret = sscanf(pnext, "%x", &strtout);
-				sprintf(extra, "%s %d" , extra , strtout);
+				sprintf(extra + strlen(extra), " %d", strtout);
 			} else
 				break;
 			pch = pnext;
@@ -341,20 +341,23 @@ int rtw_mp_read_rf(struct net_device *dev,
 	pch = tmp;
 	RTW_INFO("pch=%s", pch);
 
-	while (*pch != '\0') {
-		pnext = strpbrk(pch, " ");
-		if (!pnext)
-			break;
-		pnext++;
-		if (*pnext != '\0') {
-			/*strtou =simple_strtoul(pnext , &ptmp, 16);*/
-			ret = sscanf(pnext, "%x", &strtou);
-			sprintf(extra, "%s %d" , extra , strtou);
-		} else
-			break;
-		pch = pnext;
+	{
+		size_t extra_len = strlen(extra);
+		while (*pch != '\0') {
+			pnext = strpbrk(pch, " ");
+			if (!pnext)
+				break;
+			pnext++;
+			if (*pnext != '\0') {
+				/*strtou =simple_strtoul(pnext , &ptmp, 16);*/
+				ret = sscanf(pnext, "%x", &strtou);
+				extra_len += sprintf(extra + extra_len, " %d", strtou);
+			} else
+				break;
+			pch = pnext;
+		}
+		wrqu->length = extra_len;
 	}
-	wrqu->length = strlen(extra);
 
 	return 0;
 }
@@ -1412,7 +1415,7 @@ int rtw_mp_pretx_proc(PADAPTER padapter, u8 bStartTest, char *extra)
 			pmp_priv->mode = MP_ON;
 			sprintf(extra, "Stop continuous Tx");
 		} else if (pmp_priv->tx.stop == 1) {
-			sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500 count=%u\n", extra, pmp_priv->tx.count);
+			sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500 count=%u\n", pmp_priv->tx.count);
 			pmp_priv->tx.stop = 0;
 			SetPacketTx(padapter);
 		} else
@@ -1420,26 +1423,26 @@ int rtw_mp_pretx_proc(PADAPTER padapter, u8 bStartTest, char *extra)
 		return 0;
 	case MP_SINGLE_TONE_TX:
 		if (bStartTest != 0)
-			sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra);
+			sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.");
 		SetSingleToneTx(padapter, (u8)bStartTest);
 		break;
 	case MP_CONTINUOUS_TX:
 		if (bStartTest != 0)
-			sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra);
+			sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.");
 		SetContinuousTx(padapter, (u8)bStartTest);
 		break;
 	case MP_CARRIER_SUPPRISSION_TX:
 		if (bStartTest != 0) {
 			if (HwRateToMPTRate(pmp_priv->rateidx) <= MPT_RATE_11M)
-				sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra);
+				sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.");
 			else
-				sprintf(extra, "%s\nSpecify carrier suppression but not CCK rate", extra);
+				sprintf(extra + strlen(extra), "\nSpecify carrier suppression but not CCK rate");
 		}
 		SetCarrierSuppressionTx(padapter, (u8)bStartTest);
 		break;
 	case MP_SINGLE_CARRIER_TX:
 		if (bStartTest != 0)
-			sprintf(extra, "%s\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.", extra);
+			sprintf(extra + strlen(extra), "\nStart continuous DA=ffffffffffff len=1500\n infinite=yes.");
 		SetSingleCarrierTx(padapter, (u8)bStartTest);
 		break;
 
@@ -1517,13 +1520,13 @@ int rtw_mp_tx(struct net_device *dev,
 		return 0;
 	} else if (strncmp(extra, "setting", 7) == 0) {
 		_rtw_memset(extra, 0, wrqu->data.length);
-		sprintf(extra, "Current Setting :\n Channel:%d", pmp_priv->channel);
-		sprintf(extra, "%s\n Bandwidth:%d", extra, pmp_priv->bandwidth);
-		sprintf(extra, "%s\n Rate index:%d", extra, pmp_priv->rateidx);
-		sprintf(extra, "%s\n TxPower index:%d", extra, pmp_priv->txpoweridx);
-		sprintf(extra, "%s\n Antenna TxPath:%d", extra, pmp_priv->antenna_tx);
-		sprintf(extra, "%s\n Antenna RxPath:%d", extra, pmp_priv->antenna_rx);
-		sprintf(extra, "%s\n MP Mode:%d", extra, pmp_priv->mode);
+		extra_len = sprintf(extra, "Current Setting :\n Channel:%d", pmp_priv->channel);
+		extra_len += sprintf(extra + extra_len, "\n Bandwidth:%d", pmp_priv->bandwidth);
+		extra_len += sprintf(extra + extra_len, "\n Rate index:%d", pmp_priv->rateidx);
+		extra_len += sprintf(extra + extra_len, "\n TxPower index:%d", pmp_priv->txpoweridx);
+		extra_len += sprintf(extra + extra_len, "\n Antenna TxPath:%d", pmp_priv->antenna_tx);
+		extra_len += sprintf(extra + extra_len, "\n Antenna RxPath:%d", pmp_priv->antenna_rx);
+		extra_len += sprintf(extra + extra_len, "\n MP Mode:%d", pmp_priv->mode);
 		wrqu->data.length = strlen(extra);
 		return 0;
 #ifdef CONFIG_MP_VHT_HW_TX_MODE
@@ -1661,25 +1664,25 @@ int rtw_mp_tx(struct net_device *dev,
 		if (sscanf(extra, "ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d", &channel, &bandwidth, &rate, &txpower, &ant, &txmode) < 6) {
 			RTW_INFO("Invalid format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode);
 			_rtw_memset(extra, 0, wrqu->data.length);
-			sprintf(extra, "\n Please input correct format as bleow:\n");
-			sprintf(extra, "%s\t ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d\n", extra, channel, bandwidth, rate, txpower, ant, txmode);
-			sprintf(extra, "%s\n [ ch : BGN = <1~14> , A or AC = <36~165> ]", extra);
-			sprintf(extra, "%s\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]", extra);
-			sprintf(extra, "%s\n [ rate :	CCK: 1 2 5.5 11M X 2 = < 2 4 11 22 >]", extra);
-			sprintf(extra, "%s\n [		OFDM: 6 9 12 18 24 36 48 54M X 2 = < 12 18 24 36 48 72 96 108>", extra);
-			sprintf(extra, "%s\n [		HT 1S2SS MCS0 ~ MCS15 : < [MCS0]=128 ~ [MCS7]=135 ~ [MCS15]=143 >", extra);
-			sprintf(extra, "%s\n [		HT 3SS MCS16 ~ MCS32 : < [MCS16]=144 ~ [MCS23]=151 ~ [MCS32]=159 >", extra);
-			sprintf(extra, "%s\n [		VHT 1SS MCS0 ~ MCS9 : < [MCS0]=160 ~ [MCS9]=169 >", extra);
-			sprintf(extra, "%s\n [ txpower : 1~63 power index", extra);
-			sprintf(extra, "%s\n [ ant : <A = 1, B = 2, C = 4, D = 8> ,2T ex: AB=3 BC=6 CD=12", extra);
-			sprintf(extra, "%s\n [ txmode : < 0 = CONTINUOUS_TX, 1 = PACKET_TX, 2 = SINGLE_TONE_TX, 3 = CARRIER_SUPPRISSION_TX, 4 = SINGLE_CARRIER_TX>\n", extra);
+			extra_len = sprintf(extra, "\n Please input correct format as bleow:\n");
+			extra_len += sprintf(extra + extra_len, "\t ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d\n", channel, bandwidth, rate, txpower, ant, txmode);
+			extra_len += sprintf(extra + extra_len, "\n [ ch : BGN = <1~14> , A or AC = <36~165> ]");
+			extra_len += sprintf(extra + extra_len, "\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]");
+			extra_len += sprintf(extra + extra_len, "\n [ rate :	CCK: 1 2 5.5 11M X 2 = < 2 4 11 22 >]");
+			extra_len += sprintf(extra + extra_len, "\n [		OFDM: 6 9 12 18 24 36 48 54M X 2 = < 12 18 24 36 48 72 96 108>");
+			extra_len += sprintf(extra + extra_len, "\n [		HT 1S2SS MCS0 ~ MCS15 : < [MCS0]=128 ~ [MCS7]=135 ~ [MCS15]=143 >");
+			extra_len += sprintf(extra + extra_len, "\n [		HT 3SS MCS16 ~ MCS32 : < [MCS16]=144 ~ [MCS23]=151 ~ [MCS32]=159 >");
+			extra_len += sprintf(extra + extra_len, "\n [		VHT 1SS MCS0 ~ MCS9 : < [MCS0]=160 ~ [MCS9]=169 >");
+			extra_len += sprintf(extra + extra_len, "\n [ txpower : 1~63 power index");
+			extra_len += sprintf(extra + extra_len, "\n [ ant : <A = 1, B = 2, C = 4, D = 8> ,2T ex: AB=3 BC=6 CD=12");
+			extra_len += sprintf(extra + extra_len, "\n [ txmode : < 0 = CONTINUOUS_TX, 1 = PACKET_TX, 2 = SINGLE_TONE_TX, 3 = CARRIER_SUPPRISSION_TX, 4 = SINGLE_CARRIER_TX>\n");
 			wrqu->data.length = strlen(extra);
 			return status;
 
 		} else {
 			RTW_INFO("Got format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode);
 			_rtw_memset(extra, 0, wrqu->data.length);
-			sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
+			extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
 			padapter->mppriv.channel = channel;
 			SetChannel(padapter);
 			pHalData->CurrentChannel = channel;
@@ -1688,13 +1691,13 @@ int rtw_mp_tx(struct net_device *dev,
 				bandwidth = CHANNEL_WIDTH_40;
 			else if (bandwidth == 2)
 				bandwidth = CHANNEL_WIDTH_80;
-			sprintf(extra, "%s\nChange Current Bandwidth %d to Bandwidth %d", extra, padapter->mppriv.bandwidth , bandwidth);
+			extra_len += sprintf(extra + extra_len, "\nChange Current Bandwidth %d to Bandwidth %d", padapter->mppriv.bandwidth , bandwidth);
 			padapter->mppriv.bandwidth = (u8)bandwidth;
 			padapter->mppriv.preamble = sg;
 			SetBandwidth(padapter);
 			pHalData->CurrentChannelBW = bandwidth;
 
-			sprintf(extra, "%s\nSet power level :%d", extra, txpower);
+			extra_len += sprintf(extra + extra_len, "\nSet power level :%d", txpower);
 			padapter->mppriv.txpoweridx = (u8)txpower;
 			pMptCtx->TxPwrLevel[ODM_RF_PATH_A] = (u8)txpower;
 			pMptCtx->TxPwrLevel[ODM_RF_PATH_B] = (u8)txpower;
@@ -1717,13 +1720,13 @@ int rtw_mp_tx(struct net_device *dev,
 			RTW_INFO("%s: rate index=%d\n", __func__, rate);
 			if (rate >= MPT_RATE_LAST)
 				return -EINVAL;
-			sprintf(extra, "%s\nSet data rate to %d index %d", extra, padapter->mppriv.rateidx, rate);
+			extra_len += sprintf(extra + extra_len, "\nSet data rate to %d index %d", padapter->mppriv.rateidx, rate);
 
 			padapter->mppriv.rateidx = rate;
 			pMptCtx->MptRateIndex = rate;
 			SetDataRate(padapter);
 
-			sprintf(extra, "%s\nSet Antenna Path :%d",  extra, ant);
+			extra_len += sprintf(extra + extra_len, "\nSet Antenna Path :%d", ant);
 			switch (ant) {
 			case 1:
 				antenna = ANTENNA_A;
@@ -1800,6 +1803,7 @@ int rtw_mp_rx(struct net_device *dev,
 	      struct iw_request_info *info,
 	      union iwreq_data *wrqu, char *extra)
 {
+	size_t extra_len;
 	PADAPTER padapter = rtw_netdev_priv(dev);
 	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(padapter);
 	struct mp_priv *pmp_priv = &padapter->mppriv;
@@ -1831,19 +1835,19 @@ int rtw_mp_rx(struct net_device *dev,
 	} else if (sscanf(extra, "ch=%d,bw=%d,ant=%d", &channel, &bandwidth, &ant) < 3) {
 		RTW_INFO("Invalid format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant);
 		_rtw_memset(extra, 0, wrqu->data.length);
-		sprintf(extra, "\n Please input correct format as bleow:\n");
-		sprintf(extra, "%s\t ch=%d,bw=%d,ant=%d\n", extra, channel, bandwidth, ant);
-		sprintf(extra, "%s\n [ ch : BGN = <1~14> , A or AC = <36~165> ]", extra);
-		sprintf(extra, "%s\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]", extra);
-		sprintf(extra, "%s\n [ ant : <A = 1, B = 2, C = 4, D = 8> ,2T ex: AB=3 BC=6 CD=12", extra);
-		wrqu->data.length = strlen(extra);
+		extra_len = sprintf(extra, "\n Please input correct format as bleow:\n");
+		extra_len += sprintf(extra + extra_len, "\t ch=%d,bw=%d,ant=%d\n", channel, bandwidth, ant);
+		extra_len += sprintf(extra + extra_len, "\n [ ch : BGN = <1~14> , A or AC = <36~165> ]");
+		extra_len += sprintf(extra + extra_len, "\n [ bw : Bandwidth: 0 = 20M, 1 = 40M, 2 = 80M ]");
+		extra_len += sprintf(extra + extra_len, "\n [ ant : <A = 1, B = 2, C = 4, D = 8> ,2T ex: AB=3 BC=6 CD=12");
+		wrqu->data.length = extra_len;
 		return 0;
 
 	} else {
 		bStartRx = 1;
 		RTW_INFO("Got format [ch=%d,bw=%d,ant=%d]\n", channel, bandwidth, ant);
 		_rtw_memset(extra, 0, wrqu->data.length);
-		sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
+		extra_len = sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
 		padapter->mppriv.channel = channel;
 		SetChannel(padapter);
 		pHalData->CurrentChannel = channel;
@@ -1852,13 +1856,13 @@ int rtw_mp_rx(struct net_device *dev,
 			bandwidth = CHANNEL_WIDTH_40;
 		else if (bandwidth == 2)
 			bandwidth = CHANNEL_WIDTH_80;
-		sprintf(extra, "%s\nChange Current Bandwidth %d to Bandwidth %d", extra, padapter->mppriv.bandwidth , bandwidth);
+		extra_len += sprintf(extra + extra_len, "\nChange Current Bandwidth %d to Bandwidth %d", padapter->mppriv.bandwidth , bandwidth);
 		padapter->mppriv.bandwidth = (u8)bandwidth;
 		padapter->mppriv.preamble = sg;
 		SetBandwidth(padapter);
 		pHalData->CurrentChannelBW = bandwidth;
 
-		sprintf(extra, "%s\nSet Antenna Path :%d",  extra, ant);
+		extra_len += sprintf(extra + extra_len, "\nSet Antenna Path :%d", ant);
 		switch (ant) {
 		case 1:
 			antenna = ANTENNA_A;
@@ -1909,7 +1913,7 @@ int rtw_mp_rx(struct net_device *dev,
 		pHalData->AntennaTxPath = antenna;
 		SetAntenna(padapter);
 
-		sprintf(extra, "%s\nstart Rx", extra);
+		extra_len += sprintf(extra + extra_len, "\nstart Rx");
 		SetPacketRx(padapter, bStartRx, _FALSE);
 	}
 	wrqu->data.length = strlen(extra);
@@ -1951,6 +1955,7 @@ int rtw_efuse_mask_file(struct net_device *dev,
 	char *rtw_efuse_mask_file_path;
 	u8 Status;
 	PADAPTER padapter = rtw_netdev_priv(dev);
+	size_t extra_len;
 
 	_rtw_memset(maskfileBuffer, 0x00, sizeof(maskfileBuffer));
 
@@ -2339,16 +2344,17 @@ int rtw_mp_SetBT(struct net_device *dev,
 	mptbt_BtControlProcess(padapter, &BtReq);
 
 	if (readtherm == 0) {
-		sprintf(extra, "BT thermal=");
+		size_t extra_len = sprintf(extra, "BT thermal=");
 		for (i = 4; i < pMptCtx->mptOutLen; i++) {
 			if ((pMptCtx->mptOutBuf[i] == 0x00) && (pMptCtx->mptOutBuf[i + 1] == 0x00))
 				goto exit;
 
-			sprintf(extra, "%s %d ", extra, (pMptCtx->mptOutBuf[i] & 0x1f));
+			extra_len += sprintf(extra + extra_len, " %d ", (pMptCtx->mptOutBuf[i] & 0x1f));
 		}
 	} else {
+		size_t extra_len = strlen(extra);
 		for (i = 4; i < pMptCtx->mptOutLen; i++)
-			sprintf(extra, "%s 0x%x ", extra, pMptCtx->mptOutBuf[i]);
+			extra_len += sprintf(extra + extra_len, " 0x%x ", pMptCtx->mptOutBuf[i]);
 	}
 
 exit:
diff --git a/drivers/net/wireless/rtl8192cu/core/rtw_mp.c b/drivers/net/wireless/rtl8192cu/core/rtw_mp.c
index 9af42cdc980a89..73be688b5fede9 100755
--- a/drivers/net/wireless/rtl8192cu/core/rtw_mp.c
+++ b/drivers/net/wireless/rtl8192cu/core/rtw_mp.c
@@ -1276,7 +1276,7 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data)
 {
 	u32 i, psd_pts=0, psd_start=0, psd_stop=0;
 	u32 psd_data=0;
-	
+	size_t data_len = 0;	
 #ifdef PLATFORM_LINUX
 	if (!netif_running(pAdapter->pnetdev)) {
 		RT_TRACE(_module_mp_, _drv_warning_, ("mp_query_psd: Fail! interface not opened!\n"));
@@ -1307,7 +1307,7 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data)
 		} else {
 			psd_data = GetPSDData(pAdapter, i);
 		}
-		sprintf(data, "%s%x ", data, psd_data);
+		data_len += sprintf(data + data_len, "%x ", psd_data);
 		i++;
 	}
 
diff --git a/drivers/net/wireless/rtl8192cu/os_dep/linux/ioctl_linux.c b/drivers/net/wireless/rtl8192cu/os_dep/linux/ioctl_linux.c
index 9adbeaf16cf859..3e067fe7422c27 100755
--- a/drivers/net/wireless/rtl8192cu/os_dep/linux/ioctl_linux.c
+++ b/drivers/net/wireless/rtl8192cu/os_dep/linux/ioctl_linux.c
@@ -8668,6 +8668,7 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 	u16 mapLen=0;
 	char *pch, *ptmp, *token, *tmp[3]={0x00,0x00,0x00};
 	u16 addr = 0, cnts = 0, max_available_size = 0,raw_cursize = 0 ,raw_maxsize = 0;
+	size_t extra_len;
 	
 	_rtw_memset(data, '\0', sizeof(data));
 	_rtw_memset(rawdata, '\0', sizeof(rawdata));
@@ -8701,27 +8702,27 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		} 
 		_rtw_memset(extra, '\0', sizeof(extra));
 		DBG_871X("\tOFFSET\tVALUE(hex)\n");
-		sprintf(extra, "%s \n", extra);
+		extra_len = sprintf(extra, " \n");
 		for ( i = 0; i < EFUSE_MAP_SIZE; i += 16 )
 		{
 			DBG_871X("\t0x%02x\t", i);
-			sprintf(extra, "%s \t0x%02x\t", extra,i);
+			extra_len += sprintf(extra + extra_len, " \t0x%02x\t",i);
 			for (j = 0; j < 8; j++)
 			{	  
 				DBG_871X("%02X ", data[i+j]);
-				sprintf(extra, "%s %02X", extra, data[i+j]);
+				extra_len += sprintf(extra + extra_len, " %02X", data[i+j]);
 			}
 			DBG_871X("\t");
-			sprintf(extra,"%s\t",extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j < 16; j++){
 				DBG_871X("%02X ", data[i+j]);
-				sprintf(extra, "%s %02X", extra, data[i+j]);
+				extra_len += sprintf(extra + extra_len, " %02X", data[i+j]);
 			}
 			DBG_871X("\n");
-			sprintf(extra,"%s\n",extra);	
+			extra_len += sprintf(extra + extra_len, "\n");	
 		}
 		DBG_871X("\n");
-		wrqu->length = strlen(extra);
+		wrqu->length = extra_len;
 	
 		return 0;
 	}
@@ -8753,14 +8754,15 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		}	
 
 		_rtw_memset(extra, '\0', sizeof(extra));	 
+		extra_len = 0;
 		for ( i = 0; i < cnts; i ++) {
 			DBG_871X("0x%02x", data[i]);
-			sprintf(extra, "%s 0x%02X", extra, data[i]);
+			extra_len += sprintf(extra + extra_len, " 0x%02X", data[i]);
 			DBG_871X(" ");
-			sprintf(extra,"%s ",extra);
+			extra_len += sprintf(extra + extra_len, " ");
 		}
 
-		wrqu->length = strlen(extra)+1;
+		wrqu->length = extra_len;
 
 		DBG_871X("extra = %s ", extra);
 
@@ -8780,20 +8782,21 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		}
 				
 		_rtw_memset(extra, '\0', sizeof(extra));
+		extra_len = 0;
 		for ( i=0; i<mapLen; i++ ) {
 			DBG_871X(" %02x", rawdata[i]);
-			sprintf(extra, "%s %02x", extra, rawdata[i] );
+			extra_len += sprintf(extra + extra_len, " %02x", rawdata[i] );
 
 			if ((i & 0xF) == 0xF){ 
 				DBG_871X("\n\t");
-				sprintf(extra, "%s\n\t", extra);
+				extra_len += sprintf(extra + extra_len, "\n\t");
 			}
 			else if ((i & 0x7) == 0x7){ 
 				DBG_871X("\t");
-				sprintf(extra, "%s\t", extra);
+				extra_len += sprintf(extra + extra_len, "\t");
 			}
 		}
-		wrqu->length = strlen(extra);
+		wrqu->length = extra_len;
 		return 0;
 	}
 	else if ( strcmp(tmp[0],"mac") == 0 ) {
@@ -8819,13 +8822,14 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 			DBG_871X("rtw_efuse_access ok \n");
 		}	
 		_rtw_memset(extra, '\0', sizeof(extra));		 
+		extra_len = 0;
 		for ( i = 0; i < cnts; i ++) {
 			DBG_871X("0x%02x", data[i]);
-			sprintf(extra, "%s 0x%02X", extra, data[i+j]);
+			extra_len += sprintf(extra + extra_len, " 0x%02X", data[i+j]);
 			DBG_871X(" ");
-			sprintf(extra,"%s ",extra);
+			extra_len += sprintf(extra + extra_len, " ");
 		}
-		wrqu->length = strlen(extra);
+		wrqu->length = extra_len;
 		return 0;
 	}
 	else if ( strcmp(tmp[0],"vidpid") == 0 ) {
@@ -8850,26 +8854,29 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 			DBG_871X("rtw_efuse_access ok \n");
 		}	
 		_rtw_memset(extra, '\0', sizeof(extra));		 
+		extra_len = 0;
 		for ( i = 0; i < cnts; i ++) {
 			DBG_871X("0x%02x", data[i]);
-			sprintf(extra, "%s 0x%02X", extra, data[i+j]);
+			extra_len += sprintf(extra + extra_len, " 0x%02X", data[i+j]);
 			DBG_871X(" ");
-			sprintf(extra,"%s ",extra);
+			extra_len += sprintf(extra + extra_len, " ");
 		}
-		wrqu->length = strlen(extra);
+		wrqu->length = extra_len;
 		return 0;
 	}
 	else if ( strcmp(tmp[0],"ableraw") == 0 ) {
 		efuse_GetCurrentSize(padapter,&raw_cursize);
 		raw_maxsize = efuse_GetMaxSize(padapter);
-		sprintf(extra, "%s : [ available raw size] = %d",extra,raw_maxsize-raw_cursize);
-		wrqu->length = strlen(extra);
+		extra_len = strlen(extra);
+		extra_len += sprintf(extra + extra_len, " : [ available raw size] = %d",raw_maxsize-raw_cursize);
+		wrqu->length = extra_len;
 
 		return 0;
 	}else
 	{
-		 sprintf(extra, "%s : Command not found\n",extra);
-		  wrqu->length = strlen(extra);
+		extra_len = strlen(extra);
+		 extra_len += sprintf(extra + extra_len, " : Command not found\n");
+		  wrqu->length = extra_len;
 		  return 0;
 	}
 	
@@ -9140,6 +9147,7 @@ static int rtw_mp_read_reg(struct net_device *dev,
 	//u32 *data = (u32*)extra;
 	u32 ret, i=0, j=0, strtout=0;
 	PADAPTER padapter = rtw_netdev_priv(dev);
+	size_t extra_len;
 
 	if (wrqu->length > 128) return -EFAULT;
 
@@ -9190,6 +9198,7 @@ static int rtw_mp_read_reg(struct net_device *dev,
 				pch = tmp;		
 				DBG_871X("pch=%s",pch);
 				
+				extra_len = strlen(extra);
 				while( *pch != '\0' )
 				{
 					pnext = strpbrk(pch, " ");
@@ -9197,7 +9206,7 @@ static int rtw_mp_read_reg(struct net_device *dev,
 					if ( *pnext != '\0' )
 					{
 						  strtout = simple_strtoul (pnext , &ptmp, 16);
-						  sprintf( extra, "%s %d" ,extra ,strtout );
+						  extra_len += sprintf( extra + extra_len, " %d", strtout );
 					}
 					else{
 						  break;
@@ -9224,6 +9233,7 @@ static int rtw_mp_read_reg(struct net_device *dev,
 				pch = tmp;		
 				DBG_871X("pch=%s",pch);
 				
+				extra_len = strlen(extra);
 				while( *pch != '\0' )
 				{
 					pnext = strpbrk(pch, " ");
@@ -9231,7 +9241,7 @@ static int rtw_mp_read_reg(struct net_device *dev,
 					if ( *pnext != '\0' )
 					{
 						  strtout = simple_strtoul (pnext , &ptmp, 16);
-						  sprintf( extra, "%s %d" ,extra ,strtout );
+						  extra_len += sprintf( extra + extra_len, " %d", strtout );
 					}
 					else{
 			break;
@@ -9304,6 +9314,7 @@ static int rtw_mp_read_rf(struct net_device *dev,
 	u32 path, addr;
 	u32 ret,i=0 ,j=0,strtou=0;
 	PADAPTER padapter = rtw_netdev_priv(dev);
+	size_t extra_len = 0;
 
 
 	if (wrqu->length > 128) return -EFAULT;
@@ -9341,14 +9352,14 @@ static int rtw_mp_read_rf(struct net_device *dev,
 					if ( *pnext != '\0' )
 					{
 						  strtou = simple_strtoul (pnext , &ptmp, 16);
-						  sprintf( extra, "%s %d" ,extra ,strtou );
+						  extra_len += sprintf( extra + extra_len, " %d", strtou );
 					}
 					else{
 						  break;
 					}
 					pch = pnext;
 				}
-			wrqu->length = strlen(extra);
+			wrqu->length = extra_len;
 
 	return 0;
 }
diff --git a/drivers/net/wireless/rtl8812au/core/rtw_mp.c b/drivers/net/wireless/rtl8812au/core/rtw_mp.c
index c2e400df1ce57e..9884bb7f8a106e 100644
--- a/drivers/net/wireless/rtl8812au/core/rtw_mp.c
+++ b/drivers/net/wireless/rtl8812au/core/rtw_mp.c
@@ -1840,7 +1840,7 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data)
 {
 	u32 i, psd_pts=0, psd_start=0, psd_stop=0;
 	u32 psd_data=0;
-
+	size_t data_len = 0;
 
 #ifdef PLATFORM_LINUX
 	if (!netif_running(pAdapter->pnetdev)) {
@@ -1871,7 +1871,7 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data)
 		} else {
 			psd_data = rtw_GetPSDData(pAdapter, i);
 		}
-		sprintf(data, "%s%x ", data, psd_data);
+		data_len += sprintf(data + data_len, "%x ", psd_data);
 		i++;
 	}
 
diff --git a/drivers/net/wireless/rtl8812au/os_dep/linux/ioctl_linux.c b/drivers/net/wireless/rtl8812au/os_dep/linux/ioctl_linux.c
index 4eba681b1cb64b..62f472e020f2e6 100644
--- a/drivers/net/wireless/rtl8812au/os_dep/linux/ioctl_linux.c
+++ b/drivers/net/wireless/rtl8812au/os_dep/linux/ioctl_linux.c
@@ -9013,6 +9013,7 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 #ifdef CONFIG_IOL
 	u8 org_fw_iol = padapter->registrypriv.fw_iol;// 0:Disable, 1:enable, 2:by usb speed
 #endif
+	size_t extra_len;
 
 	wrqu = (struct iw_point*)wdata;
 	pwrctrlpriv = adapter_to_pwrctl(padapter);
@@ -9065,22 +9066,22 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 	} else if (strcmp(tmp[0], "drvmap") == 0) {
 		mapLen = EFUSE_MAP_SIZE;
 
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < EFUSE_MAP_SIZE; i += 16) {
 //			DBG_871X("0x%02x\t", i);
-			sprintf(extra, "%s0x%02x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%02x\t", i);
 			for (j=0; j<8; j++) {
 //				DBG_871X("%02X ", data[i+j]);
-				sprintf(extra, "%s%02X ", extra, PROMContent[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", PROMContent[i+j]);
 			}
 //			DBG_871X("\t");
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j<16; j++) {
 //				DBG_871X("%02X ", data[i+j]);
-				sprintf(extra, "%s%02X ", extra, PROMContent[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", PROMContent[i+j]);
 			}
 //			DBG_871X("\n");
-			sprintf(extra,"%s\n",extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 //		DBG_871X("\n");
 	} else if (strcmp(tmp[0], "realmap") == 0) {
@@ -9092,22 +9093,22 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		}
 
 //		DBG_871X("OFFSET\tVALUE(hex)\n");
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i = 0; i < EFUSE_MAP_SIZE; i += 16) {
 //			DBG_871X("0x%02x\t", i);
-			sprintf(extra, "%s0x%02x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%02x\t", i);
 			for (j=0; j<8; j++) {
 //				DBG_871X("%02X ", data[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeEfuseInitMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeEfuseInitMap[i+j]);
 			}
 //			DBG_871X("\t");
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j<16; j++) {
 //				DBG_871X("%02X ", data[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeEfuseInitMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeEfuseInitMap[i+j]);
 			}
 //			DBG_871X("\n");
-			sprintf(extra,"%s\n",extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 //		DBG_871X("\n");
 	} else if (strcmp(tmp[0], "rmap") == 0) {
@@ -9144,9 +9145,10 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 //		DBG_871X("%s: data={", __FUNCTION__);
 		*extra = 0;
+		extra_len = 0;
 		for (i=0; i<cnts; i++) {
 //			DBG_871X("0x%02x ", data[i]);
-			sprintf(extra, "%s0x%02X ", extra, data[i]);
+			extra_len += sprintf(extra + extra_len, "0x%02X ", data[i]);
 		}
 //		DBG_871X("}\n");
 	} else if (strcmp(tmp[0], "realraw") == 0) {
@@ -9159,20 +9161,20 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		}
 		_rtw_memset(extra,'\0',strlen(extra));
 		//		DBG_871X("%s: realraw={\n", __FUNCTION__);
-		sprintf(extra, "\n0x00\t");
+		extra_len = sprintf(extra, "\n0x00\t");
 		for (i=0; i< mapLen; i++) {
 			//			DBG_871X("%02X", rawdata[i]);
-			sprintf(extra, "%s%02X", extra, rawdata[i]);
+			extra_len += sprintf(extra + extra_len, "%02X", rawdata[i]);
 			if ((i & 0xF) == 0xF) {
 				//				DBG_871X("\n");
-				sprintf(extra, "%s\n", extra);
-				sprintf(extra, "%s0x%02x\t", extra, i+1);
+				extra_len += sprintf(extra + extra_len, "\n");
+				extra_len += sprintf(extra + extra_len, "0x%02x\t", i+1);
 			} else if ((i & 0x7) == 0x7) {
 				//				DBG_871X("\t");
-				sprintf(extra, "%s \t", extra);
+				extra_len += sprintf(extra + extra_len, " \t");
 			} else {
 				//				DBG_871X(" ");
-				sprintf(extra, "%s ", extra);
+				extra_len += sprintf(extra + extra_len, " ");
 			}
 		}
 		//		DBG_871X("}\n");
@@ -9255,12 +9257,13 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 //		DBG_871X("%s: MAC address={", __FUNCTION__);
 		*extra = 0;
+		extra_len = 0;
 		for (i=0; i<cnts; i++) {
 //			DBG_871X("%02X", data[i]);
-			sprintf(extra, "%s%02X", extra, data[i]);
+			extra_len += sprintf(extra + extra_len, "%02X", data[i]);
 			if (i != (cnts-1)) {
 //				DBG_871X(":");
-				sprintf(extra,"%s:",extra);
+				extra_len += sprintf(extra + extra_len, ":");
 			}
 		}
 //		DBG_871X("}\n");
@@ -9316,12 +9319,13 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 //		DBG_871X("%s: {VID,PID}={", __FUNCTION__);
 		*extra = 0;
+		extra_len = 0;
 		for (i=0; i<cnts; i++) {
 //			DBG_871X("0x%02x", data[i]);
-			sprintf(extra, "%s0x%02X", extra, data[i]);
+			extra_len += sprintf(extra + extra_len, "0x%02X", data[i]);
 			if (i != (cnts-1)) {
 //				DBG_871X(",");
-				sprintf(extra,"%s,",extra);
+				extra_len += sprintf(extra + extra_len, ",");
 			}
 		}
 //		DBG_871X("}\n");
@@ -9341,21 +9345,22 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 //		DBG_871X("OFFSET\tVALUE(hex)\n");
 		sprintf(extra, "\n");
+		extra_len = 0;
 		for (i=0; i<512; i+=16) { // set 512 because the iwpriv's extra size have limit 0x7FF
 //			DBG_871X("0x%03x\t", i);
-			sprintf(extra, "%s0x%03x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%03x\t", i);
 			for (j=0; j<8; j++) {
 //				DBG_871X("%02X ", pEfuseHal->BTEfuseInitMap[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]);
 			}
 //			DBG_871X("\t");
-			sprintf(extra,"%s\t",extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j<16; j++) {
 //				DBG_871X("%02X ", pEfuseHal->BTEfuseInitMap[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]);
 			}
 //			DBG_871X("\n");
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 //		DBG_871X("\n");
 	} else if (strcmp(tmp[0],"btbmap") == 0) {
@@ -9369,22 +9374,22 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		}
 
 //		DBG_871X("OFFSET\tVALUE(hex)\n");
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i=512; i<1024 ; i+=16) {
 //			DBG_871X("0x%03x\t", i);
-			sprintf(extra, "%s0x%03x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%03x\t", i);
 			for (j=0; j<8; j++) {
 //				DBG_871X("%02X ", data[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]);
 			}
 //			DBG_871X("\t");
-			sprintf(extra,"%s\t",extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j<16; j++) {
 //				DBG_871X("%02X ", data[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->BTEfuseInitMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->BTEfuseInitMap[i+j]);
 			}
 //			DBG_871X("\n");
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 //		DBG_871X("\n");
 	} else if (strcmp(tmp[0],"btrmap") == 0) {
@@ -9421,71 +9426,72 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 		}
 
 		*extra = 0;
+		extra_len = 0;
 //		DBG_871X("%s: bt efuse data={", __FUNCTION__);
 		for (i=0; i<cnts; i++) {
 //			DBG_871X("0x%02x ", data[i]);
-			sprintf(extra, "%s 0x%02X ", extra, data[i]);
+			extra_len += sprintf(extra + extra_len, " 0x%02X ", data[i]);
 		}
 //		DBG_871X("}\n");
 		DBG_871X(FUNC_ADPT_FMT ": BT MAC=[%s]\n", FUNC_ADPT_ARG(padapter), extra);
 	} else if (strcmp(tmp[0], "btffake") == 0) {
 //		DBG_871X("OFFSET\tVALUE(hex)\n");
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i=0; i<512; i+=16) {
 //			DBG_871X("0x%03x\t", i);
-			sprintf(extra, "%s0x%03x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%03x\t", i);
 			for (j=0; j<8; j++) {
 //				DBG_871X("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
 			}
 //			DBG_871X("\t");
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j<16; j++) {
 //				DBG_871X("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
 			}
 //			DBG_871X("\n");
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 //		DBG_871X("\n");
 	} else if (strcmp(tmp[0],"btbfake") == 0) {
 //		DBG_871X("OFFSET\tVALUE(hex)\n");
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i=512; i<1024; i+=16) {
 //			DBG_871X("0x%03x\t", i);
-			sprintf(extra, "%s0x%03x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%03x\t", i);
 			for (j=0; j<8; j++) {
 //				DBG_871X("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
 			}
 //			DBG_871X("\t");
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j<16; j++) {
 //				DBG_871X("%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeBTEfuseModifiedMap[i+j]);
 			}
 //			DBG_871X("\n");
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 //		DBG_871X("\n");
 	} else if (strcmp(tmp[0],"wlrfkmap")== 0) {
 //		DBG_871X("OFFSET\tVALUE(hex)\n");
-		sprintf(extra, "\n");
+		extra_len = sprintf(extra, "\n");
 		for (i=0; i<EFUSE_MAP_SIZE; i+=16) {
 //			DBG_871X("\t0x%02x\t", i);
-			sprintf(extra, "%s0x%02x\t", extra, i);
+			extra_len += sprintf(extra + extra_len, "0x%02x\t", i);
 			for (j=0; j<8; j++) {
 //				DBG_871X("%02X ", pEfuseHal->fakeEfuseModifiedMap[i+j]);
-				sprintf(extra, "%s%02X ", extra, pEfuseHal->fakeEfuseModifiedMap[i+j]);
+				extra_len += sprintf(extra + extra_len, "%02X ", pEfuseHal->fakeEfuseModifiedMap[i+j]);
 			}
 //			DBG_871X("\t");
-			sprintf(extra, "%s\t", extra);
+			extra_len += sprintf(extra + extra_len, "\t");
 			for (; j<16; j++) {
 //				DBG_871X("%02X ", pEfuseHal->fakeEfuseModifiedMap[i+j]);
-				sprintf(extra, "%s %02X", extra, pEfuseHal->fakeEfuseModifiedMap[i+j]);
+				extra_len += sprintf(extra + extra_len, " %02X", pEfuseHal->fakeEfuseModifiedMap[i+j]);
 			}
 //			DBG_871X("\n");
-			sprintf(extra, "%s\n", extra);
+			extra_len += sprintf(extra + extra_len, "\n");
 		}
 //		DBG_871X("\n");
 
@@ -9509,9 +9515,10 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 		//		DBG_871X("%s: data={", __FUNCTION__);
 		*extra = 0;
+		extra_len = 0;
 		for (i=0; i<cnts; i++) {
 			DBG_871X("wlrfkrmap = 0x%02x \n", pEfuseHal->fakeEfuseModifiedMap[addr+i]);
-			sprintf(extra, "%s0x%02X ", extra, pEfuseHal->fakeEfuseModifiedMap[addr+i]);
+			extra_len += sprintf(extra + extra_len, "0x%02X ", pEfuseHal->fakeEfuseModifiedMap[addr+i]);
 		}
 	} else if (strcmp(tmp[0],"btrfkrmap")== 0) {
 		if ((tmp[1]==NULL) || (tmp[2]==NULL)) {
@@ -9533,9 +9540,10 @@ static int rtw_mp_efuse_get(struct net_device *dev,
 
 		//		DBG_871X("%s: data={", __FUNCTION__);
 		*extra = 0;
+		extra_len = 0;
 		for (i=0; i<cnts; i++) {
 			DBG_871X("wlrfkrmap = 0x%02x \n", pEfuseHal->fakeBTEfuseModifiedMap[addr+i]);
-			sprintf(extra, "%s0x%02X ", extra, pEfuseHal->fakeBTEfuseModifiedMap[addr+i]);
+			extra_len += sprintf(extra + extra_len, "0x%02X ", pEfuseHal->fakeBTEfuseModifiedMap[addr+i]);
 		}
 	} else {
 		sprintf(extra, "Command not found!");
@@ -10320,6 +10328,7 @@ static int rtw_mp_read_reg(struct net_device *dev,
 	//u32 *data = (u32*)extra;
 	u32 ret, i=0, j=0, strtout=0;
 	PADAPTER padapter = rtw_netdev_priv(dev);
+	size_t extra_len;
 
 
 	if (wrqu->length > 128)
@@ -10370,6 +10379,7 @@ static int rtw_mp_read_reg(struct net_device *dev,
 		pch = tmp;
 		DBG_871X("pch=%s",pch);
 
+		extra_len = strlen(extra);
 		while( *pch != '\0' ) {
 			pnext = strpbrk(pch, " ");
 			if (!pnext)
@@ -10378,7 +10388,7 @@ static int rtw_mp_read_reg(struct net_device *dev,
 			pnext++;
 			if ( *pnext != '\0' ) {
 				strtout = simple_strtoul (pnext , &ptmp, 16);
-				sprintf( extra, "%s %d" ,extra ,strtout );
+				extra_len += sprintf( extra + extra_len, " %d", strtout );
 			} else {
 				break;
 			}
@@ -10404,6 +10414,7 @@ static int rtw_mp_read_reg(struct net_device *dev,
 		pch = tmp;
 		DBG_871X("pch=%s",pch);
 
+		extra_len = strlen(extra);
 		while( *pch != '\0' ) {
 			pnext = strpbrk(pch, " ");
 			if (!pnext)
@@ -10412,7 +10423,7 @@ static int rtw_mp_read_reg(struct net_device *dev,
 			pnext++;
 			if ( *pnext != '\0' ) {
 				strtout = simple_strtoul (pnext , &ptmp, 16);
-				sprintf( extra, "%s %d" ,extra ,strtout );
+				extra_len += sprintf( extra + extra_len, " %d", strtout );
 			} else {
 				break;
 			}
@@ -10490,6 +10501,7 @@ static int rtw_mp_read_rf(struct net_device *dev,
 	u32 path, addr;
 	u32 ret,i=0 ,j=0,strtou=0;
 	PADAPTER padapter = rtw_netdev_priv(dev);
+	size_t extra_len = 0;
 
 
 	if (wrqu->length > 128) return -EFAULT;
@@ -10525,13 +10537,13 @@ static int rtw_mp_read_rf(struct net_device *dev,
 		pnext++;
 		if ( *pnext != '\0' ) {
 			strtou = simple_strtoul (pnext , &ptmp, 16);
-			sprintf( extra, "%s %d" ,extra ,strtou );
+			extra_len += sprintf( extra + extra_len, " %d", strtou );
 		} else {
 			break;
 		}
 		pch = pnext;
 	}
-	wrqu->length = strlen(extra);
+	wrqu->length = extra_len;
 
 	return 0;
 }
@@ -11979,20 +11991,20 @@ static int rtw_mp_SetBT(struct net_device *dev,
 	mptbt_BtControlProcess(padapter, &BtReq);
 
 	if (readtherm == 0) {
-		sprintf(extra, "BT thermal=");
+		extra_len = sprintf(extra, "BT thermal=");
 		for (i=4; i<pMptCtx->mptOutLen; i++) {
 			if ((pMptCtx->mptOutBuf[i]==0x00) && (pMptCtx->mptOutBuf[i+1]==0x00))
 				goto exit;
 
 #ifdef CONFIG_RTL8723A
-			sprintf(extra, "%s %d ", extra, (pMptCtx->mptOutBuf[i]& 0x3f));
+			extra_len += sprintf(extra + extra_len, " %d ", (pMptCtx->mptOutBuf[i]& 0x3f));
 #else
-			sprintf(extra, "%s %d ", extra, (pMptCtx->mptOutBuf[i]& 0x1f));
+			extra_len += sprintf(extra + extra_len, " %d ", (pMptCtx->mptOutBuf[i]& 0x1f));
 #endif
 		}
 	} else {
 		for (i=4; i<pMptCtx->mptOutLen; i++) {
-			sprintf(extra, "%s 0x%x ", extra, pMptCtx->mptOutBuf[i]);
+			extra_len += sprintf(extra + extra_len, " 0x%x ", pMptCtx->mptOutBuf[i]);
 		}
 	}
 
diff --git a/drivers/net/wireless/rtl8821cu/core/rtw_mp.c b/drivers/net/wireless/rtl8821cu/core/rtw_mp.c
index d966fac76f8963..1cc3585750cf7e 100755
--- a/drivers/net/wireless/rtl8821cu/core/rtw_mp.c
+++ b/drivers/net/wireless/rtl8821cu/core/rtw_mp.c
@@ -2423,14 +2423,17 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data)
 
 	data[0] = '\0';
 
-	i = psd_start;
-	while (i < psd_stop) {
-		if (i >= psd_pts)
-			psd_data = rtw_GetPSDData(pAdapter, i - psd_pts);
-		else
-			psd_data = rtw_GetPSDData(pAdapter, i);
-		sprintf(data, "%s%x ", data, psd_data);
-		i++;
+	{
+		size_t extra_len = strlen(data);
+		i = psd_start;
+		while (i < psd_stop) {
+			if (i >= psd_pts)
+				psd_data = rtw_GetPSDData(pAdapter, i - psd_pts);
+			else
+				psd_data = rtw_GetPSDData(pAdapter, i);
+			extra_len += sprintf(data + extra_len, "%x ", psd_data);
+			i++;
+		}
 	}
 
 #ifdef CONFIG_LONG_DELAY_ISSUE
diff --git a/drivers/net/wireless/rtl8821cu/os_dep/linux/ioctl_mp.c b/drivers/net/wireless/rtl8821cu/os_dep/linux/ioctl_mp.c
index ad8df2d4e58027..4408b3402a9f9b 100755
--- a/drivers/net/wireless/rtl8821cu/os_dep/linux/ioctl_mp.c
+++ b/drivers/net/wireless/rtl8821cu/os_dep/linux/ioctl_mp.c
@@ -570,15 +570,15 @@ int rtw_mp_txpower_index(struct net_device *dev,
 		sprintf(extra, "patha=%d", txpower_inx);
 		if (phal_data->rf_type > RF_1T2R) {
 			txpower_inx = mpt_ProQueryCalTxPower(padapter, 1);
-			sprintf(extra, "%s,pathb=%d", extra, txpower_inx);
+			sprintf(extra + strlen(extra), ",pathb=%d", txpower_inx);
 		}
 		if (phal_data->rf_type > RF_2T4R) {
 			txpower_inx = mpt_ProQueryCalTxPower(padapter, 2);
-			sprintf(extra, "%s,pathc=%d", extra, txpower_inx);
+			sprintf(extra + strlen(extra), ",pathc=%d", txpower_inx);
 		}
 		if (phal_data->rf_type > RF_3T4R) {
 			txpower_inx = mpt_ProQueryCalTxPower(padapter, 3);
-			sprintf(extra, "%s,pathd=%d", extra, txpower_inx);
+			sprintf(extra + strlen(extra), ",pathd=%d", txpower_inx);
 		}
 	}
 	wrqu->length = strlen(extra);
@@ -1820,7 +1820,7 @@ int rtw_mp_tx(struct net_device *dev,
 			char *pextra = extra;
 			RTW_INFO("Got format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode);
 			_rtw_memset(extra, 0, wrqu->data.length);
-			sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
+			pextra += sprintf(pextra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
 			padapter->mppriv.channel = channel;
 			SetChannel(padapter);
 			pHalData->current_channel = channel;
@@ -2181,6 +2181,7 @@ int rtw_efuse_mask_file(struct net_device *dev,
 		char	*ptmp, tmp;
 		u8	count = 0;
 		u8	i = 0;
+		size_t extra_len;
 
 		ptmp = extra;
 		pch = strsep(&ptmp, ",");
@@ -2206,13 +2207,15 @@ int rtw_efuse_mask_file(struct net_device *dev,
 
 		 } while (count < 64);
 
-		for (i = 0; i < count; i++)
-			sprintf(extra, "%s:%02x", extra, maskfileBuffer[i]);
+		extra_len = strlen(extra);
+		for (i = 0; i < count; i++) {
+			extra_len += sprintf(extra + extra_len, ":%02x", maskfileBuffer[i]);
+		}
 
 		padapter->registrypriv.bFileMaskEfuse = _TRUE;
 
-		sprintf(extra, "%s\nLoad Efuse Mask data %d hex ok\n", extra, count);
-		wrqu->data.length = strlen(extra);
+		extra_len += sprintf(extra + extra_len, "\nLoad Efuse Mask data %d hex ok\n", count);
+		wrqu->data.length = extra_len;
 		return 0;
 	}
 	rtw_efuse_mask_file_path = extra;
@@ -2634,16 +2637,20 @@ int rtw_mp_SetBT(struct net_device *dev,
 	mptbt_BtControlProcess(padapter, &BtReq);
 
 	if (readtherm == 0) {
+		size_t extra_len;
 		sprintf(extra, "BT thermal=");
+		extra_len = strlen(extra);
 		for (i = 4; i < pMptCtx->mptOutLen; i++) {
 			if ((pMptCtx->mptOutBuf[i] == 0x00) && (pMptCtx->mptOutBuf[i + 1] == 0x00))
 				goto exit;
 
-			sprintf(extra, "%s %d ", extra, (pMptCtx->mptOutBuf[i] & 0x1f));
+			extra_len += sprintf(extra + extra_len, " %d ", (pMptCtx->mptOutBuf[i] & 0x1f));
 		}
 	} else {
+		size_t extra_len;
+		extra_len = strlen(extra);
 		for (i = 4; i < pMptCtx->mptOutLen; i++)
-			sprintf(extra, "%s 0x%x ", extra, pMptCtx->mptOutBuf[i]);
+			extra_len += sprintf(extra + extra_len, " 0x%x ", pMptCtx->mptOutBuf[i]);
 	}
 
 exit:
diff --git a/drivers/net/wireless/rtl88x2bu/core/rtw_mp.c b/drivers/net/wireless/rtl88x2bu/core/rtw_mp.c
index ad9755b4da9120..8272e6533fa4ed 100644
--- a/drivers/net/wireless/rtl88x2bu/core/rtw_mp.c
+++ b/drivers/net/wireless/rtl88x2bu/core/rtw_mp.c
@@ -2123,14 +2123,17 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data)
 
 	data[0] = '\0';
 
-	i = psd_start;
-	while (i < psd_stop) {
-		if (i >= psd_pts)
-			psd_data = rtw_GetPSDData(pAdapter, i - psd_pts);
-		else
-			psd_data = rtw_GetPSDData(pAdapter, i);
-		sprintf(data, "%s%x ", data, psd_data);
-		i++;
+	{
+		size_t extra_len = strlen(data);
+		i = psd_start;
+		while (i < psd_stop) {
+			if (i >= psd_pts)
+				psd_data = rtw_GetPSDData(pAdapter, i - psd_pts);
+			else
+				psd_data = rtw_GetPSDData(pAdapter, i);
+			extra_len += sprintf(data + extra_len, "%x ", psd_data);
+			i++;
+		}
 	}
 
 #ifdef CONFIG_LONG_DELAY_ISSUE
diff --git a/drivers/net/wireless/rtl88x2bu/os_dep/linux/ioctl_mp.c b/drivers/net/wireless/rtl88x2bu/os_dep/linux/ioctl_mp.c
index e82c39f6262c69..0eaed123931731 100644
--- a/drivers/net/wireless/rtl88x2bu/os_dep/linux/ioctl_mp.c
+++ b/drivers/net/wireless/rtl88x2bu/os_dep/linux/ioctl_mp.c
@@ -1795,7 +1795,7 @@ int rtw_mp_tx(struct net_device *dev,
 			char *pextra = extra;
 			RTW_INFO("Got format [ch=%d,bw=%d,rate=%d,pwr=%d,ant=%d,tx=%d]\n", channel, bandwidth, rate, txpower, ant, txmode);
 			_rtw_memset(extra, 0, wrqu->data.length);
-			sprintf(extra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
+			pextra += sprintf(pextra, "Change Current channel %d to channel %d", padapter->mppriv.channel , channel);
 			padapter->mppriv.channel = channel;
 			SetChannel(padapter);
 			pHalData->current_channel = channel;
@@ -2159,6 +2159,7 @@ int rtw_efuse_mask_file(struct net_device *dev,
 		u8	count = 0;
 		u8	i = 0;
 		u32	datalen = 0;
+		size_t extra_len;
 
 		ptmp = extra;
 		pch = strsep(&ptmp, ",");
@@ -2184,12 +2185,13 @@ int rtw_efuse_mask_file(struct net_device *dev,
 
 		 } while (count < 64);
 
+		extra_len = strlen(extra);
 		for (i = 0; i < count; i++)
-			sprintf(extra, "%s:%02x", extra, maskfileBuffer[i]);
+			extra_len += sprintf(extra + extra_len, ":%02x", maskfileBuffer[i]);
 
 		padapter->registrypriv.bFileMaskEfuse = _TRUE;
 
-		sprintf(extra, "%s\nLoad Efuse Mask data %d hex ok\n", extra, count);
+		extra_len += sprintf(extra + extra_len, "\nLoad Efuse Mask data %d hex ok\n", count);
 		wrqu->data.length = strlen(extra);
 		return 0;
 	}
@@ -2612,16 +2614,18 @@ int rtw_mp_SetBT(struct net_device *dev,
 	mptbt_BtControlProcess(padapter, &BtReq);
 
 	if (readtherm == 0) {
+		size_t extra_len;
 		sprintf(extra, "BT thermal=");
 		for (i = 4; i < pMptCtx->mptOutLen; i++) {
 			if ((pMptCtx->mptOutBuf[i] == 0x00) && (pMptCtx->mptOutBuf[i + 1] == 0x00))
 				goto exit;
 
-			sprintf(extra, "%s %d ", extra, (pMptCtx->mptOutBuf[i] & 0x1f));
+			extra_len += sprintf(extra + extra_len, " %d ", (pMptCtx->mptOutBuf[i] & 0x1f));
 		}
 	} else {
+		size_t extra_len;
 		for (i = 4; i < pMptCtx->mptOutLen; i++)
-			sprintf(extra, "%s 0x%x ", extra, pMptCtx->mptOutBuf[i]);
+			extra_len += sprintf(extra + extra_len, " 0x%x ", pMptCtx->mptOutBuf[i]);
 	}
 
 exit:
diff --git a/drivers/net/wireless/ti/wlcore/boot.c b/drivers/net/wireless/ti/wlcore/boot.c
index 19b7ec7b69c21d..fe642b354a84a7 100644
--- a/drivers/net/wireless/ti/wlcore/boot.c
+++ b/drivers/net/wireless/ti/wlcore/boot.c
@@ -87,6 +87,7 @@ static int wlcore_validate_fw_ver(struct wl1271 *wl)
 		wl->min_mr_fw_ver : wl->min_sr_fw_ver;
 	char min_fw_str[32] = "";
 	int i;
+	size_t min_fw_len = 0;
 
 	/* the chip must be exactly equal */
 	if ((min_ver[FW_VER_CHIP] != WLCORE_FW_VER_IGNORE) &&
@@ -121,11 +122,11 @@ static int wlcore_validate_fw_ver(struct wl1271 *wl)
 fail:
 	for (i = 0; i < NUM_FW_VER; i++)
 		if (min_ver[i] == WLCORE_FW_VER_IGNORE)
-			snprintf(min_fw_str, sizeof(min_fw_str),
-				  "%s*.", min_fw_str);
+			min_fw_len += snprintf(min_fw_str + min_fw_len,
+				sizeof(min_fw_str) - min_fw_len, "*.");
 		else
-			snprintf(min_fw_str, sizeof(min_fw_str),
-				  "%s%u.", min_fw_str, min_ver[i]);
+			min_fw_len += snprintf(min_fw_str + min_fw_len,
+				sizeof(min_fw_str) - min_fw_len, "%u.", min_ver[i]);
 
 	wl1271_error("Your WiFi FW version (%u.%u.%u.%u.%u) is invalid.\n"
 		     "Please use at least FW %s\n"
diff --git a/drivers/net/wireless/ti/wlcore/debugfs.h b/drivers/net/wireless/ti/wlcore/debugfs.h
index bf14676e651500..31b4d4a77640e4 100644
--- a/drivers/net/wireless/ti/wlcore/debugfs.h
+++ b/drivers/net/wireless/ti/wlcore/debugfs.h
@@ -96,13 +96,14 @@ static ssize_t sub## _ ##name## _read(struct file *file,		\
 	struct wl1271 *wl = file->private_data;				\
 	struct struct_type *stats = wl->stats.fw_stats;			\
 	char buf[DEBUGFS_FORMAT_BUFFER_SIZE] = "";			\
-	int res, i;							\
+	int i;								\
+	size_t buf_len = 0;						\
 									\
 	wl1271_debugfs_update_stats(wl);				\
 									\
 	for (i = 0; i < len; i++)					\
-		res = snprintf(buf, sizeof(buf), "%s[%d] = %d\n",	\
-			       buf, i, stats->sub.name[i]);		\
+		snprintf(buf + buf_len, sizeof(buf) - buf_len,		\
+			 "[%d] = %d\n", i, stats->sub.name[i]);		\
 									\
 	return wl1271_format_buffer(userbuf, count, ppos, "%s", buf);	\
 }									\
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index ed772311ec1fbe..798f1fac3961a5 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -422,6 +422,16 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
 #define __visible
 #endif
 
+#if defined __has_attribute
+# if __has_attribute (__copy__)
+#  define __copy(symbol)                 __attribute__((__copy__(symbol)))
+# else
+#  define __copy(symbol)
+# endif
+#else
+#  define __copy(symbol)
+#endif
+
 /*
  * Assume alignment of return value.
  */
diff --git a/include/linux/fs.h b/include/linux/fs.h
index c0f76c97359c59..d036da45899f98 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -938,7 +938,7 @@ struct file_handle {
 	__u32 handle_bytes;
 	int handle_type;
 	/* file identifier */
-	unsigned char f_handle[0];
+	unsigned char f_handle[];
 };
 
 static inline struct file *get_file(struct file *f)
diff --git a/include/linux/module.h b/include/linux/module.h
index d79e1e55c1d446..4b29f51443f86d 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -127,13 +127,13 @@ extern void cleanup_module(void);
 #define module_init(initfn)					\
 	static inline initcall_t __maybe_unused __inittest(void)		\
 	{ return initfn; }					\
-	int init_module(void) __attribute__((alias(#initfn)));
+	int init_module(void) __copy(initfn) __attribute__((alias(#initfn)));
 
 /* This is only required if you want to be unloadable. */
 #define module_exit(exitfn)					\
 	static inline exitcall_t __maybe_unused __exittest(void)		\
 	{ return exitfn; }					\
-	void cleanup_module(void) __attribute__((alias(#exitfn)));
+	void cleanup_module(void) __copy(exitfn) __attribute__((alias(#exitfn)));
 
 #endif
 
diff --git a/include/linux/tty.h b/include/linux/tty.h
index bac8e6dc8689c5..f1e422acfda8dc 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -64,7 +64,7 @@ struct tty_buffer {
 	int read;
 	int flags;
 	/* Data points here */
-	unsigned long data[0];
+	unsigned long data[];
 };
 
 /* Values for .flags field of tty_buffer */
diff --git a/include/linux/usb/ehci_def.h b/include/linux/usb/ehci_def.h
index e479033bd78291..311e37cf7bb56d 100644
--- a/include/linux/usb/ehci_def.h
+++ b/include/linux/usb/ehci_def.h
@@ -126,7 +126,8 @@ struct ehci_regs {
 #define FLAG_CF		(1<<0)		/* true: we'll support "high speed" */
 
 	/* PORTSC: offset 0x44 */
-	u32		port_status[0];	/* up to N_PORTS */
+	union {
+		u32		port_status[9];	/* up to N_PORTS */
 /* EHCI 1.1 addendum */
 #define PORTSC_SUSPEND_STS_ACK 0
 #define PORTSC_SUSPEND_STS_NYET 1
@@ -164,7 +165,8 @@ struct ehci_regs {
 #define PORT_CONNECT	(1<<0)		/* device connected */
 #define PORT_RWC_BITS   (PORT_CSC | PORT_PEC | PORT_OCC)
 
-	u32		reserved3[9];
+		u32		reserved3[9];
+	};
 
 	/* USBMODE: offset 0x68 */
 	u32		usbmode;	/* USB Device mode */
@@ -180,11 +182,13 @@ struct ehci_regs {
  * PORTSCx
  */
 	/* HOSTPC: offset 0x84 */
-	u32		hostpc[0];	/* HOSTPC extension */
+	union {
+		u32		hostpc[17];	/* HOSTPC extension */
 #define HOSTPC_PHCD	(1<<22)		/* Phy clock disable */
 #define HOSTPC_PSPD	(3<<25)		/* Port speed detection */
 
-	u32		reserved5[17];
+		u32		reserved5[17];
+	};
 
 	/* USBMODE_EX: offset 0xc8 */
 	u32		usbmode_ex;	/* USB Device mode extension */
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index fde4068eec0b29..c818597b71e690 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -98,7 +98,7 @@ struct nf_conn {
 	possible_net_t ct_net;
 
 	/* all members below initialized via memset */
-	u8 __nfct_init_offset[0];
+	struct { } __nfct_init_offset;
 
 	/* If we were expected by an expectation, this will be it */
 	struct nf_conn *master;
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 5f747089024fa3..3a290456507f6a 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -863,9 +863,9 @@ __nf_conntrack_alloc(struct net *net,
 	/* Don't set timer yet: wait for confirmation */
 	setup_timer(&ct->timeout, death_by_timeout, (unsigned long)ct);
 	write_pnet(&ct->ct_net, net);
-	memset(&ct->__nfct_init_offset[0], 0,
+	memset(&ct->__nfct_init_offset, 0,
 	       offsetof(struct nf_conn, proto) -
-	       offsetof(struct nf_conn, __nfct_init_offset[0]));
+	       offsetof(struct nf_conn, __nfct_init_offset));
 
 	if (zone && nf_ct_zone_add(ct, GFP_ATOMIC, zone) < 0)
 		goto out_free;
diff --git a/tools/lib/api/fs/fs.c b/tools/lib/api/fs/fs.c
index 459599d1b6c410..58f05748dd39ed 100644
--- a/tools/lib/api/fs/fs.c
+++ b/tools/lib/api/fs/fs.c
@@ -179,6 +179,7 @@ static bool fs__env_override(struct fs *fs)
 	size_t name_len = strlen(fs->name);
 	/* name + "_PATH" + '\0' */
 	char upper_name[name_len + 5 + 1];
+
 	memcpy(upper_name, fs->name, name_len);
 	mem_toupper(upper_name, name_len);
 	strcpy(&upper_name[name_len], "_PATH");
@@ -188,7 +189,8 @@ static bool fs__env_override(struct fs *fs)
 		return false;
 
 	fs->found = true;
-	strncpy(fs->path, override_path, sizeof(fs->path));
+	strncpy(fs->path, override_path, sizeof(fs->path) - 1);
+	fs->path[sizeof(fs->path) - 1] = '\0';
 	return true;
 }
 
diff --git a/tools/perf/bench/bench.h b/tools/perf/bench/bench.h
index a50df86f2b9bc1..e758896f499571 100644
--- a/tools/perf/bench/bench.h
+++ b/tools/perf/bench/bench.h
@@ -1,6 +1,10 @@
 #ifndef BENCH_H
 #define BENCH_H
 
+#include <sys/time.h>
+
+extern struct timeval bench__start, bench__end, bench__runtime;
+
 /*
  * The madvise transparent hugepage constants were added in glibc
  * 2.13. For compatibility with older versions of glibc, define these
diff --git a/tools/perf/bench/futex-hash.c b/tools/perf/bench/futex-hash.c
index fc9bebd2cca057..80313b40d32422 100644
--- a/tools/perf/bench/futex-hash.c
+++ b/tools/perf/bench/futex-hash.c
@@ -28,7 +28,7 @@ static unsigned int nfutexes = 1024;
 static bool fshared = false, done = false, silent = false;
 static int futex_flag = 0;
 
-struct timeval start, end, runtime;
+struct timeval bench__start, bench__end, bench__runtime;
 static pthread_mutex_t thread_lock;
 static unsigned int threads_starting;
 static struct stats throughput_stats;
@@ -92,8 +92,8 @@ static void toggle_done(int sig __maybe_unused,
 {
 	/* inform all threads that we're done for the day */
 	done = true;
-	gettimeofday(&end, NULL);
-	timersub(&end, &start, &runtime);
+	gettimeofday(&bench__end, NULL);
+	timersub(&bench__end, &bench__start, &bench__runtime);
 }
 
 static void print_summary(void)
@@ -103,7 +103,7 @@ static void print_summary(void)
 
 	printf("%sAveraged %ld operations/sec (+- %.2f%%), total secs = %d\n",
 	       !silent ? "\n" : "", avg, rel_stddev_stats(stddev, avg),
-	       (int) runtime.tv_sec);
+	       (int) bench__runtime.tv_sec);
 }
 
 int bench_futex_hash(int argc, const char **argv,
@@ -148,7 +148,7 @@ int bench_futex_hash(int argc, const char **argv,
 
 	threads_starting = nthreads;
 	pthread_attr_init(&thread_attr);
-	gettimeofday(&start, NULL);
+	gettimeofday(&bench__start, NULL);
 	for (i = 0; i < nthreads; i++) {
 		worker[i].tid = i;
 		worker[i].futex = calloc(nfutexes, sizeof(*worker[i].futex));
@@ -191,7 +191,7 @@ int bench_futex_hash(int argc, const char **argv,
 	pthread_mutex_destroy(&thread_lock);
 
 	for (i = 0; i < nthreads; i++) {
-		unsigned long t = worker[i].ops/runtime.tv_sec;
+		unsigned long t = worker[i].ops/bench__runtime.tv_sec;
 		update_stats(&throughput_stats, t);
 		if (!silent) {
 			if (nfutexes == 1)
diff --git a/tools/perf/bench/futex-lock-pi.c b/tools/perf/bench/futex-lock-pi.c
index bc6a16adbca8a3..8d0f60456a9594 100644
--- a/tools/perf/bench/futex-lock-pi.c
+++ b/tools/perf/bench/futex-lock-pi.c
@@ -29,7 +29,6 @@ static bool silent = false, multi = false;
 static bool done = false, fshared = false;
 static unsigned int ncpus, nthreads = 0;
 static int futex_flag = 0;
-struct timeval start, end, runtime;
 static pthread_mutex_t thread_lock;
 static unsigned int threads_starting;
 static struct stats throughput_stats;
@@ -56,7 +55,7 @@ static void print_summary(void)
 
 	printf("%sAveraged %ld operations/sec (+- %.2f%%), total secs = %d\n",
 	       !silent ? "\n" : "", avg, rel_stddev_stats(stddev, avg),
-	       (int) runtime.tv_sec);
+	       (int) bench__runtime.tv_sec);
 }
 
 static void toggle_done(int sig __maybe_unused,
@@ -65,8 +64,8 @@ static void toggle_done(int sig __maybe_unused,
 {
 	/* inform all threads that we're done for the day */
 	done = true;
-	gettimeofday(&end, NULL);
-	timersub(&end, &start, &runtime);
+	gettimeofday(&bench__end, NULL);
+	timersub(&bench__end, &bench__start, &bench__runtime);
 }
 
 static void *workerfn(void *arg)
@@ -172,7 +171,7 @@ int bench_futex_lock_pi(int argc, const char **argv,
 
 	threads_starting = nthreads;
 	pthread_attr_init(&thread_attr);
-	gettimeofday(&start, NULL);
+	gettimeofday(&bench__start, NULL);
 
 	create_threads(worker, thread_attr);
 	pthread_attr_destroy(&thread_attr);
@@ -198,7 +197,7 @@ int bench_futex_lock_pi(int argc, const char **argv,
 	pthread_mutex_destroy(&thread_lock);
 
 	for (i = 0; i < nthreads; i++) {
-		unsigned long t = worker[i].ops/runtime.tv_sec;
+		unsigned long t = worker[i].ops/bench__runtime.tv_sec;
 
 		update_stats(&throughput_stats, t);
 		if (!silent)
diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c
index ca93257a6cb7da..ee23fd37f2419e 100644
--- a/tools/perf/util/cs-etm.c
+++ b/tools/perf/util/cs-etm.c
@@ -91,6 +91,9 @@ struct cs_etm_queue {
         bool                    kernel_mapped;
 };
 
+/* RB tree for quick conversion between traceID and metadata pointers */
+static struct intlist *traceid_list;
+
 static int cs_etm__get_trace(struct cs_etm_buffer *buff, struct cs_etm_queue *etmq);
 static int cs_etm__update_queues(struct cs_etm_auxtrace *);
 static int cs_etm__process_queues(struct cs_etm_auxtrace *, u64);
diff --git a/tools/perf/util/cs-etm.h b/tools/perf/util/cs-etm.h
index ec6ff78f1905f7..1f785a92fb205c 100644
--- a/tools/perf/util/cs-etm.h
+++ b/tools/perf/util/cs-etm.h
@@ -65,9 +65,6 @@ enum {
 	CS_ETMV4_PRIV_MAX,
 };
 
-/* RB tree for quick conversion between traceID and CPUs */
-struct intlist *traceid_list;
-
 #define KiB(x) ((x) * 1024)
 #define MiB(x) ((x) * 1024 * 1024)
 
diff --git a/tools/perf/util/srcline.c b/tools/perf/util/srcline.c
index b4db3f48e3b097..2853d4728ab9dd 100644
--- a/tools/perf/util/srcline.c
+++ b/tools/perf/util/srcline.c
@@ -86,16 +86,30 @@ static void find_address_in_section(bfd *abfd, asection *section, void *data)
 	bfd_vma pc, vma;
 	bfd_size_type size;
 	struct a2l_data *a2l = data;
+	flagword flags;
 
 	if (a2l->found)
 		return;
 
-	if ((bfd_get_section_flags(abfd, section) & SEC_ALLOC) == 0)
+#ifdef bfd_get_section_flags
+	flags = bfd_get_section_flags(abfd, section);
+#else
+	flags = bfd_section_flags(section);
+#endif
+	if ((flags & SEC_ALLOC) == 0)
 		return;
 
 	pc = a2l->addr;
+#ifdef bfd_get_section_vma
 	vma = bfd_get_section_vma(abfd, section);
+#else
+	vma = bfd_section_vma(section);
+#endif
+#ifdef bfd_get_section_size
 	size = bfd_get_section_size(section);
+#else
+	size = bfd_section_size(section);
+#endif
 
 	if (pc < vma || pc >= vma + size)
 		return;