diff --git a/core/rtw_mp.c b/core/rtw_mp.c
index c15ce94..aca3e8b 100644
--- a/core/rtw_mp.c
+++ b/core/rtw_mp.c
@@ -2406,7 +2406,7 @@ u32 mp_query_psd(PADAPTER pAdapter, u8 *data)
 			psd_data = rtw_GetPSDData(pAdapter, i - psd_pts);
 		else
 			psd_data = rtw_GetPSDData(pAdapter, i);
-		sprintf(data, "%s%x ", data, psd_data);
+		sprintf(data + strlen(data), "%x ", psd_data);
 		i++;
 	}
 
diff --git a/dkms.conf b/dkms.conf
index 1f2b21a..aa5cb45 100644
--- a/dkms.conf
+++ b/dkms.conf
@@ -1,5 +1,5 @@
 PACKAGE_NAME="realtek-rtl88xxau"
-PACKAGE_VERSION="5.6.4.2~20200313"
+PACKAGE_VERSION="5.6.4.2~20200712"
 CLEAN="'make' clean"
 BUILT_MODULE_NAME[0]=88XXau
 PROCS_NUM=`nproc`
diff --git a/os_dep/linux/ioctl_linux.c b/os_dep/linux/ioctl_linux.c
index 9136d68..d434bf5 100644
--- a/os_dep/linux/ioctl_linux.c
+++ b/os_dep/linux/ioctl_linux.c
@@ -6867,21 +6867,17 @@ static int wpa_supplicant_ioctl(struct net_device *dev, struct iw_point *p)
 
 	/* down(&ieee->wx_sem);	 */
 
-	if (p->length < sizeof(struct ieee_param) || !p->pointer) {
-		ret = -EINVAL;
-		goto out;
-	}
+	if (!p->pointer || p->length != sizeof(struct ieee_param))
+		return -EINVAL;
 
 	param = (struct ieee_param *)rtw_malloc(p->length);
-	if (param == NULL) {
-		ret = -ENOMEM;
-		goto out;
-	}
+
+	if (param == NULL)
+		return -ENOMEM;
 
 	if (copy_from_user(param, p->pointer, p->length)) {
 		rtw_mfree((u8 *)param, p->length);
-		ret = -EFAULT;
-		goto out;
+		return -EFAULT;
 	}
 
 	switch (param->cmd) {
@@ -6915,12 +6911,7 @@ static int wpa_supplicant_ioctl(struct net_device *dev, struct iw_point *p)
 
 	rtw_mfree((u8 *)param, p->length);
 
-out:
-
-	/* up(&ieee->wx_sem); */
-
 	return ret;
-
 }
 
 #ifdef CONFIG_AP_MODE
@@ -7727,32 +7718,21 @@ static int rtw_hostapd_ioctl(struct net_device *dev, struct iw_point *p)
 	* so, we just check hw_init_completed
 	*/
 
-	if (!rtw_is_hw_init_completed(padapter)) {
-		ret = -EPERM;
-		goto out;
-	}
+	if (!rtw_is_hw_init_completed(padapter))
+		return -EPERM;
 
-
-	/* if (p->length < sizeof(struct ieee_param) || !p->pointer){ */
-	if (!p->pointer) {
-		ret = -EINVAL;
-		goto out;
-	}
+	if (!p->pointer || p->length != sizeof(struct ieee_param))
+		return -EINVAL;
 
 	param = (struct ieee_param *)rtw_malloc(p->length);
-	if (param == NULL) {
-		ret = -ENOMEM;
-		goto out;
-	}
+	if (param == NULL)
+		return -ENOMEM;
 
 	if (copy_from_user(param, p->pointer, p->length)) {
 		rtw_mfree((u8 *)param, p->length);
-		ret = -EFAULT;
-		goto out;
+		return -EFAULT;
 	}
 
-	/* RTW_INFO("%s, cmd=%d\n", __FUNCTION__, param->cmd); */
-
 	switch (param->cmd) {
 	case RTL871X_HOSTAPD_FLUSH:
 
@@ -7845,10 +7825,7 @@ static int rtw_hostapd_ioctl(struct net_device *dev, struct iw_point *p)
 
 	rtw_mfree((u8 *)param, p->length);
 
-out:
-
 	return ret;
-
 }
 #endif