diff --git a/drivers/misc/vehicle/vehicle_core.c b/drivers/misc/vehicle/vehicle_core.c index 5a800e0f88c4..d973514260ee 100644 --- a/drivers/misc/vehicle/vehicle_core.c +++ b/drivers/misc/vehicle/vehicle_core.c @@ -117,7 +117,9 @@ void vehicle_set_property(u16 prop, u8 index, u32 value, u32 param) { char *buffer; - buffer = kmalloc(128, GFP_KERNEL); + buffer = kmalloc(NLMSG_SIZE, GFP_KERNEL); + if (!buffer) + return; pr_debug("%s: prop %d, index %d, value %d\n", __func__, prop, index, value); property_encode.value = value; switch (prop) { @@ -240,7 +242,7 @@ void vehicle_set_property(u16 prop, u8 index, u32 value, u32 param) pb_ostream_t stream; - stream = pb_ostream_from_buffer(buffer, 128); + stream = pb_ostream_from_buffer(buffer, NLMSG_SIZE); emulator_EmulatorMessage send_message = {}; @@ -272,7 +274,9 @@ static void netlink_rcv_msg(struct sk_buff *skb) int i; emulator_EmulatorMessage emulator_message; - buffer = kmalloc(128, GFP_KERNEL); + buffer = kmalloc(NLMSG_SIZE, GFP_KERNEL); + if (!buffer) + return; if (skb->len >= nlmsg_total_size(0)) { nlh = nlmsg_hdr(skb); g_user_pid = nlh->nlmsg_pid; @@ -281,6 +285,7 @@ static void netlink_rcv_msg(struct sk_buff *skb) if (umsg) { for (i = 0; i < len; i++) pr_debug("%s raw byte %d %d\n", __func__, i, umsg[i]); + len = (len > NLMSG_SIZE) ? NLMSG_SIZE : len; memcpy(buffer, umsg, len); pb_istream_t stream = pb_istream_from_buffer(buffer, len); diff --git a/drivers/misc/vehicle/vehicle_core.h b/drivers/misc/vehicle/vehicle_core.h index 3a586c0ce75a..60d124adad00 100644 --- a/drivers/misc/vehicle/vehicle_core.h +++ b/drivers/misc/vehicle/vehicle_core.h @@ -339,6 +339,8 @@ struct hw_prop_ops { */ #define kMixedTypePropertyForTest 568332561 +#define NLMSG_SIZE 1024 + /*vehicle_event_type: stateType in command VSTATE*/ enum vehicle_event_type { VEHICLE_AC = 0,