Re: [PATCH] platform/chrome: lightbar: Enforce 8-bit payload limit

--ykjrXLfY+xYnztqc
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Wed, Jul 29, 2026 at 03:14:58PM -0700, Alexis Savery wrote:
> The LIGHTBAR_CMD_SET_PROGRAM_EX command encapsulates its payload data
> with an 8-bit size field `uint8_t size`. However, the driver currently
> allows the payload chunk to bypass this limit if the EC transport layer
> supports a larger max_request.
>=20
> When this occurs, large payloads (e.g., >255 bytes limit) overflow the
> 8-bit size variable when assigning `param->set_program_ex.size`, causing
> truncation and parse failures in the EC firmware.
>=20
> This change functionally clamps max_size dynamically against the struct
> maximum (255 bytes).
>=20
> Signed-off-by: Alexis Savery <[email protected]>

Reviewed-by: Benson Leung <[email protected]>

> ---
>  drivers/platform/chrome/cros_ec_lightbar.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
>=20
> diff --git a/drivers/platform/chrome/cros_ec_lightbar.c b/drivers/platfor=
m/chrome/cros_ec_lightbar.c
> index 02a6c34e68e6..a8df36260419 100644
> --- a/drivers/platform/chrome/cros_ec_lightbar.c
> +++ b/drivers/platform/chrome/cros_ec_lightbar.c
> @@ -496,9 +496,16 @@ static ssize_t program_store(struct device *dev, str=
uct device_attribute *attr,
>  			return -EINVAL;
>  		}
>  	} else {
> +		/*
> +		 * The LIGHTBAR_CMD_SET_PROGRAM_EX payload uses a uint8_t size field.
> +		 * Thus, independent of the transport limits, the maximum payload subs=
et
> +		 * that can be transmitted in a single structure is 255 bytes.
> +		 */
> +		const size_t max_struct_payload =3D 255;
>  		extra_bytes =3D offsetof(typeof(*param), set_program_ex) +
>  			sizeof(param->set_program_ex);
> -		max_size =3D ec->ec_dev->max_request - extra_bytes;
> +		max_size =3D min((size_t)(ec->ec_dev->max_request - extra_bytes),
> +			       max_struct_payload);
>  	}
> =20
>  	msg =3D alloc_lightbar_cmd_msg(ec);
> --=20
> 2.55.0.508.g3f0d502094-goog
>=20
>=20

--ykjrXLfY+xYnztqc
Content-Type: application/pgp-signature; name=signature.asc

-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQQCtZK6p/AktxXfkOlzbaomhzOwwgUCamqSngAKCRBzbaomhzOw
wsg5AP97OVykK/KLwRFKCvGi7yiOgwe2SYRQxxGFXp673N/qPAD+J0AQVAiu7EKA
cSj88KBSu1qe3FvZ9z2WG1c95NoqWAw=
=9zXQ
-----END PGP SIGNATURE-----

--ykjrXLfY+xYnztqc--