Re: [PATCH v3] platform/chrome: lightbar: Limit payload size to EC packet limit

[Tzung-Bi Shih <tzungbi@kernel.org>]

On Wed, Jul 29, 2026 at 05:59:56PM -0700, Alexis Savery wrote:
> The LIGHTBAR_CMD_SET_PROGRAM_EX command encapsulates its payload data
> with an 8-bit size field `uint8_t size` and is natively capped by the V3

The u8 size field can't wrap or contain the payload itself.  To be more
technically accurate, please rephrase "encapsulates".

> packet bounds limit array `EC_LPC_HOST_PACKET_SIZE`. However, the driver
> currently allows the payload chunk to bypass this protocol limit if the
> SPI transmission layer negotiates a larger physical `max_request`.

EC_LPC_HOST_PACKET_SIZE is only for LPC.  Protocol SPI uses another value
(e.g., SPI_MAX_REQUEST_SIZE).

> @@ -496,9 +496,14 @@ static ssize_t program_store(struct device *dev, struct device_attribute *attr,
>  			return -EINVAL;
>  		}
>  	} else {
> +		/*
> +		 * The EC limits all version 3 host packets to EC_LPC_HOST_PACKET_SIZE.
> +		 */
>  		extra_bytes = offsetof(typeof(*param), set_program_ex) +
>  			sizeof(param->set_program_ex);
> -		max_size = ec->ec_dev->max_request - extra_bytes;
> +		max_size = min_t(size_t, ec->ec_dev->max_request,
> +				 EC_LPC_HOST_PACKET_SIZE);
> +		max_size -= extra_bytes;

How about:

    max_size = min(ec->ec_dev->max_request - extra_bytes,
                   sizeof(param->set_program_ex.size));