All of lore.kernel.org
 help / color / mirror / Atom feed
From: Tzung-Bi Shih <tzungbi@kernel.org>
To: Alexis Savery <asavery@google.com>
Cc: chrome-platform@lists.linux.dev
Subject: Re: [PATCH v4] platform/chrome: lightbar: Limit payload to max packet size
Date: Fri, 31 Jul 2026 02:24:35 +0000	[thread overview]
Message-ID: <amwHY2HCxvdQ6qxR@google.com> (raw)
In-Reply-To: <20260730204240.2227178-1-asavery@google.com>

On Thu, Jul 30, 2026 at 01:42:40PM -0700, Alexis Savery wrote:
> The LIGHTBAR_CMD_SET_PROGRAM_EX command encapsulates its payload data
> with an 8-bit size field `uint8_t size` and is natively capped by the V3
> packet bounds limit array `EC_LPC_HOST_PACKET_SIZE`. However, the driver
> currently allows the payload chunk to bypass this protocol limit if the
> SPI transmission layer negotiates a larger physical `max_request`.
> 
> When this occurs, large payloads (e.g., >255 bytes) integer wrap the
> 8-bit size variable when assigning `param->set_program_ex.size`, causing
> truncation and parse failures downstream in the EC firmware stack.
> 
> [...]

Applied to

    https://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux.git for-next

[1/1] platform/chrome: lightbar: Limit payload to max packet size
      commit: ed1d1f519c56c6c2ffa13f3d52cd77beb023db13

Thanks!

      reply	other threads:[~2026-07-31  2:24 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-07-29 22:14 [PATCH] platform/chrome: lightbar: Enforce 8-bit payload limit Alexis Savery
2026-07-29 23:54 ` Benson Leung
2026-07-30  0:59 ` [PATCH v2] platform/chrome: lightbar: Limit payload size to EC bounding macro Alexis Savery
2026-07-30  0:59 ` [PATCH v3] platform/chrome: lightbar: Limit payload size to EC packet limit Alexis Savery
2026-07-30  3:32   ` Tzung-Bi Shih
2026-07-30 20:42 ` [PATCH v4] platform/chrome: lightbar: Limit payload to max packet size Alexis Savery
2026-07-31  2:24   ` Tzung-Bi Shih [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=amwHY2HCxvdQ6qxR@google.com \
    --to=tzungbi@kernel.org \
    --cc=asavery@google.com \
    --cc=chrome-platform@lists.linux.dev \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.