On Wed, Jul 29, 2026 at 03:14:58PM -0700, Alexis Savery wrote:
> The LIGHTBAR_CMD_SET_PROGRAM_EX command encapsulates its payload data
> with an 8-bit size field `uint8_t size`. However, the driver currently
> allows the payload chunk to bypass this limit if the EC transport layer
> supports a larger max_request.
> 
> When this occurs, large payloads (e.g., >255 bytes limit) overflow the
> 8-bit size variable when assigning `param->set_program_ex.size`, causing
> truncation and parse failures in the EC firmware.
> 
> This change functionally clamps max_size dynamically against the struct
> maximum (255 bytes).
> 
> Signed-off-by: Alexis Savery <asavery@google.com>

Reviewed-by: Benson Leung <bleung@chromium.org>

> ---
>  drivers/platform/chrome/cros_ec_lightbar.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/platform/chrome/cros_ec_lightbar.c b/drivers/platform/chrome/cros_ec_lightbar.c
> index 02a6c34e68e6..a8df36260419 100644
> --- a/drivers/platform/chrome/cros_ec_lightbar.c
> +++ b/drivers/platform/chrome/cros_ec_lightbar.c
> @@ -496,9 +496,16 @@ static ssize_t program_store(struct device *dev, struct device_attribute *attr,
>  			return -EINVAL;
>  		}
>  	} else {
> +		/*
> +		 * The LIGHTBAR_CMD_SET_PROGRAM_EX payload uses a uint8_t size field.
> +		 * Thus, independent of the transport limits, the maximum payload subset
> +		 * that can be transmitted in a single structure is 255 bytes.
> +		 */
> +		const size_t max_struct_payload = 255;
>  		extra_bytes = offsetof(typeof(*param), set_program_ex) +
>  			sizeof(param->set_program_ex);
> -		max_size = ec->ec_dev->max_request - extra_bytes;
> +		max_size = min((size_t)(ec->ec_dev->max_request - extra_bytes),
> +			       max_struct_payload);
>  	}
>  
>  	msg = alloc_lightbar_cmd_msg(ec);
> -- 
> 2.55.0.508.g3f0d502094-goog
> 
>