Chrome platform driver development
 help / color / mirror / Atom feed
From: Tzung-Bi Shih <tzungbi@kernel.org>
To: Alexis Savery <asavery@google.com>
Cc: chrome-platform@lists.linux.dev
Subject: Re: [PATCH v4] platform/chrome: lightbar: Limit payload to max packet size
Date: Fri, 31 Jul 2026 02:24:35 +0000	[thread overview]
Message-ID: <amwHY2HCxvdQ6qxR@google.com> (raw)
In-Reply-To: <20260730204240.2227178-1-asavery@google.com>

On Thu, Jul 30, 2026 at 01:42:40PM -0700, Alexis Savery wrote:
> The LIGHTBAR_CMD_SET_PROGRAM_EX command encapsulates its payload data
> with an 8-bit size field `uint8_t size` and is natively capped by the V3
> packet bounds limit array `EC_LPC_HOST_PACKET_SIZE`. However, the driver
> currently allows the payload chunk to bypass this protocol limit if the
> SPI transmission layer negotiates a larger physical `max_request`.
> 
> When this occurs, large payloads (e.g., >255 bytes) integer wrap the
> 8-bit size variable when assigning `param->set_program_ex.size`, causing
> truncation and parse failures downstream in the EC firmware stack.
> 
> [...]

Applied to

    https://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux.git for-next

[1/1] platform/chrome: lightbar: Limit payload to max packet size
      commit: ed1d1f519c56c6c2ffa13f3d52cd77beb023db13

Thanks!

      reply	other threads:[~2026-07-31  2:24 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-07-29 22:14 [PATCH] platform/chrome: lightbar: Enforce 8-bit payload limit Alexis Savery
2026-07-29 23:54 ` Benson Leung
2026-07-30  0:59 ` [PATCH v2] platform/chrome: lightbar: Limit payload size to EC bounding macro Alexis Savery
2026-07-30  0:59 ` [PATCH v3] platform/chrome: lightbar: Limit payload size to EC packet limit Alexis Savery
2026-07-30  3:32   ` Tzung-Bi Shih
2026-07-30 20:42 ` [PATCH v4] platform/chrome: lightbar: Limit payload to max packet size Alexis Savery
2026-07-31  2:24   ` Tzung-Bi Shih [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=amwHY2HCxvdQ6qxR@google.com \
    --to=tzungbi@kernel.org \
    --cc=asavery@google.com \
    --cc=chrome-platform@lists.linux.dev \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox