github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 12:44:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

platform/chrome: lightbar: Limit payload to max packet size

Browse Source 
The LIGHTBAR_CMD_SET_PROGRAM command uses an 8-bit size field for its
payload length, but the protocol-negotiated `max_request` may exceed
the maximum value an 8-bit integer can represent.

When this occurs, large payloads (e.g., >255 bytes) integer wrap the
8-bit size variable when assigning `param->set_program_ex.size`, causing
truncation and parse failures downstream in the EC firmware stack.

Clamp `max_size` to the maximum value the structural size field can
support.

Fixes: 9600b8bdbf ("platform/chrome: lightbar: Add support for large sequence")
Signed-off-by: Alexis Savery <asavery@google.com>
Link: https://lore.kernel.org/r/20260730204240.2227178-1-asavery@google.com
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
This commit is contained in:
Alexis Savery 2026-07-30 13:42:40 -07:00 committed by Tzung-Bi Shih
parent e5954d3031
commit ed1d1f519c
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/platform/chrome/cros_ec_lightbar.c
View File

@ -505,9 +505,14 @@ static ssize_t program_store(struct device *dev, struct device_attribute *attr,
return -EINVAL;
}
} else {
/*
* Bound the payload strictly by the maximum value the structural
* size field can natively support.
*/
extra_bytes = offsetof(typeof(*param), set_program_ex) +
sizeof(param->set_program_ex);
max_size = ec->ec_dev->max_request - extra_bytes;
max_size = min_t(size_t, ec->ec_dev->max_request - extra_bytes,
type_max(typeof(param->set_program_ex.size)));
}
msg = alloc_lightbar_cmd_msg(ec);