Re: [PATCH] hwmon: occ: validate poll response sensor blocks

[Guenter Roeck]

On 7/6/26 02:33, Pengpeng Hou wrote:
> The OCC poll response parser walks a counted list of sensor data blocks.
> It used the static response buffer size as the parse boundary, but the
> transport only guarantees the bytes declared by the current response
> length. A malformed or truncated response can therefore make the parser
> read a block header or block payload beyond the current response data.
>
> Use the response data_length as the parent boundary for the poll payload.
> Reject responses that cannot contain the fixed poll header, prove that
> each sensor block header is present before reading its item fields, and
> then prove that the complete block fits before advancing to the next
> block.
>
> Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
> ---
>   drivers/hwmon/occ/common.c | 32 +++++++++++++++++++++++++-------
>   1 file changed, 25 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/hwmon/occ/common.c b/drivers/hwmon/occ/common.c
> index e18e80e832fd..fa92ae6ec4f0 100644
> --- a/drivers/hwmon/occ/common.c
> +++ b/drivers/hwmon/occ/common.c
> @@ -1052,9 +1052,10 @@ static int occ_setup_sensor_attrs(struct occ *occ)
>   }
>   
>   /* only need to do this once at startup, as OCC won't change sensors on us */
> -static void occ_parse_poll_response(struct occ *occ)
> +static int occ_parse_poll_response(struct occ *occ)
>   {
>   	unsigned int i, old_offset, offset = 0, size = 0;
> +	u16 data_length;
>   	struct occ_sensor *sensor;
>   	struct occ_sensors *sensors = &occ->sensors;
>   	struct occ_response *resp = &occ->resp;
> @@ -1063,21 +1064,34 @@ static void occ_parse_poll_response(struct occ *occ)
>   	struct occ_poll_response_header *header = &poll->header;
>   	struct occ_sensor_data_block *block = &poll->block;
>   
> +	data_length = get_unaligned_be16(&resp->data_length);
> +	if (data_length < sizeof(*header) || data_length > OCC_RESP_DATA_BYTES) {
> +		dev_warn(occ->bus_dev, "invalid OCC poll response length %u\n",
> +			 data_length);

The warning messages in this function now result in aborting the registration
and thus need to be converted to dev_err().

Thanks,
Guenter