Re: [PATCH v2] hwmon: occ: validate poll response sensor blocks

[Guenter Roeck]

On Mon, Jul 20, 2026 at 07:58:26PM +0800, Pengpeng Hou wrote:
> The OCC poll response parser walks a counted list of sensor data blocks.
> It used the static backing-array capacity as the parse boundary, but a
> transport response makes only data_length bytes current and valid. A
> truncated response can therefore make the parser consume a block header or
> block extent outside the current response.
> 
> Use data_length as the parent boundary, prove the fixed poll header and
> each current block header before reading them, and prove the complete block
> before advancing. Keep parsed sensor metadata local until the complete
> response has passed validation, then publish it. Propagate
> malformed-response errors before publishing the OCC as active.
> 
> Fixes: aa195fe49b03 ("hwmon (occ): Parse OCC poll response")
> Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>

The issues reported by Sashiko are pre-existing issues worth looking into,
but not as part of this patch.

Applied.

Thanks,
Guenter