[PATCH] IOMUX: Fix access past end of console_devices

[Andy Shevchenko]

On Wed, Mar 30, 2022 at 01:25:59PM -0400, Sean Anderson wrote:
> On 3/30/22 1:13 PM, Andy Shevchenko wrote:
> > On Wed, Mar 30, 2022 at 7:49 PM Sean Anderson <seanga2 at gmail.com> wrote:
> > 
> > Also I don't like to have workarounds for the broken tools.
> > But if you still want to have something, what about rather this
> > 
> > >   #define for_each_console_dev(i, file, dev)             \
> > > -       for (i = 0, dev = console_devices[file][i];     \
> > > -            i < cd_count[file];                        \
> > > -            i++, dev = console_devices[file][i])
> > > +       for (i = 0; i < cd_count[file] &&               \
> > > +               (dev = console_devices[file][i]); i++)
> > 
> >         for (i = 0, dev = console_devices[file][0];     \
> >              i < cd_count[file];                        \
> >              i++, dev = console_devices[file][i])
> > 
> > ?
> > 
> > Or if it's still complains
> > 
> >         for (i = 0, dev = cd_count[file] ? console_devices[file][0] : NULL;     \
> >              i < cd_count[file];                        \
> >              i++, dev = console_devices[file][i])
> > 
> > ?
> 
> The problem is not the first assignment but the last. Consider the case when cd_count[file] = 1

Following that logic the first one is also problematic when cd_count[file] == 0.

> i = 0, dev = console_devices[file][0]; // OK
> i < cd_count[file] // 0 < 1
> // loop body
> i++, dev = console_devices[file][1] // Oops, past the end
> i < cd_count[file] // 1 < 1, loop exit

I don't see good solution. :-(

Maybe moving to dev as a loop variable and having NULL terminated arrays
should fix that.

For now probably your solution is a good compromise.
But, please rewrite it to have all three more visible in a for-loop:

	for (i = 0;							\
	     i < cd_count[file] && (dev = console_devices[file][i]);	\
	     i++)

-- 
With Best Regards,
Andy Shevchenko