component_dais[RSND_MAX_COMPONENT] is initially zero-initialized and later populated in rsnd_dai_of_node(). However, the existing boundary check: if (i >= RSND_MAX_COMPONENT) does not guarantee that the last valid element remains zero. As a result, the loop can rely on component_dais[RSND_MAX_COMPONENT] being zero, which may lead to an out-of-bounds access. Found by Linux Verification Center (linuxtesting.org) with SVACE.
Unified · Split
| @@ -1974,7 +1974,7 @@ static int rsnd_probe(struct platform_device *pdev) · 1973 unmodified lines | ||
| 1974 | 1974 | * asoc register |
| 1975 | 1975 | */ |
| 1976 | 1976 | ci = 0; |
| 1977 | − for (i = 0; priv->component_dais[i] > 0; i++) { | |
| 1977 | + for (i = 0; i < RSND_MAX_COMPONENT && priv->component_dais[i] > 0; i++) { | |
| 1978 | 1978 | int nr = priv->component_dais[i]; |
| 1979 | 1979 | |
| 1980 | 1980 | ret = devm_snd_soc_register_component(dev, &rsnd_soc_component, |