component_dais[RSND_MAX_COMPONENT] is initially zero-initialized and later populated in rsnd_dai_of_node(). However, the existing boundary check: if (i >= RSND_MAX_COMPONENT) does not guarantee that the last valid element remains zero. As a result, the loop can rely on component_dais[RSND_MAX_COMPONENT] being zero, which may lead to an out-of-bounds access. Found by Linux Verification Center (linuxtesting.org) with SVACE.
Unified · Split
| @@ -1974,7 +1974,7 @@ static int rsnd_probe(struct platform_device *pdev) · 1973 unmodified lines | |||
| 1974 | * asoc register | 1974 | * asoc register |
| 1975 | */ | 1975 | */ |
| 1976 | ci = 0; | 1976 | ci = 0; |
| 1977 | for (i = 0; priv->component_dais[i] > 0; i++) { | 1977 | for (i = 0; i < RSND_MAX_COMPONENT && priv->component_dais[i] > 0; i++) { |
| 1978 | int nr = priv->component_dais[i]; | 1978 | int nr = priv->component_dais[i]; |
| 1979 | 1979 | ||
| 1980 | ret = devm_snd_soc_register_component(dev, &rsnd_soc_component, | 1980 | ret = devm_snd_soc_register_component(dev, &rsnd_soc_component, |