Re: [PATCH next] i2c: Fix end of loop test in i2c_atr_find_mapping_by_addr()

[Dan Carpenter <dan.carpenter@linaro.org>]

On Wed, Apr 23, 2025 at 05:25:44PM +0200, Romain Gantois wrote:
> Hello Dan,
> 
> On Wednesday, 23 April 2025 10:21:18 CEST Dan Carpenter wrote:
> > When the list_for_each_entry_reverse() exits without hitting a break
> > then the list cursor points to invalid memory.  So this check for
> > if (c2a->fixed) is checking bogus memory.  Fix it by using a "found"
> > variable to track if we found what we were looking for or not.
> 
> IIUC the for loop ending condition in list_for_each_entry_reverse() is
> "!list_entry_is_head(pos, head, member);", so even if the loop runs to 
> completion, the pointer should still be valid right?
> 

head is &chan->alias_pairs.  pos is an offset off the head.  In this
case, the offset is zero.  So it's &chan->alias_pairs minus zero.

So we exit the list with c2a = (void *)&chan->alias_pairs.

If you look how struct i2c_atr_chan is declareted the next struct member
after alias_pairs is:

	struct i2c_atr_alias_pool *alias_pool;

So if (c2a->fixed) is poking around in the alias_pool pointer.  It's not
out of bounds but it's not valid either.

regards,
dan carpenter