Re: [PATCH 1/2] iio: Fix the sorting functionality in iio_gts_build_avail_time_table

[Matti Vaittinen]

On 4/29/24 09:29, Chenyuan Yang wrote:
> The sorting in iio_gts_build_avail_time_table is not working as intended.
> It could result in an out-of-bounds access when the time is zero.
>
> Here are more details:
>
> 1. When the gts->itime_table[i].time_us is zero, e.g., the time
> sequence is `3, 0, 1`, the inner for-loop will not terminate and do
> out-of-bound writes. This is because once `times[j] > new`, the value
> `new` will be added in the current position and the `times[j]` will be
> moved to `j+1` position, which makes the if-condition always hold.
> Meanwhile, idx will be added one, making the loop keep running without
> termination and out-of-bound write.
> 2. If none of the gts->itime_table[i].time_us is zero, the elements
> will just be copied without being sorted as described in the comment
> "Sort times from all tables to one and remove duplicates".
>
> For more details, please refer to
> https://lore.kernel.org/all/6dd0d822-046c-4dd2-9532-79d7ab96ec05@xxxxxxxxx.
>
> Reported-by: Chenyuan Yang <chenyuan0y@xxxxxxxxx>
> Suggested-by: Matti Vaittinen <mazziesaccount@xxxxxxxxx>
> Fixes: 38416c28e168 ("iio: light: Add gain-time-scale helpers")
> Co-developed-by: Chenyuan Yang <chenyuan0y@xxxxxxxxx>
> Signed-off-by: Chenyuan Yang <chenyuan0y@xxxxxxxxx>
> Co-developed-by: Matti Vaittinen <mazziesaccount@xxxxxxxxx>
> Signed-off-by: Matti Vaittinen <mazziesaccount@xxxxxxxxx> 

Huh. I had never before sent a patch with co-authored tags. Just to 
ensure there is no misunderstandings - I did send this patch mail. I 
added the From: tag as was suggested in:
https://www.kernel.org/doc/html/latest/process/submitting-patches.html

I am afraid mutt picked the email sender from this tag - which does not 
fee like correct thing to do! Sorry! I did not intend to impersonate 
Chenyuan!

Yours,
	-- Matti

--
Matti Vaittinen
Linux kernel developer at ROHM Semiconductors
Oulu Finland

~~ When things go utterly wrong vim users can always type :help! ~~