On Fri, Mar 17, 2023 at 1:51 PM Linus Torvalds
<torvalds@xxxxxxxxxxxxxxxxxxxx> wrote:
>
> I do think that on the kernel side, the fix is to just change
>
> } while (type++ != SIZE_DEFAULT_FFMT);
>
> to
>
> } while (++type != SIZE_DEFAULT_FFMT);
Ok, I ended up deciding to just commit that minimal change, even
though it might have been better to just make it a normal for-loop
(and use M5MOLS_RESTYPE_MAX instead as the end condition).
So maybe it would be more legible (and less likely to have had that
off-by-one) if the loop had been
for (type = 0; type < M5MOLS_RESTYPE_MAX; type++)
instead. But I'll leave that decision to the driver authors (now cc'd).
For people brought in late, this is now commit efbcbb12ee99 ("media:
m5mols: fix off-by-one loop termination error") with link to the
discussion here
https://lore.kernel.org/linux-block/CAHk-=wgTSdKYbmB1JYM5vmHMcD9J9UZr0mn7BOYM_LudrP+Xvw@xxxxxxxxxxxxxx/
so you can see the history of it (me having initially blamed UBSAN,
but the problem can be triggered at least in theory without it).
Linus
