Re: [PATCH] platform/x86: ibm_rtl: Fix potential OOB read at signature search

["Ilpo Järvinen" <ilpo.jarvinen@linux.intel.com>]

On Tue, 20 Oct 2026, Takashi Iwai wrote:

> The loop for signature search fetches 8 bytes at each check,

But that's not all it's going to access??

> while the
> loop count is calculated in 4 bytes unit, which means that, at the
> last entry, it fetches over the limit.
> 
> Correct the boundary condition to "ebda_size/sizeof(unsigned int)-1"

This seems even more obfuscated than this code already is!

I think it should do this instead:

(ebda_size - sizeof(*rtl_table)) / sizeof(u32)

Admittedly, it a logical change too but why you think only partial RTL 
table is good enough just because signature can be checked? After the sig 
check, it will read the struct beyond that.

...And that other sizeof() should use u32 as well.


Unrelated to this change and if you have this HW and can test changes, it 
would be nice to also get rid of the debug parameter and use dynamic 
debugging instead of RTL_DEBUG() for consistency.

I also don't understand why it's mixing readq() and ioread*() for reading 
from the same area.

> for avoiding the potential OOB access.
> 
> Fixes: 15dd100349b8 ("platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic")
> Signed-off-by: Takashi Iwai <tiwai@suse.de>
> ---
>  drivers/platform/x86/ibm_rtl.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/platform/x86/ibm_rtl.c b/drivers/platform/x86/ibm_rtl.c
> index 139956168cf9..6d6998049d8c 100644
> --- a/drivers/platform/x86/ibm_rtl.c
> +++ b/drivers/platform/x86/ibm_rtl.c
> @@ -271,7 +271,7 @@ static int __init ibm_rtl_init(void) {
>  		return -ENOMEM;
>  
>  	/* search for the _RTL_ signature at the start of the table */
> -	for (i = 0 ; i < ebda_size/sizeof(unsigned int); i++) {
> +	for (i = 0 ; i < ebda_size/sizeof(unsigned int) - 1; i++) {

Also remove that extra space after i = 0.

>  		struct ibm_rtl_table __iomem * tmp;
>  		tmp = (struct ibm_rtl_table __iomem *) (ebda_map + i*sizeof(unsigned int));
>  		if ((readq(&tmp->signature) & RTL_MASK) == RTL_SIGNATURE) {
> 

-- 
 i.