[PATCH] platform/x86: ibm_rtl: Fix potential OOB read at signature search

[PATCH] platform/x86: ibm_rtl: Fix potential OOB read at signature search

[Takashi Iwai]

The loop for signature search fetches 8 bytes at each check, while the
loop count is calculated in 4 bytes unit, which means that, at the
last entry, it fetches over the limit.

Correct the boundary condition to "ebda_size/sizeof(unsigned int)-1"
for avoiding the potential OOB access.

Fixes: 15dd100349b8 ("platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
 drivers/platform/x86/ibm_rtl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/x86/ibm_rtl.c b/drivers/platform/x86/ibm_rtl.c
index 139956168cf9..6d6998049d8c 100644
--- a/drivers/platform/x86/ibm_rtl.c
+++ b/drivers/platform/x86/ibm_rtl.c
@@ -271,7 +271,7 @@ static int __init ibm_rtl_init(void) {
 		return -ENOMEM;
 
 	/* search for the _RTL_ signature at the start of the table */
-	for (i = 0 ; i < ebda_size/sizeof(unsigned int); i++) {
+	for (i = 0 ; i < ebda_size/sizeof(unsigned int) - 1; i++) {
 		struct ibm_rtl_table __iomem * tmp;
 		tmp = (struct ibm_rtl_table __iomem *) (ebda_map + i*sizeof(unsigned int));
 		if ((readq(&tmp->signature) & RTL_MASK) == RTL_SIGNATURE) {
-- 
2.55.0

Re: [PATCH] platform/x86: ibm_rtl: Fix potential OOB read at signature search

[Ilpo Järvinen]

On Tue, 20 Oct 2026, Takashi Iwai wrote:

> The loop for signature search fetches 8 bytes at each check,

But that's not all it's going to access??

> while the
> loop count is calculated in 4 bytes unit, which means that, at the
> last entry, it fetches over the limit.
> 
> Correct the boundary condition to "ebda_size/sizeof(unsigned int)-1"

This seems even more obfuscated than this code already is!

I think it should do this instead:

(ebda_size - sizeof(*rtl_table)) / sizeof(u32)

Admittedly, it a logical change too but why you think only partial RTL 
table is good enough just because signature can be checked? After the sig 
check, it will read the struct beyond that.

...And that other sizeof() should use u32 as well.


Unrelated to this change and if you have this HW and can test changes, it 
would be nice to also get rid of the debug parameter and use dynamic 
debugging instead of RTL_DEBUG() for consistency.

I also don't understand why it's mixing readq() and ioread*() for reading 
from the same area.

> for avoiding the potential OOB access.
> 
> Fixes: 15dd100349b8 ("platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic")
> Signed-off-by: Takashi Iwai <tiwai@suse.de>
> ---
>  drivers/platform/x86/ibm_rtl.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/platform/x86/ibm_rtl.c b/drivers/platform/x86/ibm_rtl.c
> index 139956168cf9..6d6998049d8c 100644
> --- a/drivers/platform/x86/ibm_rtl.c
> +++ b/drivers/platform/x86/ibm_rtl.c
> @@ -271,7 +271,7 @@ static int __init ibm_rtl_init(void) {
>  		return -ENOMEM;
>  
>  	/* search for the _RTL_ signature at the start of the table */
> -	for (i = 0 ; i < ebda_size/sizeof(unsigned int); i++) {
> +	for (i = 0 ; i < ebda_size/sizeof(unsigned int) - 1; i++) {

Also remove that extra space after i = 0.

>  		struct ibm_rtl_table __iomem * tmp;
>  		tmp = (struct ibm_rtl_table __iomem *) (ebda_map + i*sizeof(unsigned int));
>  		if ((readq(&tmp->signature) & RTL_MASK) == RTL_SIGNATURE) {
> 

-- 
 i.

Re: [PATCH] platform/x86: ibm_rtl: Fix potential OOB read at signature search

[Takashi Iwai]

On Tue, 20 Oct 2026 15:52:28 +0200,
Ilpo Järvinen wrote:
> 
> On Tue, 20 Oct 2026, Takashi Iwai wrote:
> 
> > The loop for signature search fetches 8 bytes at each check,
> 
> But that's not all it's going to access??

Oh indeed it access further.

> > while the
> > loop count is calculated in 4 bytes unit, which means that, at the
> > last entry, it fetches over the limit.
> > 
> > Correct the boundary condition to "ebda_size/sizeof(unsigned int)-1"
> 
> This seems even more obfuscated than this code already is!

Yeah, the driver code is really ugly, and I made a whip cream on the
top :)

> I think it should do this instead:
> 
> (ebda_size - sizeof(*rtl_table)) / sizeof(u32)

Hrm, this will result in the omit of the last loop entry?

I guess it'd be better understandable rather by directly adding the
offset in the loop instead of the counter.  Something like below.

> Admittedly, it a logical change too but why you think only partial RTL 
> table is good enough just because signature can be checked? After the sig 
> check, it will read the struct beyond that.
> 
> ...And that other sizeof() should use u32 as well.
> 
> 
> Unrelated to this change and if you have this HW and can test changes, it 
> would be nice to also get rid of the debug parameter and use dynamic 
> debugging instead of RTL_DEBUG() for consistency.

No, I don't.  It was caught only through reviews at backporting to the
distro kernels.

> I also don't understand why it's mixing readq() and ioread*() for reading 
> from the same area.

I guess it's just an optimization for the signature check.
The driver needs significant code cleanup, in anyway...


thanks,

Takashi

-- 8< --
From: Takashi Iwai <tiwai@suse.de>
Subject: [PATCH v2] platform/x86: ibm_rtl: Fix potential OOB read at signature
 search

The loop for signature search fetches 22 bytes of struct ibm_rtl_table
at each check, while the loop count is calculated in 4 bytes unit,
which means that, at the last entry, it fetches over the limit.

Rewrite the loop to use the byte offset and correct the boundary
condition check for avoiding the potential OOB access.

Fixes: 15dd100349b8 ("platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
 drivers/platform/x86/ibm_rtl.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/platform/x86/ibm_rtl.c b/drivers/platform/x86/ibm_rtl.c
index 139956168cf9..6f0a10e1d81e 100644
--- a/drivers/platform/x86/ibm_rtl.c
+++ b/drivers/platform/x86/ibm_rtl.c
@@ -234,9 +234,9 @@ static const struct dmi_system_id ibm_rtl_dmi_table[] __initconst = {
 };
 
 static int __init ibm_rtl_init(void) {
-	unsigned long ebda_addr, ebda_size;
+	unsigned long ebda_addr, ebda_size, offset;
 	unsigned int ebda_kb;
-	int ret = -ENODEV, i;
+	int ret = -ENODEV;
 
 	if (force)
 		pr_warn("module loaded by force\n");
@@ -271,9 +271,9 @@ static int __init ibm_rtl_init(void) {
 		return -ENOMEM;
 
 	/* search for the _RTL_ signature at the start of the table */
-	for (i = 0 ; i < ebda_size/sizeof(unsigned int); i++) {
+	for (offset = 0 ; offset + sizeof(*rtl_table) <= ebda_size; offset += 4) {
 		struct ibm_rtl_table __iomem * tmp;
-		tmp = (struct ibm_rtl_table __iomem *) (ebda_map + i*sizeof(unsigned int));
+		tmp = (struct ibm_rtl_table __iomem *) (ebda_map + offset);
 		if ((readq(&tmp->signature) & RTL_MASK) == RTL_SIGNATURE) {
 			phys_addr_t addr;
 			unsigned int plen;
-- 
2.55.0