[PATCH] platform/x86: ibm_rtl: Fix potential OOB read at signature search

[Takashi Iwai]

The loop for signature search fetches 8 bytes at each check, while the
loop count is calculated in 4 bytes unit, which means that, at the
last entry, it fetches over the limit.

Correct the boundary condition to "ebda_size/sizeof(unsigned int)-1"
for avoiding the potential OOB access.

Fixes: 15dd100349b8 ("platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic")
Signed-off-by: Takashi Iwai <tiwai@xxxxxxx>
---
 drivers/platform/x86/ibm_rtl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/x86/ibm_rtl.c b/drivers/platform/x86/ibm_rtl.c
index 139956168cf9..6d6998049d8c 100644
--- a/drivers/platform/x86/ibm_rtl.c
+++ b/drivers/platform/x86/ibm_rtl.c
@@ -271,7 +271,7 @@ static int __init ibm_rtl_init(void) {
 		return -ENOMEM;
 
 	/* search for the _RTL_ signature at the start of the table */
-	for (i = 0 ; i < ebda_size/sizeof(unsigned int); i++) {
+	for (i = 0 ; i < ebda_size/sizeof(unsigned int) - 1; i++) {
 		struct ibm_rtl_table __iomem * tmp;
 		tmp = (struct ibm_rtl_table __iomem *) (ebda_map + i*sizeof(unsigned int));
 		if ((readq(&tmp->signature) & RTL_MASK) == RTL_SIGNATURE) {
-- 
2.55.0