Re: [PATCH] platform/x86: ibm_rtl: Fix potential OOB read at signature search

[Takashi Iwai]

On Tue, 20 Oct 2026 22:20:50 +0200,
Ilpo Järvinen wrote:
> 
> On Tue, 20 Oct 2026, Takashi Iwai wrote:
> 
> > On Tue, 20 Oct 2026 15:52:28 +0200,
> > Ilpo Järvinen wrote:
> > > 
> > > On Tue, 20 Oct 2026, Takashi Iwai wrote:
> > > 
> > > > The loop for signature search fetches 8 bytes at each check,
> > > 
> > > But that's not all it's going to access??
> > 
> > Oh indeed it access further.
> > 
> > > > while the
> > > > loop count is calculated in 4 bytes unit, which means that, at the
> > > > last entry, it fetches over the limit.
> > > > 
> > > > Correct the boundary condition to "ebda_size/sizeof(unsigned int)-1"
> > > 
> > > This seems even more obfuscated than this code already is!
> > 
> > Yeah, the driver code is really ugly, and I made a whip cream on the
> > top :)
> > 
> > > I think it should do this instead:
> > > 
> > > (ebda_size - sizeof(*rtl_table)) / sizeof(u32)
> > 
> > Hrm, this will result in the omit of the last loop entry?
> > 
> > I guess it'd be better understandable rather by directly adding the
> > offset in the loop instead of the counter.  Something like below.
> 
> The patch below looks fine sans one nit but could you please send it in 
> own thread so it gets captured by patchwork & sashiko & etc.

OK, will do.

(snip)
> > @@ -271,9 +271,9 @@ static int __init ibm_rtl_init(void) {
> >  		return -ENOMEM;
> >  
> >  	/* search for the _RTL_ signature at the start of the table */
> > -	for (i = 0 ; i < ebda_size/sizeof(unsigned int); i++) {
> > +	for (offset = 0 ; offset + sizeof(*rtl_table) <= ebda_size; offset += 4) {
> 
> Nit, remove the extra space before semicolon.

Will be corrected in the next submission.


thanks,

Takashi