platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic

The ibm_rtl_init() function searches for the signature but has a pointer
arithmetic error. The loop counter suggests searching at 4-byte intervals
but the implementation only advances by 1 byte per iteration.

Fix by properly advancing the pointer by sizeof(unsigned int) bytes
each iteration.

Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Reported-by: Junrui Luo <moonafterrain@outlook.com>
Fixes: 35f0ce032b0f ("IBM Real-Time "SMI Free" mode driver -v7")
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Link: https://patch.msgid.link/SYBPR01MB78812D887A92DE3802D0D06EAFA9A@SYBPR01MB7881.ausprd01.prod.outlook.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>

diff --git a/drivers/platform/x86/ibm_rtl.c b/drivers/platform/x86/ibm_rtl.c
index 231b37909801700630167144431b9701bd4ebe0f..139956168cf94738a9f61cb467dc1cdc0231ebb0 100644 (file)
--- a/drivers/platform/x86/ibm_rtl.c
+++ b/drivers/platform/x86/ibm_rtl.c
@@ -273,7 +273,7 @@ static int __init ibm_rtl_init(void) {
        /* search for the _RTL_ signature at the start of the table */
        for (i = 0 ; i < ebda_size/sizeof(unsigned int); i++) {
                struct ibm_rtl_table __iomem * tmp;
-               tmp = (struct ibm_rtl_table __iomem *) (ebda_map+i);
+               tmp = (struct ibm_rtl_table __iomem *) (ebda_map + i*sizeof(unsigned int));
                if ((readq(&tmp->signature) & RTL_MASK) == RTL_SIGNATURE) {
                        phys_addr_t addr;
                        unsigned int plen;