platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic

[ Upstream commit 15dd100349b8526cbdf2de0ce3e72e700eb6c208 ]

The ibm_rtl_init() function searches for the signature but has a pointer
arithmetic error. The loop counter suggests searching at 4-byte intervals
but the implementation only advances by 1 byte per iteration.

Fix by properly advancing the pointer by sizeof(unsigned int) bytes
each iteration.

Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Reported-by: Junrui Luo <moonafterrain@outlook.com>
Fixes: 35f0ce032b0f ("IBM Real-Time "SMI Free" mode driver -v7")
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Link: https://patch.msgid.link/SYBPR01MB78812D887A92DE3802D0D06EAFA9A@SYBPR01MB7881.ausprd01.prod.outlook.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/platform/x86/ibm_rtl.c b/drivers/platform/x86/ibm_rtl.c
index 5fc665f7d9b35dd72a7fde3a976cdc1172835ac6..10cab7bdfe1505c809ca49b1bb347075bda8db5f 100644 (file)
--- a/drivers/platform/x86/ibm_rtl.c
+++ b/drivers/platform/x86/ibm_rtl.c
@@ -262,7 +262,7 @@ static int __init ibm_rtl_init(void) {
        /* search for the _RTL_ signature at the start of the table */
        for (i = 0 ; i < ebda_size/sizeof(unsigned int); i++) {
                struct ibm_rtl_table __iomem * tmp;
-               tmp = (struct ibm_rtl_table __iomem *) (ebda_map+i);
+               tmp = (struct ibm_rtl_table __iomem *) (ebda_map + i*sizeof(unsigned int));
                if ((readq(&tmp->signature) & RTL_MASK) == RTL_SIGNATURE) {
                        phys_addr_t addr;
                        unsigned int plen;