[PATCH] Bluetooth: btintel: validate the BRDS domain packages

[PATCH] Bluetooth: btintel: validate the BRDS domain packages

[Kang Chen]

btintel_acpi_get_bt_pkg() treats every element after the revision as a
package and reads its first element without checking the element type
or count.  An integer element makes package.elements alias the integer
value and dereferences a firmware-chosen pointer; a short string or
buffer element reads past its allocation.  The function is called for
BRDS during Intel SAR setup.

Skip elements that are not non-empty packages.

Fixes: e036afb1fe44 ("Bluetooth: btintel: Add support to configure TX power")
Signed-off-by: Kang Chen <k.chen@smail.nju.edu.cn>
---
 drivers/bluetooth/btintel.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c
index 0709fb3212f9..16745b58bde4 100644
--- a/drivers/bluetooth/btintel.c
+++ b/drivers/bluetooth/btintel.c
@@ -3042,6 +3042,10 @@ static union acpi_object *btintel_acpi_get_bt_pkg(union acpi_object *buffer)
 
 	for (i = 1; i < buffer->package.count; i++) {
 		bt_pkg = &buffer->package.elements[i];
+		if (bt_pkg->type != ACPI_TYPE_PACKAGE ||
+		    bt_pkg->package.count < 1)
+			continue;
+
 		domain = &bt_pkg->package.elements[0];
 		if (domain->type == ACPI_TYPE_INTEGER &&
 		    domain->integer.value == BTINTEL_BT_DOMAIN)
-- 
2.34.1

RE: Bluetooth: btintel: validate the BRDS domain packages

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1021 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1200286/

---Test result---

Test Summary:
CheckPatch                    PASS      11.04 seconds
VerifyFixes                   PASS      8.99 seconds
VerifySignedoff               PASS      0.52 seconds
GitLint                       PASS      0.48 seconds
SubjectPrefix                 PASS      0.20 seconds
BuildKernel                   PASS      32.56 seconds
CheckAllWarning               PASS      36.83 seconds
CheckSparse                   PASS      38.97 seconds
BuildKernel32                 PASS      32.01 seconds
CheckKernelLLVM               PASS      35.78 seconds
TestRunnerSetup               PASS      764.36 seconds
IncrementalBuild              PASS      29.45 seconds



https://github.com/bluez/bluetooth-next/pull/1053

---
Regards,
Linux Bluetooth