[PATCH bluetooth] Bluetooth: btintel: validate PPAG table element types

[PATCH bluetooth] Bluetooth: btintel: validate PPAG table element types

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

btintel_set_ppag() validates that the top-level ACPI PPAG object is a
package, but does not check that the inner PPAG table at element[1] is
itself a package with integer elements. If firmware returns a
non-package type in that position, the code interprets an unrelated
union member as package.elements, dereferencing a meaningless pointer.

Add type validation for the inner package and its integer elements
before reading the domain and mode values.

Fixes: c585a92b2f9c ("Bluetooth: btintel: Set Per Platform Antenna Gain(PPAG)")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/bluetooth/btintel.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c
index c69a5d226e882..aeaf80e03f8ad 100644
--- a/drivers/bluetooth/btintel.c
+++ b/drivers/bluetooth/btintel.c
@@ -2637,6 +2637,19 @@ static void btintel_set_ppag(struct hci_dev *hdev, struct intel_version_tlv *ver
 	/* PPAG table is located at element[1] */
 	p = &elements[1];
 
+	if (p->type != ACPI_TYPE_PACKAGE || p->package.count < 2) {
+		bt_dev_warn(hdev, "PPAG-BT: Invalid PPAG table format");
+		kfree(buffer.pointer);
+		return;
+	}
+
+	if (p->package.elements[0].type != ACPI_TYPE_INTEGER ||
+	    p->package.elements[1].type != ACPI_TYPE_INTEGER) {
+		bt_dev_warn(hdev, "PPAG-BT: Invalid element types in PPAG table");
+		kfree(buffer.pointer);
+		return;
+	}
+
 	domain = (u32)p->package.elements[0].integer.value;
 	mode = (u32)p->package.elements[1].integer.value;
 	kfree(buffer.pointer);
-- 
2.47.3

RE: Bluetooth: btintel: validate PPAG table element types

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1020 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1192798/

---Test result---

Test Summary:
CheckPatch                    PASS      2.51 seconds
VerifyFixes                   PASS      0.13 seconds
VerifySignedoff               PASS      0.13 seconds
GitLint                       PASS      0.34 seconds
SubjectPrefix                 PASS      0.12 seconds
BuildKernel                   PASS      30.28 seconds
CheckAllWarning               PASS      34.34 seconds
CheckSparse                   PASS      37.16 seconds
BuildKernel32                 PASS      30.12 seconds
CheckKernelLLVM               PASS      36.49 seconds
TestRunnerSetup               PASS      713.10 seconds
IncrementalBuild              PASS      27.82 seconds



https://github.com/bluez/bluetooth-next/pull/1001

---
Regards,
Linux Bluetooth