[PATCH bluetooth] Bluetooth: btintel: validate PPAG table element types

[Tristan Madani <tristmd@gmail.com>]

From: Tristan Madani <tristan@talencesecurity.com>

btintel_set_ppag() validates that the top-level ACPI PPAG object is a
package, but does not check that the inner PPAG table at element[1] is
itself a package with integer elements. If firmware returns a
non-package type in that position, the code interprets an unrelated
union member as package.elements, dereferencing a meaningless pointer.

Add type validation for the inner package and its integer elements
before reading the domain and mode values.

Fixes: c585a92b2f9c ("Bluetooth: btintel: Set Per Platform Antenna Gain(PPAG)")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/bluetooth/btintel.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c
index c69a5d226e882..aeaf80e03f8ad 100644
--- a/drivers/bluetooth/btintel.c
+++ b/drivers/bluetooth/btintel.c
@@ -2637,6 +2637,19 @@ static void btintel_set_ppag(struct hci_dev *hdev, struct intel_version_tlv *ver
 	/* PPAG table is located at element[1] */
 	p = &elements[1];
 
+	if (p->type != ACPI_TYPE_PACKAGE || p->package.count < 2) {
+		bt_dev_warn(hdev, "PPAG-BT: Invalid PPAG table format");
+		kfree(buffer.pointer);
+		return;
+	}
+
+	if (p->package.elements[0].type != ACPI_TYPE_INTEGER ||
+	    p->package.elements[1].type != ACPI_TYPE_INTEGER) {
+		bt_dev_warn(hdev, "PPAG-BT: Invalid element types in PPAG table");
+		kfree(buffer.pointer);
+		return;
+	}
+
 	domain = (u32)p->package.elements[0].integer.value;
 	mode = (u32)p->package.elements[1].integer.value;
 	kfree(buffer.pointer);
-- 
2.47.3