[PATCH] ACPI: property: verify nested _DSD packages

[Kang Chen]

acpi_properties_format_valid() and acpi_add_nondev_subnodes() inspect
the package.count of nested elements before checking that those
elements actually are packages.  In union acpi_object, count aliases
the length of a string or buffer, so a Buffer(2) or String(2) element
passes the two-element test and the following elements[0]/elements[1]
accesses read past the small allocation.  In the non-device subnode
path, the resulting string pointer can reach acpi_get_handle().

Test for ACPI_TYPE_PACKAGE before using package.count in both
functions.  Also require an even number of entries in the _DSD package
before reading paired GUID/link elements.

Fixes: ffdcd955c307 ("ACPI: Add support for device specific properties")
Fixes: 99db5ff7fe0b ("ACPI / property: Hierarchical properties support update")
Signed-off-by: Kang Chen <k.chen@xxxxxxxxxxxxxxxx>
---
 drivers/acpi/property.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
index 8ee5a1f0eb48..f5e0dc87edde 100644
--- a/drivers/acpi/property.c
+++ b/drivers/acpi/property.c
@@ -194,7 +194,8 @@ static bool acpi_add_nondev_subnodes(acpi_handle scope,
 
 		link = &links->package.elements[i];
 		/* Only two elements allowed. */
-		if (link->package.count != 2)
+		if (link->type != ACPI_TYPE_PACKAGE ||
+		    link->package.count != 2)
 			continue;
 
 		/* The first one (the key) must be a string. */
@@ -262,6 +263,9 @@ static bool acpi_enumerate_nondev_subnodes(acpi_handle scope,
 	int i;
 
 	/* Look for the ACPI data subnodes GUID. */
+	if (desc->package.count % 2)
+		return false;
+
 	for (i = 0; i < desc->package.count; i += 2) {
 		const union acpi_object *guid;
 		union acpi_object *links;
@@ -331,9 +335,10 @@ static bool acpi_properties_format_valid(const union acpi_object *properties)
 		 * Only two elements allowed, the first one must be a string and
 		 * the second one has to satisfy certain conditions.
 		 */
-		if (property->package.count != 2
-		    || property->package.elements[0].type != ACPI_TYPE_STRING
-		    || !acpi_property_value_ok(&property->package.elements[1]))
+		if (property->type != ACPI_TYPE_PACKAGE ||
+		    property->package.count != 2 ||
+		    property->package.elements[0].type != ACPI_TYPE_STRING ||
+		    !acpi_property_value_ok(&property->package.elements[1]))
 			return false;
 	}
 	return true;
-- 
2.34.1