[PATCH] Bluetooth: btintel: validate the BRDS domain packages

[Kang Chen]

btintel_acpi_get_bt_pkg() treats every element after the revision as a
package and reads its first element without checking the element type
or count.  An integer element makes package.elements alias the integer
value and dereferences a firmware-chosen pointer; a short string or
buffer element reads past its allocation.  The function is called for
BRDS during Intel SAR setup.

Skip elements that are not non-empty packages.

Fixes: e036afb1fe44 ("Bluetooth: btintel: Add support to configure TX power")
Signed-off-by: Kang Chen <k.chen@xxxxxxxxxxxxxxxx>
---
 drivers/bluetooth/btintel.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c
index 0709fb3212f9..16745b58bde4 100644
--- a/drivers/bluetooth/btintel.c
+++ b/drivers/bluetooth/btintel.c
@@ -3042,6 +3042,10 @@ static union acpi_object *btintel_acpi_get_bt_pkg(union acpi_object *buffer)
 
 	for (i = 1; i < buffer->package.count; i++) {
 		bt_pkg = &buffer->package.elements[i];
+		if (bt_pkg->type != ACPI_TYPE_PACKAGE ||
+		    bt_pkg->package.count < 1)
+			continue;
+
 		domain = &bt_pkg->package.elements[0];
 		if (domain->type == ACPI_TYPE_INTEGER &&
 		    domain->integer.value == BTINTEL_BT_DOMAIN)
-- 
2.34.1