mfd: cs42l43: Sanity check firmware size

Currently the code checks if a firmware was received, however it does
not verify that the firmware size is larger than the firmware header. As
the firmware pointer is dereferenced as a pointer to the header
structure this could lead to an out of bounds memory access. Add the
missing check.

Fixes: ace6d1448138 ("mfd: cs42l43: Add support for cs42l43 core driver")
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20260508134804.1787461-1-ckeepax@opensource.cirrus.com
Signed-off-by: Lee Jones <lee@kernel.org>

diff --git a/drivers/mfd/cs42l43.c b/drivers/mfd/cs42l43.c
index 166881751e698a78eecaf8bcf33839327dcf672b..ed6d93893de04d3fd19c4acfb6510cee9de3f158 100644 (file)
--- a/drivers/mfd/cs42l43.c
+++ b/drivers/mfd/cs42l43.c
@@ -722,7 +722,7 @@ static void cs42l43_mcu_load_firmware(const struct firmware *firmware, void *con
        unsigned int loadaddr, val;
        int ret;
 
-       if (!firmware) {
+       if (!firmware || firmware->size < sizeof(*hdr)) {
                dev_err(cs42l43->dev, "Failed to load firmware\n");
                cs42l43->firmware_error = -ENODEV;
                goto err;