Currently the code checks if a firmware was received, however it does
not verify that the firmware size is larger than the firmware header. As
the firmware pointer is dereferenced as a pointer to the header
structure this could lead to an out of bounds memory access. Add the
missing check.

Fixes: ace6d1448138 ("mfd: cs42l43: Add support for cs42l43 core driver")
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
---
 drivers/mfd/cs42l43.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mfd/cs42l43.c b/drivers/mfd/cs42l43.c
index 166881751e698..ed6d93893de04 100644
--- a/drivers/mfd/cs42l43.c
+++ b/drivers/mfd/cs42l43.c
@@ -722,7 +722,7 @@ static void cs42l43_mcu_load_firmware(const struct firmware *firmware, void *con
 	unsigned int loadaddr, val;
 	int ret;
 
-	if (!firmware) {
+	if (!firmware || firmware->size < sizeof(*hdr)) {
 		dev_err(cs42l43->dev, "Failed to load firmware\n");
 		cs42l43->firmware_error = -ENODEV;
 		goto err;
-- 
2.47.3

On Fri, 08 May 2026 14:48:04 +0100, Charles Keepax wrote:
> Currently the code checks if a firmware was received, however it does
> not verify that the firmware size is larger than the firmware header. As
> the firmware pointer is dereferenced as a pointer to the header
> structure this could lead to an out of bounds memory access. Add the
> missing check.
> 
> 
> [...]

Applied, thanks!

[1/1] mfd: cs42l43: Sanity check firmware size
      commit: 00141b30b2aebbeab67d1497ff1b48ea738518a9

--
Lee Jones [李琼斯]