[PATCH] iio: dac: mcp47feb02: reject out-of-range raw values

[PATCH] iio: dac: mcp47feb02: reject out-of-range raw values

[David Carlier]

mcp47feb02_write_raw() writes the user supplied raw value to the DAC
register without checking it against the chip resolution. The parts
are 8, 10 or 12 bit, and the bits above the resolution are not
implemented, so writing 300 to out_voltage0_raw on an 8-bit part sets
the output to code 44 instead of failing, and -1 is written as 0xffff.

The out-of-range value is also cached in dac_data, so it is written
back on resume and stored to EEPROM by store_eeprom.

Return -EINVAL for values outside [0, 2^resolution - 1].

Found by code inspection. Build tested with W=1 (=m and =y) only;
no hardware was available for runtime testing.

Fixes: bf394cc80369 ("iio: dac: adding support for Microchip MCP47FEB02")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: David Carlier <devnexen@gmail.com>
---
 drivers/iio/dac/mcp47feb02-core.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/iio/dac/mcp47feb02-core.c b/drivers/iio/dac/mcp47feb02-core.c
index 88bffbab0854..1a0e80b5db87 100644
--- a/drivers/iio/dac/mcp47feb02-core.c
+++ b/drivers/iio/dac/mcp47feb02-core.c
@@ -696,6 +696,9 @@ static int mcp47feb02_write_raw(struct iio_dev *indio_dev, struct iio_chan_spec
 
 	switch (mask) {
 	case IIO_CHAN_INFO_RAW:
+		if (val < 0 || val >= BIT(data->chip_features->resolution))
+			return -EINVAL;
+
 		ret = regmap_write(data->regmap, REG_ADDR(ch->address), val);
 		if (ret)
 			return ret;
-- 
2.55.0

Re: [PATCH] iio: dac: mcp47feb02: reject out-of-range raw values

[Joshua Crofts]

On Sat, 24 Oct 2026 22:44:23 +0100
David Carlier <devnexen@gmail.com> wrote:

> mcp47feb02_write_raw() writes the user supplied raw value to the DAC
> register without checking it against the chip resolution. The parts
> are 8, 10 or 12 bit, and the bits above the resolution are not
> implemented, so writing 300 to out_voltage0_raw on an 8-bit part sets
> the output to code 44 instead of failing, and -1 is written as 0xffff.
> 
> The out-of-range value is also cached in dac_data, so it is written
> back on resume and stored to EEPROM by store_eeprom.
> 
> Return -EINVAL for values outside [0, 2^resolution - 1].
> 
> Found by code inspection. Build tested with W=1 (=m and =y) only;
> no hardware was available for runtime testing.

This should go under the ---.

> Fixes: bf394cc80369 ("iio: dac: adding support for Microchip MCP47FEB02")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM

This tag has been deprecated.

Otherwise LGTM.

Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>

-- 
Kind regards,
Joshua Crofts

Re: [PATCH] iio: dac: mcp47feb02: reject out-of-range raw values

[Andy Shevchenko]

On Sat, Oct 24, 2026 at 10:44:23PM +0100, David Carlier wrote:
> mcp47feb02_write_raw() writes the user supplied raw value to the DAC
> register without checking it against the chip resolution. The parts
> are 8, 10 or 12 bit, and the bits above the resolution are not
> implemented, so writing 300 to out_voltage0_raw on an 8-bit part sets
> the output to code 44 instead of failing, and -1 is written as 0xffff.
> 
> The out-of-range value is also cached in dac_data, so it is written
> back on resume and stored to EEPROM by store_eeprom.
> 
> Return -EINVAL for values outside [0, 2^resolution - 1].
> 
> Found by code inspection. Build tested with W=1 (=m and =y) only;
> no hardware was available for runtime testing.

...

>  	case IIO_CHAN_INFO_RAW:
> +		if (val < 0 || val >= BIT(data->chip_features->resolution))

If resolution is 32, this will suck. (Yes, this is a bit theoretical case.)

> +			return -EINVAL;

Not sure about this error code. Do other IIO drivers use same in the similar
situation?

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH] iio: dac: mcp47feb02: reject out-of-range raw values

[Andy Shevchenko]

On Sun, Oct 25, 2026 at 08:50:16PM +0000, David CARLIER wrote:
> On Sun, 25 Oct 2026 at 20:37, Andy Shevchenko <andriy.shevchenko@intel.com>
> wrote:
> > On Sat, Oct 24, 2026 at 10:44:23PM +0100, David Carlier wrote:

...

> > >       case IIO_CHAN_INFO_RAW:
> > > +             if (val < 0 || val >= BIT(data->chip_features->resolution))
> >
> > If resolution is 32, this will suck. (Yes, this is a bit theoretical case.)
> >
> 
> Hmm true.
> 
> > > +                     return -EINVAL;
> >
> > Not sure about this error code. Do other IIO drivers use same in the
> > similar situation?
> 
> Yes other drivers for every out-of-range check IIO_CHAN_INFO_RAW.

No doubts. But I asked a different question. Can you answer it?

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH] iio: dac: mcp47feb02: reject out-of-range raw values

[Andy Shevchenko]

On Sun, Oct 25, 2026 at 09:11:16PM +0000, David CARLIER wrote:
> On Sun, 25 Oct 2026 at 21:07, Andy Shevchenko <andriy.shevchenko@intel.com>
> wrote:
> > On Sun, Oct 25, 2026 at 08:50:16PM +0000, David CARLIER wrote:
> > > On Sun, 25 Oct 2026 at 20:37, Andy Shevchenko <andriy.shevchenko@intel.com>
> > > wrote:
> > > > On Sat, Oct 24, 2026 at 10:44:23PM +0100, David Carlier wrote:

...

> > > > > +                     return -EINVAL;
> > > >
> > > > Not sure about this error code. Do other IIO drivers use same in the
> > > > similar situation?
> > >
> > > Yes other drivers for every out-of-range check IIO_CHAN_INFO_RAW.
> >
> > No doubts. But I asked a different question. Can you answer it?
> 
> I meant in this case the other drivers -EINVAL.

OK, thanks for confirming!

-- 
With Best Regards,
Andy Shevchenko