[PATCH v2] iio: dac: mcp47feb02: reject out-of-range raw values

[PATCH v2] iio: dac: mcp47feb02: reject out-of-range raw values

[David Carlier]

mcp47feb02_write_raw() writes the user supplied raw value to the DAC
register without checking it against the chip resolution. The parts
are 8, 10 or 12 bit, and the bits above the resolution are not
implemented, so writing 300 to out_voltage0_raw on an 8-bit part sets
the output to code 44 instead of failing, and -1 is written as 0xffff.

The out-of-range value is also cached in dac_data, so it is written
back on resume and stored to EEPROM by store_eeprom.

Return -EINVAL for values outside [0, 2^resolution - 1].

Fixes: bf394cc80369 ("iio: dac: adding support for Microchip MCP47FEB02")
Cc: stable@vger.kernel.org
Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
Signed-off-by: David Carlier <devnexen@gmail.com>
---
Found by LLM-assisted code inspection, reviewed and verified by hand.
Build tested with W=1 (=m and =y) only; no hardware was available for
runtime testing.

v2:
- Use GENMASK() for the upper bound so it is safe up to 32 bits (Andy)
- Drop the Assisted-by tag, removed from the docs in 1e035297ffda (Joshua)
- Move the testing note below the --- (Joshua)

v1: https://lore.kernel.org/all/20261024214423.865635-1-devnexen@gmail.com/
---
 drivers/iio/dac/mcp47feb02-core.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/iio/dac/mcp47feb02-core.c b/drivers/iio/dac/mcp47feb02-core.c
index 88bffbab0854..b5a2ac4a2e67 100644
--- a/drivers/iio/dac/mcp47feb02-core.c
+++ b/drivers/iio/dac/mcp47feb02-core.c
@@ -696,6 +696,9 @@ static int mcp47feb02_write_raw(struct iio_dev *indio_dev, struct iio_chan_spec
 
 	switch (mask) {
 	case IIO_CHAN_INFO_RAW:
+		if (val < 0 || val > GENMASK(data->chip_features->resolution - 1, 0))
+			return -EINVAL;
+
 		ret = regmap_write(data->regmap, REG_ADDR(ch->address), val);
 		if (ret)
 			return ret;
-- 
2.55.0

Re: [PATCH v2] iio: dac: mcp47feb02: reject out-of-range raw values

[Andy Shevchenko]

On Sun, Oct 25, 2026 at 09:18:56PM +0000, David Carlier wrote:
> mcp47feb02_write_raw() writes the user supplied raw value to the DAC
> register without checking it against the chip resolution. The parts
> are 8, 10 or 12 bit, and the bits above the resolution are not
> implemented, so writing 300 to out_voltage0_raw on an 8-bit part sets
> the output to code 44 instead of failing, and -1 is written as 0xffff.
> 
> The out-of-range value is also cached in dac_data, so it is written
> back on resume and stored to EEPROM by store_eeprom.
> 
> Return -EINVAL for values outside [0, 2^resolution - 1].

LGTM now,
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH v2] iio: dac: mcp47feb02: reject out-of-range raw values

[Jonathan Cameron]

On Sun, 25 Oct 2026 21:18:56 +0000
David Carlier <devnexen@gmail.com> wrote:

> mcp47feb02_write_raw() writes the user supplied raw value to the DAC
> register without checking it against the chip resolution. The parts
> are 8, 10 or 12 bit, and the bits above the resolution are not
> implemented, so writing 300 to out_voltage0_raw on an 8-bit part sets
> the output to code 44 instead of failing, and -1 is written as 0xffff.
> 
> The out-of-range value is also cached in dac_data, so it is written
> back on resume and stored to EEPROM by store_eeprom.
> 
> Return -EINVAL for values outside [0, 2^resolution - 1].
> 
> Fixes: bf394cc80369 ("iio: dac: adding support for Microchip MCP47FEB02")
> Cc: stable@vger.kernel.org#

Good catch but given the fix will go in the same cycle as the driver
I've dropped the table tag.

This is more about how I choose to queue this up than anything could
know.  I might have held it for next merge window in which case
it would have wanted the stable tag.

Applied to the fixes-togreg branch of iio.git.  I've just rebased that
to reflect the char-misc pull going into Linus' tree (which was needed
to get the driver for this patch). I'll rebase again on rc1 once available.

Given I'll be rebasing anyway, extra tags welcome (and I didn't hold
off on applying as I might have done if aiming for no rebasing). Ariana,
please take a look at this one.

Thanks,

Jonathan



> Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
> Signed-off-by: David Carlier <devnexen@gmail.com>
> ---
> Found by LLM-assisted code inspection, reviewed and verified by hand.
> Build tested with W=1 (=m and =y) only; no hardware was available for
> runtime testing.
> 
> v2:
> - Use GENMASK() for the upper bound so it is safe up to 32 bits (Andy)
> - Drop the Assisted-by tag, removed from the docs in 1e035297ffda (Joshua)
> - Move the testing note below the --- (Joshua)
> 
> v1: https://lore.kernel.org/all/20261024214423.865635-1-devnexen@gmail.com/
> ---
>  drivers/iio/dac/mcp47feb02-core.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/iio/dac/mcp47feb02-core.c b/drivers/iio/dac/mcp47feb02-core.c
> index 88bffbab0854..b5a2ac4a2e67 100644
> --- a/drivers/iio/dac/mcp47feb02-core.c
> +++ b/drivers/iio/dac/mcp47feb02-core.c
> @@ -696,6 +696,9 @@ static int mcp47feb02_write_raw(struct iio_dev *indio_dev, struct iio_chan_spec
>  
>  	switch (mask) {
>  	case IIO_CHAN_INFO_RAW:
> +		if (val < 0 || val > GENMASK(data->chip_features->resolution - 1, 0))
> +			return -EINVAL;
> +
>  		ret = regmap_write(data->regmap, REG_ADDR(ch->address), val);
>  		if (ret)
>  			return ret;