mcp47feb02_write_raw() writes the user supplied raw value to the DAC register without checking it against the chip resolution. The parts are 8, 10 or 12 bit, and the bits above the resolution are not implemented, so writing 300 to out_voltage0_raw on an 8-bit part sets the output to code 44 instead of failing, and -1 is written as 0xffff. The out-of-range value is also cached in dac_data, so it is written back on resume and stored to EEPROM by store_eeprom. Return -EINVAL for values outside [0, 2^resolution - 1]. Fixes: bf394cc80369 ("iio: dac: adding support for Microchip MCP47FEB02") Cc: stable@vger.kernel.org Reviewed-by: Joshua Crofts Signed-off-by: David Carlier --- Found by LLM-assisted code inspection, reviewed and verified by hand. Build tested with W=1 (=m and =y) only; no hardware was available for runtime testing. v2: - Use GENMASK() for the upper bound so it is safe up to 32 bits (Andy) - Drop the Assisted-by tag, removed from the docs in 1e035297ffda (Joshua) - Move the testing note below the --- (Joshua) v1: https://lore.kernel.org/all/20261024214423.865635-1-devnexen@gmail.com/ --- drivers/iio/dac/mcp47feb02-core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/iio/dac/mcp47feb02-core.c b/drivers/iio/dac/mcp47feb02-core.c index 88bffbab0854..b5a2ac4a2e67 100644 --- a/drivers/iio/dac/mcp47feb02-core.c +++ b/drivers/iio/dac/mcp47feb02-core.c @@ -696,6 +696,9 @@ static int mcp47feb02_write_raw(struct iio_dev *indio_dev, struct iio_chan_spec switch (mask) { case IIO_CHAN_INFO_RAW: + if (val < 0 || val > GENMASK(data->chip_features->resolution - 1, 0)) + return -EINVAL; + ret = regmap_write(data->regmap, REG_ADDR(ch->address), val); if (ret) return ret; -- 2.55.0