Re: [PATCH] iio: dac: mcp47feb02: reject out-of-range raw values
From: Andy Shevchenko
Date: Sun Oct 25 2026 - 16:38:38 EST
On Sat, Oct 24, 2026 at 10:44:23PM +0100, David Carlier wrote:
> mcp47feb02_write_raw() writes the user supplied raw value to the DAC
> register without checking it against the chip resolution. The parts
> are 8, 10 or 12 bit, and the bits above the resolution are not
> implemented, so writing 300 to out_voltage0_raw on an 8-bit part sets
> the output to code 44 instead of failing, and -1 is written as 0xffff.
>
> The out-of-range value is also cached in dac_data, so it is written
> back on resume and stored to EEPROM by store_eeprom.
>
> Return -EINVAL for values outside [0, 2^resolution - 1].
>
> Found by code inspection. Build tested with W=1 (=m and =y) only;
> no hardware was available for runtime testing.
...
> case IIO_CHAN_INFO_RAW:
> + if (val < 0 || val >= BIT(data->chip_features->resolution))
If resolution is 32, this will suck. (Yes, this is a bit theoretical case.)
> + return -EINVAL;
Not sure about this error code. Do other IIO drivers use same in the similar
situation?
--
With Best Regards,
Andy Shevchenko