From: Sanman Pradhan <psanman@juniper.net>

mp2869_reg2data_linear11() and mp29502_reg2data_linear11() decode
a Linear11 PMBus value using signed intermediates but return u16.
This can silently truncate negative or oversized results before they
are consumed by the driver read_word_data() callback path.

Those helpers feed values later returned through the driver
read_word_data() callback path. In that path, negative integers are
reserved for errors, so successful decoded values must remain in a
non-negative bounded range.

Change the helper return type to int and clamp the result to
[0, 0xffff]. This makes the bounded result explicit instead of
relying on implicit truncation to u16, and keeps the conversion
behavior consistent for all helper users.

Fixes: a3a2923aaf7f ("hwmon: add MP2869,MP29608,MP29612 and MP29816 series driver")
Fixes: 90bad684e9ac ("hwmon: add MP29502 driver")
Cc: stable@vger.kernel.org
Signed-off-by: Sanman Pradhan <psanman@juniper.net>
---
v2:
- No changes to this patch in this version.
---
 drivers/hwmon/pmbus/mp2869.c  | 4 ++--
 drivers/hwmon/pmbus/mp29502.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/hwmon/pmbus/mp2869.c b/drivers/hwmon/pmbus/mp2869.c
index 4f8543801298..fc4ce854c9c3 100644
--- a/drivers/hwmon/pmbus/mp2869.c
+++ b/drivers/hwmon/pmbus/mp2869.c
@@ -65,7 +65,7 @@ static const int mp2869_iout_sacle[8] = {32, 1, 2, 4, 8, 16, 32, 64};
 
 #define to_mp2869_data(x)	container_of(x, struct mp2869_data, info)
 
-static u16 mp2869_reg2data_linear11(u16 word)
+static int mp2869_reg2data_linear11(u16 word)
 {
 	s16 exponent;
 	s32 mantissa;
@@ -80,7 +80,7 @@ static u16 mp2869_reg2data_linear11(u16 word)
 	else
 		val >>= -exponent;
 
-	return val;
+	return clamp_val(val, 0, 0xffff);
 }
 
 static int
diff --git a/drivers/hwmon/pmbus/mp29502.c b/drivers/hwmon/pmbus/mp29502.c
index 4556bc8350ae..1457809aa7e4 100644
--- a/drivers/hwmon/pmbus/mp29502.c
+++ b/drivers/hwmon/pmbus/mp29502.c
@@ -52,7 +52,7 @@ struct mp29502_data {
 
 #define to_mp29502_data(x)	container_of(x, struct mp29502_data, info)
 
-static u16 mp29502_reg2data_linear11(u16 word)
+static int mp29502_reg2data_linear11(u16 word)
 {
 	s16 exponent;
 	s32 mantissa;
@@ -67,7 +67,7 @@ static u16 mp29502_reg2data_linear11(u16 word)
 	else
 		val >>= -exponent;
 
-	return val;
+	return clamp_val(val, 0, 0xffff);
 }
 
 static int
-- 
2.34.1