Re: [PATCH v8 08/20] KVM: selftests: Add helper to get host IRQ from device MSI-X for IRQ bypass test

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The 4096-byte buffer used to read `/proc/interrupts` is too small for systems with many CPUs, causing line truncation and leading to either deterministic test crashes or silent parsing of incorrect IRQ numbers.
--

commit 87caa5d203166722732c2c1909ec869049e95fe7
Author: David Matlack <dmatlack@google.com>

KVM: selftests: Add helper to get host IRQ from device MSI-X for IRQ bypass test

This commit introduces proc_util.c and adds vfio_msix_to_host_irq() to
parse /proc/interrupts and get the host Linux IRQ for a given VFIO device
BDF and MSI-X vector.

> diff --git a/tools/testing/selftests/kvm/lib/proc_util.c b/tools/testing/selftests/kvm/lib/proc_util.c
> new file mode 100644
> index 0000000000000..84d30f055a0a9
> --- /dev/null
> +++ b/tools/testing/selftests/kvm/lib/proc_util.c
[ ... ]
> +unsigned int vfio_msix_to_host_irq(const char *device_bdf, int msix)
> +{
> +	char search_string[64];
> +	char line[4096];
> +	int irq = -1;
> +	FILE *fp;
> +
> +	fp = open_proc_interrupts();
> +
> +	snprintf(search_string, sizeof(search_string), "vfio-msix[%d]", msix);
> +
> +	while (fgets(line, sizeof(line), fp)) {
> +		if (strstr(line, device_bdf) && strstr(line, search_string)) {
> +			TEST_ASSERT_EQ(1, sscanf(line, "%d:", &irq));

[Severity: Medium]
Will this 4096-byte buffer truncate lines on systems with many CPUs?

When /proc/interrupts is read on a host with a large number of CPUs
(e.g., >360 CPUs), the per-CPU interrupt counts can cause the line to exceed
the fixed 4096-byte limit, causing fgets() to split the line into multiple
chunks.

If the final chunk contains the device strings (device_bdf and search_string)
but not the original IRQ number at the start of the line, sscanf() could
evaluate incorrectly.

If the trailing chunk begins with a CPU count, sscanf(line, "%d:", &irq)
would extract the count, ignore the missing colon, return 1, and silently
assign the wrong IRQ.

If the chunk starts with non-numeric text, sscanf() returns 0, failing
TEST_ASSERT_EQ() and aborting the test.

Does this regression require a larger fixed buffer or dynamic allocation to
handle systems with higher CPU counts?

> +			break;
> +		}
> +	}
> +
> +	fclose(fp);
> +
> +	TEST_ASSERT(irq != -1, "Failed to locate IRQ for %s %s", device_bdf,
> +		    search_string);
> +	return (unsigned int)irq;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260626213534.3866178-1-seanjc@google.com?part=8