Re: [PATCH v4] rust: pci: reject IRQ vector indices that do not fit in u32

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing bounds check in `IrqVectorRegistration::index()` leads to kernel warning/panic via C API.
--

commit 97b70137801249b8b3a7409015c5b394925bf777
Author: Sophon Zhang <aiqubits@hotmail.com>
rust: pci: reject IRQ vector indices that do not fit in u32

This commit attempts to prevent 64-bit Rust IRQ vector indices from wrapping
when passed to the C API by introducing a checked cast to u32. It relies on
the PCI core to validate the range of the index rather than doing a bounds
check in Rust.

> diff --git a/rust/kernel/pci/irq.rs b/rust/kernel/pci/irq.rs
> --- a/rust/kernel/pci/irq.rs
> +++ b/rust/kernel/pci/irq.rs
> @@ -151,8 +151,10 @@ pub fn irq_type(&self) -> IrqType {
>      /// [Self::len()].
>      #[inline]
>      pub fn index(&self, index: usize) -> Result<IrqVector<'_>> {
> +        let index = u32::try_from(index)?;
> +
>          // SAFETY: self.dev.as_raw() is a valid pointer to a struct pci_dev.
> -        let irq = unsafe { bindings::pci_irq_vector(self.dev.as_raw(), index as u32) };
> +        let irq = unsafe { bindings::pci_irq_vector(self.dev.as_raw(), index) };

[Severity: High]
This is a pre-existing issue, but does relying on the C API for bounds
checking violate Rust safety guarantees by triggering a kernel warning or
panic?

If a driver calls this safe Rust function with an out-of-bounds index that
still fits in a u32 (for example, 65536), it will pass the u32 conversion
and be handed directly to bindings::pci_irq_vector().

If MSI is enabled, this eventually calls msi_domain_get_virq() in
kernel/irq/msi.c, which executes:

    if (WARN_ON_ONCE(index > MSI_MAX_INDEX || domid >= MSI_MAX_DEVICE_IRQDOMAINS))
        return 0;

Because MSI_MAX_INDEX is 65535, an index of 65536 will trigger the
WARN_ON_ONCE, which can crash the kernel if panic_on_warn is set.

Furthermore, if the kernel is built without CONFIG_PCI_MSI, the fallback
inline pci_irq_vector() in include/linux/pci.h will trigger a similar
warning for any index > 0:

    if (WARN_ON_ONCE(nr > 0))
        return -EINVAL;

Since IrqVectorRegistration::index() is exposed as a safe Rust API, could an
explicit check against self.len() be added here to avoid relying on C-side
WARN_ON_ONCE checks for validation?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260901-fix-pci-irq-vector-index-truncation-v4-1-f94aa6932fd9@hotmail.com?part=1