[PATCH v2] rust: pci: Reject IRQ vector indices that do not fit in u32

[PATCH v2] rust: pci: Reject IRQ vector indices that do not fit in u32

[Sophon Z via B4 Relay]

From: Sophon Z <aiqubits@hotmail.com>

IrqVectorRegistration::index() accepts a usize, but pci_irq_vector()
takes an unsigned int. On 64-bit architectures, casting an index
larger than u32::MAX wraps it before the PCI core can validate it.
In particular, u32::MAX + 1 becomes zero and can resolve to the first
allocated vector.

Use a checked conversion and return EINVAL when the index cannot be
represented by the C API.

Fixes: 2fb7755b0a7e ("rust: pci: resolve IRQ in index() and embed IrqRequest in IrqVector")

Signed-off-by: Sophon Z <aiqubits@hotmail.com>
---
Changes in v2:
- EDITME: describe what is new in this series revision.
- EDITME: use bulletpoints and terse descriptions.
- Link to v1: https://patch.msgid.link/20260831-fix-pci-irq-vector-index-truncation-v1-1-d63217d99b67@hotmail.com
---
 rust/kernel/pci/irq.rs | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/rust/kernel/pci/irq.rs b/rust/kernel/pci/irq.rs
index 6741046ec1c0..1bf91973cb1f 100644
--- a/rust/kernel/pci/irq.rs
+++ b/rust/kernel/pci/irq.rs
@@ -151,8 +151,10 @@ pub fn irq_type(&self) -> IrqType {
     /// [`Self::len()`].
     #[inline]
     pub fn index(&self, index: usize) -> Result<IrqVector<'_>> {
+        let index = u32::try_from(index).map_err(|_| EINVAL)?;
+
         // SAFETY: `self.dev.as_raw()` is a valid pointer to a `struct pci_dev`.
-        let irq = unsafe { bindings::pci_irq_vector(self.dev.as_raw(), index as u32) };
+        let irq = unsafe { bindings::pci_irq_vector(self.dev.as_raw(), index) };
         if irq < 0 {
             return Err(Error::from_errno(irq));
         }

---
base-commit: cee9395acd8043be0644b25c34bfa86623f2b935
change-id: 20260831-fix-pci-irq-vector-index-truncation-6752f3751a0d

Best regards,
--  
Sophon Z <aiqubits@hotmail.com>

Re: [PATCH v2] rust: pci: Reject IRQ vector indices that do not fit in u32

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] `IrqVectorRegistration::index` delegates out-of-bounds validation entirely to the C API `pci_irq_vector`, which triggers a `WARN_ON_ONCE` for sufficiently large indices, potentially causing a kernel panic.
--

commit 1d05a4f88062a655f88b6ab70e939331e2445d7b
Author: Sophon Z <aiqubits@hotmail.com>

rust: pci: Reject IRQ vector indices that do not fit in u32

IrqVectorRegistration::index() accepts a usize, but pci_irq_vector() takes
an unsigned int. This commit adds a checked conversion to prevent wrapping
on 64-bit architectures, returning EINVAL if the index exceeds u32 limits.

> diff --git a/rust/kernel/pci/irq.rs b/rust/kernel/pci/irq.rs
> index 6741046ec1c09..1bf91973cb1f4 100644
> --- a/rust/kernel/pci/irq.rs
> +++ b/rust/kernel/pci/irq.rs
> @@ -151,8 +151,10 @@ pub fn irq_type(&self) -> IrqType {
>      /// [`Self::len()`].
>      #[inline]
>      pub fn index(&self, index: usize) -> Result<IrqVector<'_>> {
> +        let index = u32::try_from(index).map_err(|_| EINVAL)?;

[Severity: High]
This is a pre-existing issue, but does this adequately prevent out-of-bounds
indices from reaching the C API?

Passing an index greater than 65535 (MSI_MAX_INDEX) causes the underlying
C API msi_domain_get_virq() to trigger a WARN_ON_ONCE(index > MSI_MAX_INDEX).
On systems configured with panic_on_warn=1, this leads to a kernel panic.

If a driver exposes IRQ vector selection to userspace without its own bounds
checking, relying on this abstraction to return EINVAL, this could result in
a Denial of Service.

Since self.len() is already known and guaranteed to be at most 2048 for
MSI-X, wouldn't explicitly checking if index >= self.len() be safer and
inherently prevent the warning from being triggered?

> +
>          // SAFETY: `self.dev.as_raw()` is a valid pointer to a `struct pci_dev`.
> -        let irq = unsafe { bindings::pci_irq_vector(self.dev.as_raw(), index as u32) };
> +        let irq = unsafe { bindings::pci_irq_vector(self.dev.as_raw(), index) };
>          if irq < 0 {
>              return Err(Error::from_errno(irq));
>          }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-fix-pci-irq-vector-index-truncation-v2-1-4030ea7746a9@hotmail.com?part=1