[PATCH v3] rust: pci: reject out-of-bounds IRQ vector indices

[PATCH v3] rust: pci: reject out-of-bounds IRQ vector indices

[Sophon Z via B4 Relay]

From: Sophon Z <aiqubits@hotmail.com>

IrqVectorRegistration::index() accepts a usize and documents that
out-of-bounds indices return EINVAL, while pci_irq_vector() takes an
unsigned int.

Casting an index larger than u32::MAX wraps it before the PCI core can
validate it. In particular, u32::MAX + 1 becomes zero and can resolve to
the first allocated vector. Values that fit in u32 but exceed
MSI_MAX_INDEX can also reach msi_domain_get_virq() and trigger
WARN_ON_ONCE.

Check the index against the registration length before entering the C
API, and keep the usize-to-u32 conversion checked so the ABI boundary
does not rely on an unchecked cast.

Fixes: 2fb7755b0a7e ("rust: pci: resolve IRQ in index() and embed IrqRequest in IrqVector")

Signed-off-by: Sophon Z <aiqubits@hotmail.com>
---
Changes in v3:
- Check the index against the allocated vector count before entering the C API.
- Keep the checked usize-to-u32 conversion and document the C-side warning.
- Link to v2: https://patch.msgid.link/20260831-fix-pci-irq-vector-index-truncation-v2-1-4030ea7746a9@hotmail.com

Changes in v2:
- No code changes.
- Link to v1: https://patch.msgid.link/20260831-fix-pci-irq-vector-index-truncation-v1-1-d63217d99b67@hotmail.com
---
 rust/kernel/pci/irq.rs | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/rust/kernel/pci/irq.rs b/rust/kernel/pci/irq.rs
index 6741046ec1c0..dfab323f26f7 100644
--- a/rust/kernel/pci/irq.rs
+++ b/rust/kernel/pci/irq.rs
@@ -151,8 +151,14 @@ pub fn irq_type(&self) -> IrqType {
     /// [`Self::len()`].
     #[inline]
     pub fn index(&self, index: usize) -> Result<IrqVector<'_>> {
+        if index >= self.len.get() {
+            return Err(EINVAL);
+        }
+
+        let index = u32::try_from(index).map_err(|_| EINVAL)?;
+
         // SAFETY: `self.dev.as_raw()` is a valid pointer to a `struct pci_dev`.
-        let irq = unsafe { bindings::pci_irq_vector(self.dev.as_raw(), index as u32) };
+        let irq = unsafe { bindings::pci_irq_vector(self.dev.as_raw(), index) };
         if irq < 0 {
             return Err(Error::from_errno(irq));
         }

---
base-commit: cee9395acd8043be0644b25c34bfa86623f2b935
change-id: 20260831-fix-pci-irq-vector-index-truncation-6752f3751a0d

Best regards,
--  
Sophon Z <aiqubits@hotmail.com>

Re: [PATCH v3] rust: pci: reject out-of-bounds IRQ vector indices

[sashiko-bot]

> From: Sophon Z <aiqubits@hotmail.com>
> 
> IrqVectorRegistration::index() accepts a usize and documents that
> out-of-bounds indices return EINVAL, while pci_irq_vector() takes an
> unsigned int.
> 
> Casting an index larger than u32::MAX wraps it before the PCI core can
> validate it. In particular, u32::MAX + 1 becomes zero and can resolve to
> the first allocated vector. Values that fit in u32 but exceed
> MSI_MAX_INDEX can also reach msi_domain_get_virq() and trigger
> WARN_ON_ONCE.
> 
> Check the index against the registration length before entering the C
> API, and keep the usize-to-u32 conversion checked so the ABI boundary
> does not rely on an unchecked cast.
> 
> Fixes: 2fb7755b0a7e ("rust: pci: resolve IRQ in index() and embed IrqRequest in IrqVector")
> 
> Signed-off-by: Sophon Z <aiqubits@hotmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-fix-pci-irq-vector-index-truncation-v3-1-a2103084d20e@hotmail.com?part=1

Re: [PATCH v3] rust: pci: reject out-of-bounds IRQ vector indices

[Miguel Ojeda]

On Mon, Aug 31, 2026 at 9:17 AM Sophon Z via B4 Relay
<devnull+aiqubits.hotmail.com@kernel.org> wrote:
>
> Fixes: 2fb7755b0a7e ("rust: pci: resolve IRQ in index() and embed IrqRequest in IrqVector")

The tag looks good, and there is no need for Cc: stable since this is
from yesterday's -rc1, so that is good.

Nit: we usually don't do newlines between tags.

> Signed-off-by: Sophon Z <aiqubits@hotmail.com>

Is this a known identity? Please see:

  https://docs.kernel.org/process/submitting-patches.html#sign-your-work-the-developer-s-certificate-of-origin

> +        let index = u32::try_from(index).map_err(|_| EINVAL)?;

Do we need the `.map_err()`?

Thanks!

Cheers,
Miguel

Re: [PATCH v3] rust: pci: reject out-of-bounds IRQ vector indices

[Gary Guo]

On Mon Aug 31, 2026 at 8:17 AM BST, Sophon Z via B4 Relay wrote:
> From: Sophon Z <aiqubits@hotmail.com>
>
> IrqVectorRegistration::index() accepts a usize and documents that
> out-of-bounds indices return EINVAL, while pci_irq_vector() takes an
> unsigned int.
>
> Casting an index larger than u32::MAX wraps it before the PCI core can
> validate it. In particular, u32::MAX + 1 becomes zero and can resolve to
> the first allocated vector. Values that fit in u32 but exceed
> MSI_MAX_INDEX can also reach msi_domain_get_virq() and trigger
> WARN_ON_ONCE.
>
> Check the index against the registration length before entering the C
> API, and keep the usize-to-u32 conversion checked so the ABI boundary
> does not rely on an unchecked cast.
>
> Fixes: 2fb7755b0a7e ("rust: pci: resolve IRQ in index() and embed IrqRequest in IrqVector")
>
> Signed-off-by: Sophon Z <aiqubits@hotmail.com>
> ---
> Changes in v3:
> - Check the index against the allocated vector count before entering the C API.
> - Keep the checked usize-to-u32 conversion and document the C-side warning.
> - Link to v2: https://patch.msgid.link/20260831-fix-pci-irq-vector-index-truncation-v2-1-4030ea7746a9@hotmail.com
>
> Changes in v2:
> - No code changes.
> - Link to v1: https://patch.msgid.link/20260831-fix-pci-irq-vector-index-truncation-v1-1-d63217d99b67@hotmail.com
> ---
>  rust/kernel/pci/irq.rs | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/rust/kernel/pci/irq.rs b/rust/kernel/pci/irq.rs
> index 6741046ec1c0..dfab323f26f7 100644
> --- a/rust/kernel/pci/irq.rs
> +++ b/rust/kernel/pci/irq.rs
> @@ -151,8 +151,14 @@ pub fn irq_type(&self) -> IrqType {
>      /// [`Self::len()`].
>      #[inline]
>      pub fn index(&self, index: usize) -> Result<IrqVector<'_>> {
> +        if index >= self.len.get() {
> +            return Err(EINVAL);
> +        }
> +
> +        let index = u32::try_from(index).map_err(|_| EINVAL)?;

Just having this line should be fine, no need for the length check above.

Alternatively, just have the check above, and do the cast, while documenting
that `len` fits u32 as invariant (which is always true given the length is
handed out by PCI core.

Best,
Gary

> +
>          // SAFETY: `self.dev.as_raw()` is a valid pointer to a `struct pci_dev`.
> -        let irq = unsafe { bindings::pci_irq_vector(self.dev.as_raw(), index as u32) };
> +        let irq = unsafe { bindings::pci_irq_vector(self.dev.as_raw(), index) };
>          if irq < 0 {
>              return Err(Error::from_errno(irq));
>          }
>
> ---
> base-commit: cee9395acd8043be0644b25c34bfa86623f2b935
> change-id: 20260831-fix-pci-irq-vector-index-truncation-6752f3751a0d
>
> Best regards,
> --  
> Sophon Z <aiqubits@hotmail.com>

回复: [PATCH v3] rust: pci: reject out-of-bounds IRQ vector indices

[ai qubits]

Thanks for the review.

Yes, Sophon Zhang is my known identity. I will use the full name in v4.

The explicit map_err() is not needed because TryFromIntError is already
converted to Error as EINVAL. I will simplify it to:

    let index = u32::try_from(index)?;

I will also remove the blank line between the trailers.

Best regards,
Sophon

// Reason for Resending

Note: I don't think your messages will be accepted by the mailing
list, since they use HTML. Please switch to plain text -- thanks!

Cheers,
Miguel

Hi Miguel,
Thanks for the reminder. I will resend it in plain text.

Best regards,
Sophon

________________________________________
发件人: ai qubits <aiqubits@hotmail.com>
发送时间: 2026年9月1日 0:58
收件人: Miguel Ojeda
抄送: Danilo Krummrich; Bjorn Helgaas; Krzysztof Wilczyński; Miguel Ojeda; Boqun Feng; Gary Guo; Björn Roy Baron; Benno Lossin; Andreas Hindborg; Alice Ryhl; Trevor Gross; Daniel Almeida; Tamir Duberstein; Alexandre Courbot; Onur Özkan; linux-pci@vger.kernel.org; rust-for-linux@vger.kernel.org; linux-kernel@vger.kernel.org
主题: 回复: [PATCH v3] rust: pci: reject out-of-bounds IRQ vector indices

Thanks for the review.

Yes, Sophon Zhang is my known identity. I will use the full name in v4.

The explicit map_err() is not needed because TryFromIntError is already
converted to Error as EINVAL. I will simplify it to:

    let index = u32::try_from(index)?;

I will also remove the blank line between the trailers.

________________________________
发件人: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
发送时间: 2026年8月31日 17:50
收件人: aiqubits@hotmail.com <aiqubits@hotmail.com>
抄送: Danilo Krummrich <dakr@kernel.org>; Bjorn Helgaas <bhelgaas@google.com>; Krzysztof Wilczyński <kwilczynski@kernel.org>; Miguel Ojeda <ojeda@kernel.org>; Boqun Feng <boqun@kernel.org>; Gary Guo <gary@garyguo.net>; Björn Roy Baron <bjorn3_gh@protonmail.com>; Benno Lossin <lossin@kernel.org>; Andreas Hindborg <a.hindborg@kernel.org>; Alice Ryhl <aliceryhl@google.com>; Trevor Gross <tmgross@umich.edu>; Daniel Almeida <daniel.almeida@collabora.com>; Tamir Duberstein <tamird@kernel.org>; Alexandre Courbot <acourbot@nvidia.com>; Onur Özkan <work@onurozkan.dev>; linux-pci@vger.kernel.org <linux-pci@vger.kernel.org>; rust-for-linux@vger.kernel.org <rust-for-linux@vger.kernel.org>; linux-kernel@vger.kernel.org <linux-kernel@vger.kernel.org>
主题: Re: [PATCH v3] rust: pci: reject out-of-bounds IRQ vector indices

On Mon, Aug 31, 2026 at 9:17 AM Sophon Z via B4 Relay
<devnull+aiqubits.hotmail.com@kernel.org> wrote:
>
> Fixes: 2fb7755b0a7e ("rust: pci: resolve IRQ in index() and embed IrqRequest in IrqVector")

The tag looks good, and there is no need for Cc: stable since this is
from yesterday's -rc1, so that is good.

Nit: we usually don't do newlines between tags.

> Signed-off-by: Sophon Z <aiqubits@hotmail.com>

Is this a known identity? Please see:

  https://docs.kernel.org/process/submitting-patches.html#sign-your-work-the-developer-s-certificate-of-origin

> +        let index = u32::try_from(index).map_err(|_| EINVAL)?;

Do we need the `.map_err()`?

Thanks!

Cheers,
Miguel