[PATCH] vfio/pci: Make VFIO_PCI_OFFSET_TO_INDEX() return unsigned

[PATCH] vfio/pci: Make VFIO_PCI_OFFSET_TO_INDEX() return unsigned

[Matt Evans]

VFIO_PCI_OFFSET_TO_INDEX() is used in several places with a signed
parameter (e.g. loff_t).  Because it makes no sense for a BAR/resource
index to be negative, enforce this in the macro.

This fixes at least one current issue, where vfio_pci_ioeventfd() uses
this macro with an unvalidated signed loff_t returned into a signed
type, leading to a possible negative array access.  This instance does
test against an out-of-bounds positive value, so treating the index as
unsigned fixes this issue.

Fixes: 89e1f7d4c66d8 ("vfio: Add PCI device driver")
Signed-off-by: Matt Evans <mattev@meta.com>
---

This patch follows up on a nearby issue found during review, discussed
here:

https://lore.kernel.org/kvm/20260508114552.6f5b99f0@shazbot.org/

 include/linux/vfio_pci_core.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/vfio_pci_core.h b/include/linux/vfio_pci_core.h
index 2ebba746c18f..89165b769e5c 100644
--- a/include/linux/vfio_pci_core.h
+++ b/include/linux/vfio_pci_core.h
@@ -21,7 +21,7 @@
 #define VFIO_PCI_CORE_H
 
 #define VFIO_PCI_OFFSET_SHIFT   40
-#define VFIO_PCI_OFFSET_TO_INDEX(off)	(off >> VFIO_PCI_OFFSET_SHIFT)
+#define VFIO_PCI_OFFSET_TO_INDEX(off)	((u64)(off) >> VFIO_PCI_OFFSET_SHIFT)
 #define VFIO_PCI_INDEX_TO_OFFSET(index)	((u64)(index) << VFIO_PCI_OFFSET_SHIFT)
 #define VFIO_PCI_OFFSET_MASK	(((u64)(1) << VFIO_PCI_OFFSET_SHIFT) - 1)
 
-- 
2.47.3

Re: [PATCH] vfio/pci: Make VFIO_PCI_OFFSET_TO_INDEX() return unsigned

[Alex Williamson]

On Mon, 11 May 2026 07:46:42 -0700
Matt Evans <mattev@meta.com> wrote:

> VFIO_PCI_OFFSET_TO_INDEX() is used in several places with a signed
> parameter (e.g. loff_t).  Because it makes no sense for a BAR/resource
> index to be negative, enforce this in the macro.
> 
> This fixes at least one current issue, where vfio_pci_ioeventfd() uses
> this macro with an unvalidated signed loff_t returned into a signed
> type, leading to a possible negative array access.  This instance does
> test against an out-of-bounds positive value, so treating the index as
> unsigned fixes this issue.
> 
> Fixes: 89e1f7d4c66d8 ("vfio: Add PCI device driver")
> Signed-off-by: Matt Evans <mattev@meta.com>
> ---
> 
> This patch follows up on a nearby issue found during review, discussed
> here:
> 
> https://lore.kernel.org/kvm/20260508114552.6f5b99f0@shazbot.org/
> 
>  include/linux/vfio_pci_core.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/include/linux/vfio_pci_core.h b/include/linux/vfio_pci_core.h
> index 2ebba746c18f..89165b769e5c 100644
> --- a/include/linux/vfio_pci_core.h
> +++ b/include/linux/vfio_pci_core.h
> @@ -21,7 +21,7 @@
>  #define VFIO_PCI_CORE_H
>  
>  #define VFIO_PCI_OFFSET_SHIFT   40
> -#define VFIO_PCI_OFFSET_TO_INDEX(off)	(off >> VFIO_PCI_OFFSET_SHIFT)
> +#define VFIO_PCI_OFFSET_TO_INDEX(off)	((u64)(off) >> VFIO_PCI_OFFSET_SHIFT)
>  #define VFIO_PCI_INDEX_TO_OFFSET(index)	((u64)(index) << VFIO_PCI_OFFSET_SHIFT)
>  #define VFIO_PCI_OFFSET_MASK	(((u64)(1) << VFIO_PCI_OFFSET_SHIFT) - 1)


Applied to vfio for-linus branch for v7.1-rc.  Thanks,

Alex