github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-12 12:34:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

rust: pci: reject IRQ vector indices that do not fit in u32

Browse Source 
IrqVectorRegistration::index() accepts a usize, but pci_irq_vector()
takes an unsigned int. On 64-bit architectures, casting an index larger
than u32::MAX wraps it before the PCI core can validate it. In
particular, u32::MAX + 1 becomes zero and can resolve to the first
allocated vector.

Use a checked conversion and return EINVAL when the index cannot be
represented by the C API.

Fixes: 2fb7755b0a ("rust: pci: resolve IRQ in index() and embed IrqRequest in IrqVector")
Signed-off-by: Sophon Zhang <aiqubits@hotmail.com>
Reviewed-by: Gary Guo <gary@garyguo.net>
Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
Link: https://patch.msgid.link/20260901-fix-pci-irq-vector-index-truncation-v4-1-f94aa6932fd9@hotmail.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
This commit is contained in:
Sophon Zhang 2026-09-01 01:09:53 +08:00 committed by Danilo Krummrich
parent 7b15d6cf25
commit 8d7b3e41ff
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
rust/kernel/pci/irq.rs
View File

@ -151,8 +151,10 @@ pub fn irq_type(&self) -> IrqType {
/// [`Self::len()`].
#[inline]
pub fn index(&self, index: usize) -> Result<IrqVector<'_>> {
let index = u32::try_from(index)?;
// SAFETY: `self.dev.as_raw()` is a valid pointer to a `struct pci_dev`.
let irq = unsafe { bindings::pci_irq_vector(self.dev.as_raw(), index as u32) };
let irq = unsafe { bindings::pci_irq_vector(self.dev.as_raw(), index) };
if irq < 0 {
return Err(Error::from_errno(irq));
}