[PATCH] irqchip/riscv-rpmi-sysmsi: Validate system MSI indices

[Anup Patel]

On Sat, Jul 18, 2026 at 10:07 AM Pengpeng Hou <pengpeng at iscas.ac.cn> wrote:
>
> SYS_NUM_MSI is the number of available system MSIs. OpenSBI and the Linux
> wired-MSI domain therefore treat valid system MSI indices as the half-open
> range [0, SYS_NUM_MSI). The driver stores this count in nr_irqs, but its
> translation callback only subtracts gsi_base.
>
> For DT, gsi_base is zero, so an interrupt specifier at or above
> SYS_NUM_MSI can be retained as the hardware interrupt number. The wired
> MSI allocation path uses a separate descriptor index and preserves the
> hardware number in the MSI cookie, so the domain size does not reject it.
>
> Reject a raw value below gsi_base and a translated value outside that
> half-open range.
>
> Fixes: aa43953e862c ("irqchip: Add driver for the RPMI system MSI service group")
> Signed-off-by: Pengpeng Hou <pengpeng at iscas.ac.cn>

LGTM.

Reviewed-by: Anup Patel <anup at brainfault.org>

Thanks,
Anup

> ---
>  drivers/irqchip/irq-riscv-rpmi-sysmsi.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/irqchip/irq-riscv-rpmi-sysmsi.c b/drivers/irqchip/irq-riscv-rpmi-sysmsi.c
> index 612f3972f7af0..9d957f8a12477 100644
> --- a/drivers/irqchip/irq-riscv-rpmi-sysmsi.c
> +++ b/drivers/irqchip/irq-riscv-rpmi-sysmsi.c
> @@ -174,8 +174,13 @@ static int rpmi_sysmsi_translate(struct irq_domain *d, struct irq_fwspec *fwspec
>         if (WARN_ON(fwspec->param_count < 1))
>                 return -EINVAL;
>
> -       /* For DT, gsi_base is always zero. */
> +       if (fwspec->param[0] < priv->gsi_base)
> +               return -EINVAL;
> +
>         *hwirq = fwspec->param[0] - priv->gsi_base;
> +       if (*hwirq >= priv->nr_irqs)
> +               return -EINVAL;
> +
>         *type = IRQ_TYPE_NONE;
>         return 0;
>  }
> --
> 2.43.0
>