[PATCH 5/5] PCI: endpoint: Reject a zero interrupt number in raise_irq

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@xxxxxxxxxx>

pci_epc_raise_irq() passes interrupt_num straight through to the
controller's raise_irq callback.  The DWC and other controllers compute
"msg_data | (interrupt_num - 1)" for MSI/MSI-X, so an interrupt_num of 0
underflows to 65535 and raises a message with a bogus vector that no
configured MSI/MSI-X entry matches.

Reject interrupt_num == 0 for the MSI and MSI-X types in the core API.
INTx raises use interrupt_num 0 and are unaffected.

Fixes: 5e8cb4033807 ("PCI: endpoint: Add EP core layer to enable EP controller and EP functions")
Signed-off-by: Shao Mingyin <shao.mingyin@xxxxxxxxxx>
---
Tested on 7.3.0-next-20261030 (QEMU/TCG guest).  QEMU has no PCI EP
controller model, so a TEST-ONLY hook (applied to both kernels, not part
of this patch) fabricates a pci_epc whose ops->raise_irq records whether
it is called, then drives pci_epc_raise_irq() with interrupt_num 0 for
MSI and MSI-X.  Without this fix both reach the controller callback (the
DWC style "msg_data | (interrupt_num - 1)" would underflow to 65535);
with this fix both are rejected with -EINVAL while INTx (interrupt_num 0)
still reaches the callback unchanged.

diff --git a/drivers/pci/endpoint/pci-epc-core.c b/drivers/pci/endpoint/pci-epc-core.c
index 831b40458dcd..d8e5dd6355ac 100644
--- a/drivers/pci/endpoint/pci-epc-core.c
+++ b/drivers/pci/endpoint/pci-epc-core.c
@@ -295,6 +295,10 @@ int pci_epc_raise_irq(struct pci_epc *epc, u8 func_no, u8 vfunc_no,
 	if (!pci_epc_function_is_valid(epc, func_no, vfunc_no))
 		return -EINVAL;
 
+	if ((type == PCI_IRQ_MSI || type == PCI_IRQ_MSIX) &&
+	    !interrupt_num)
+		return -EINVAL;
+
 	if (!epc->ops->raise_irq)
 		return 0;