SYS_NUM_MSI is the number of available system MSIs. OpenSBI and the Linux
wired-MSI domain therefore treat valid system MSI indices as the half-open
range [0, SYS_NUM_MSI). The driver stores this count in nr_irqs, but its
translation callback only subtracts gsi_base.

For DT, gsi_base is zero, so an interrupt specifier at or above
SYS_NUM_MSI can be retained as the hardware interrupt number. The wired
MSI allocation path uses a separate descriptor index and preserves the
hardware number in the MSI cookie, so the domain size does not reject it.

Reject a raw value below gsi_base and a translated value outside that
half-open range.

Fixes: aa43953e862c ("irqchip: Add driver for the RPMI system MSI service group")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/irqchip/irq-riscv-rpmi-sysmsi.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-riscv-rpmi-sysmsi.c b/drivers/irqchip/irq-riscv-rpmi-sysmsi.c
index 612f3972f7af0..9d957f8a12477 100644
--- a/drivers/irqchip/irq-riscv-rpmi-sysmsi.c
+++ b/drivers/irqchip/irq-riscv-rpmi-sysmsi.c
@@ -174,8 +174,13 @@ static int rpmi_sysmsi_translate(struct irq_domain *d, struct irq_fwspec *fwspec
 	if (WARN_ON(fwspec->param_count < 1))
 		return -EINVAL;
 
-	/* For DT, gsi_base is always zero. */
+	if (fwspec->param[0] < priv->gsi_base)
+		return -EINVAL;
+
 	*hwirq = fwspec->param[0] - priv->gsi_base;
+	if (*hwirq >= priv->nr_irqs)
+		return -EINVAL;
+
 	*type = IRQ_TYPE_NONE;
 	return 0;
 }
-- 
2.43.0