Merge tag 'v4.4.214' into 10

[sagit-ice-cold/kernel_xiaomi_msm8998.git] / arch / x86 / kvm / ioapic.c

diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
index d380111..086833e 100644 (file)
--- a/arch/x86/kvm/ioapic.c
+++ b/arch/x86/kvm/ioapic.c
@@ -36,6 +36,7 @@
 #include <linux/io.h>
 #include <linux/slab.h>
 #include <linux/export.h>
+#include <linux/nospec.h>
 #include <asm/processor.h>
 #include <asm/page.h>
 #include <asm/current.h>
@@ -73,13 +74,14 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
        default:
                {
                        u32 redir_index = (ioapic->ioregsel - 0x10) >> 1;
-                       u64 redir_content;
+                       u64 redir_content = ~0ULL;
 
-                       if (redir_index < IOAPIC_NUM_PINS)
-                               redir_content =
-                                       ioapic->redirtbl[redir_index].bits;
-                       else
-                               redir_content = ~0ULL;
+                       if (redir_index < IOAPIC_NUM_PINS) {
+                               u32 index = array_index_nospec(
+                                       redir_index, IOAPIC_NUM_PINS);
+
+                               redir_content = ioapic->redirtbl[index].bits;
+                       }
 
                        result = (ioapic->ioregsel & 0x1) ?
                            (redir_content >> 32) & 0xffffffff :
@@ -289,6 +291,7 @@ static void ioapic_write_indirect(struct kvm_ioapic *ioapic, u32 val)
                ioapic_debug("change redir index %x val %x\n", index, val);
                if (index >= IOAPIC_NUM_PINS)
                        return;
+               index = array_index_nospec(index, IOAPIC_NUM_PINS);
                e = &ioapic->redirtbl[index];
                mask_before = e->fields.mask;
                /* Preserve read-only fields */