From fc203d45b67c9b68c764b5b65a0bc10ce6369e21 Mon Sep 17 00:00:00 2001 From: Juergen Gross Date: Mon, 24 Aug 2026 11:51:31 +0200 Subject: [PATCH] xen/evtchn: fix wrong usage of array_index_nospec() The size passed to array_index_nospec() in evtchn_fifo_word_from_port() doesn't match the value it is meant to clamp. Fix it by clamping the port to a safe interval and use that value to calculate the event_array[] index. Fixes: 443d3ab6daee ("evtchn: block speculative out-of-bound accesses") Signed-off-by: Juergen Gross Reviewed-by: Jan Beulich master commit: 3a6cb6aae45ae979c47308e0cbb01e713a3ddd92 master date: 2026-08-03 09:50:07 +0200 --- xen/common/event_fifo.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/xen/common/event_fifo.c b/xen/common/event_fifo.c index cae08a594e..611bf8a788 100644 --- a/xen/common/event_fifo.c +++ b/xen/common/event_fifo.c @@ -71,11 +71,10 @@ static inline event_word_t *evtchn_fifo_word_from_port(const struct domain *d, */ smp_rmb(); - p = array_index_nospec(port / EVTCHN_FIFO_EVENT_WORDS_PER_PAGE, - d->evtchn_fifo->num_evtchns); + p = array_index_nospec(port, d->evtchn_fifo->num_evtchns); w = port % EVTCHN_FIFO_EVENT_WORDS_PER_PAGE; - return d->evtchn_fifo->event_array[p] + w; + return d->evtchn_fifo->event_array[p / EVTCHN_FIFO_EVENT_WORDS_PER_PAGE] + w; } static void cf_check evtchn_fifo_init(struct domain *d, struct evtchn *evtchn)