[xen staging] xen/evtchn: fix wrong usage of array_index_nospec()

[patchbot@xxxxxxx]

commit 3a6cb6aae45ae979c47308e0cbb01e713a3ddd92
Author:     Juergen Gross <jgross@xxxxxxxx>
AuthorDate: Mon Aug 3 09:50:07 2026 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Mon Aug 3 09:50:07 2026 +0200

    xen/evtchn: fix wrong usage of array_index_nospec()
    
    The size passed to array_index_nospec() in evtchn_fifo_word_from_port()
    doesn't match the value it is meant to clamp.
    
    Fix it by clamping the port to a safe interval and use that value to
    calculate the event_array[] index and the offset into the page
    addressed by the array element.
    
    Fixes: 443d3ab6daee ("evtchn: block speculative out-of-bound accesses")
    Signed-off-by: Juergen Gross <jgross@xxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
---
 xen/common/event_fifo.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/xen/common/event_fifo.c b/xen/common/event_fifo.c
index cae08a594e..611bf8a788 100644
--- a/xen/common/event_fifo.c
+++ b/xen/common/event_fifo.c
@@ -71,11 +71,10 @@ static inline event_word_t 
*evtchn_fifo_word_from_port(const struct domain *d,
      */
     smp_rmb();
 
-    p = array_index_nospec(port / EVTCHN_FIFO_EVENT_WORDS_PER_PAGE,
-                           d->evtchn_fifo->num_evtchns);
+    p = array_index_nospec(port, d->evtchn_fifo->num_evtchns);
     w = port % EVTCHN_FIFO_EVENT_WORDS_PER_PAGE;
 
-    return d->evtchn_fifo->event_array[p] + w;
+    return d->evtchn_fifo->event_array[p / EVTCHN_FIFO_EVENT_WORDS_PER_PAGE] + 
w;
 }
 
 static void cf_check evtchn_fifo_init(struct domain *d, struct evtchn *evtchn)
--
generated by git-patchbot for /home/xen/git/xen.git#staging