Re: [PATCH] xen/evtchn: fix wrong usage of array_index_nospec()

On 29.07.2026 16:12, Juergen Gross wrote:
> --- a/xen/common/event_fifo.c
> +++ b/xen/common/event_fifo.c
> @@ -71,11 +71,10 @@ static inline event_word_t *evtchn_fifo_word_from_port(const struct domain *d,
>       */
>      smp_rmb();
>  
> -    p = array_index_nospec(port / EVTCHN_FIFO_EVENT_WORDS_PER_PAGE,
> -                           d->evtchn_fifo->num_evtchns);
> -    w = port % EVTCHN_FIFO_EVENT_WORDS_PER_PAGE;
> +    p = array_index_nospec(port, d->evtchn_fifo->num_evtchns);
> +    w = p % EVTCHN_FIFO_EVENT_WORDS_PER_PAGE;

I don't see why the calculation of w would also need to change - whichever way
it is, w is bounded by EVTCHN_FIFO_EVENT_WORDS_PER_PAGE (and hence safe).
Preferably with that undone (can do while committing):
Reviewed-by: Jan Beulich <[email protected]>

Jan

> -    return d->evtchn_fifo->event_array[p] + w;
> +    return d->evtchn_fifo->event_array[p / EVTCHN_FIFO_EVENT_WORDS_PER_PAGE] + w;
>  }
>  
>  static void cf_check evtchn_fifo_init(struct domain *d, struct evtchn *evtchn)