KVM: fix spectrev1 gadgets

These were found with smatch, and then generalized when applicable.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

2 files changed, 7 insertions, 4 deletions

diff --git a/virt/kvm/irqchip.c b/virt/kvm/irqchip.c
index 3547b0d8c91e..79e59e4fa3dc 100644
--- a/virt/kvm/irqchip.c
+++ b/virt/kvm/irqchip.c
@@ -144,18 +144,19 @@ static int setup_routing_entry(struct kvm *kvm,
 {
         struct kvm_kernel_irq_routing_entry *ei;
         int r;
+        u32 gsi = array_index_nospec(ue->gsi, KVM_MAX_IRQ_ROUTES);
 
         /*
          * Do not allow GSI to be mapped to the same irqchip more than once.
          * Allow only one to one mapping between GSI and non-irqchip routing.
          */
-        hlist_for_each_entry(ei, &rt->map[ue->gsi], link)
+        hlist_for_each_entry(ei, &rt->map[gsi], link)
                 if (ei->type != KVM_IRQ_ROUTING_IRQCHIP ||
                     ue->type != KVM_IRQ_ROUTING_IRQCHIP ||
                     ue->u.irqchip.irqchip == ei->irqchip.irqchip)
                         return -EINVAL;
 
-        e->gsi = ue->gsi;
+        e->gsi = gsi;
         e->type = ue->type;
         r = kvm_set_routing_entry(kvm, e, ue);
         if (r)
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 55fe8e20d8fd..dc8edc97ba85 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -2977,12 +2977,14 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
         struct kvm_device_ops *ops = NULL;
         struct kvm_device *dev;
         bool test = cd->flags & KVM_CREATE_DEVICE_TEST;
+        int type;
         int ret;
 
         if (cd->type >= ARRAY_SIZE(kvm_device_ops_table))
                 return -ENODEV;
 
-        ops = kvm_device_ops_table[cd->type];
+        type = array_index_nospec(cd->type, ARRAY_SIZE(kvm_device_ops_table));
+        ops = kvm_device_ops_table[type];
         if (ops == NULL)
                 return -ENODEV;
 
@@ -2997,7 +2999,7 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
         dev->kvm = kvm;
 
         mutex_lock(&kvm->lock);
-        ret = ops->create(dev, cd->type);
+        ret = ops->create(dev, type);
         if (ret < 0) {
                 mutex_unlock(&kvm->lock);
                 kfree(dev);