1 files changed, 4 insertions, 2 deletions

diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 5dc174ac8cac..34ea219936e3 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -2071,8 +2071,10 @@ static int translate_desc(struct vhost_virtqueue *vq, u64 addr, u32 len,
                 _iov = iov + ret;
                 size = node->size - addr + node->start;
                 _iov->iov_len = min((u64)len - s, size);
-                _iov->iov_base = (void __user *)(unsigned long)
-                        (node->userspace_addr + addr - node->start);
+                _iov->iov_base = (void __user *)
+                        ((unsigned long)node->userspace_addr +
+                         array_index_nospec((unsigned long)(addr - node->start),
+                                            node->size));
                 s += size;
                 addr += size;
                 ++ret;