2 files changed, 3 insertions, 4 deletions

diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index a9a20528e700..ee768bb2367f 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -1181,7 +1181,8 @@ void kvm_mmu_write_protect_pt_masked(struct kvm *kvm,
         unsigned long *rmapp;
 
         while (mask) {
-                rmapp = &slot->rmap[gfn_offset + __ffs(mask)];
+                rmapp = __gfn_to_rmap(slot->base_gfn + gfn_offset + __ffs(mask),
+                                      PT_PAGE_TABLE_LEVEL, slot);
                 __rmap_write_protect(kvm, rmapp, PT_PAGE_TABLE_LEVEL, false);
 
                 /* clear the first set bit */
diff --git a/arch/x86/kvm/mmu_audit.c b/arch/x86/kvm/mmu_audit.c
index 7d7d0b9e23eb..ca403f9bb0f2 100644
--- a/arch/x86/kvm/mmu_audit.c
+++ b/arch/x86/kvm/mmu_audit.c
@@ -190,7 +190,6 @@ static void check_mappings_rmap(struct kvm *kvm, struct kvm_mmu_page *sp)
 
 static void audit_write_protection(struct kvm *kvm, struct kvm_mmu_page *sp)
 {
-        struct kvm_memory_slot *slot;
         unsigned long *rmapp;
         u64 *sptep;
         struct rmap_iterator iter;
@@ -198,8 +197,7 @@ static void audit_write_protection(struct kvm *kvm, struct kvm_mmu_page *sp)
         if (sp->role.direct || sp->unsync || sp->role.invalid)
                 return;
 
-        slot = gfn_to_memslot(kvm, sp->gfn);
-        rmapp = &slot->rmap[sp->gfn - slot->base_gfn];
+        rmapp = gfn_to_rmap(kvm, sp->gfn, PT_PAGE_TABLE_LEVEL);
 
         for (sptep = rmap_get_first(*rmapp, &iter); sptep;
              sptep = rmap_get_next(&iter)) {