diff -Naurp a/kernel/events/core.c b/kernel/events/core.c
--- a/kernel/events/core.c 2018-08-10 13:17:43.000000000 -0300
+++ b/kernel/events/core.c 2018-08-15 07:55:47.687515042 -0300
@@ -7477,7 +7477,6 @@ static void sw_perf_event_destroy(struct
WARN_ON(event->parent);
- event_id = array_index_nospec(event_id, PERF_COUNT_SW_MAX);
static_key_slow_dec(&perf_swevent_enabled[event_id]);
swevent_hlist_put(event);
}
@@ -7514,7 +7513,6 @@ static int perf_swevent_init(struct perf
if (err)
return err;
- event_id = array_index_nospec(event_id, PERF_COUNT_SW_MAX);
static_key_slow_inc(&perf_swevent_enabled[event_id]);
event->destroy = sw_perf_event_destroy;
}
diff -aurp a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
--- a/drivers/block/zram/zram_drv.c 2018-08-10 13:17:43.000000000 -0300
+++ b/drivers/block/zram/zram_drv.c 2018-08-15 09:11:14.074903632 -0300
@@ -131,7 +131,6 @@ static inline int valid_io_request_nospe
/* out of range range */
if (unlikely(*start >= bound || end > bound || *start > end))
return 0;
- *start = array_index_nospec(*start, bound);
/* I/O request is valid */
return 1;
diff -aurp a/drivers/gpu/drm/i915/i915_perf.c b/drivers/gpu/drm/i915/i915_perf.c
--- a/drivers/gpu/drm/i915/i915_perf.c 2018-08-10 13:17:43.000000000 -0300
+++ b/drivers/gpu/drm/i915/i915_perf.c 2018-08-15 09:47:26.886738292 -0300
@@ -2758,7 +2758,6 @@ static int read_properties_unlocked(stru
value);
return -EINVAL;
}
- value = array_index_nospec(value, I915_OA_FORMAT_MAX);
if (!dev_priv->perf.oa.oa_formats[value].size) {
DRM_DEBUG("Unsupported OA report format %llu\n",
diff -aurp a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
--- a/drivers/gpu/drm/i915/intel_sdvo.c 2018-08-10 13:17:43.000000000 -0300
+++ b/drivers/gpu/drm/i915/intel_sdvo.c 2018-08-15 09:21:16.000040109 -0300
@@ -2112,7 +2112,6 @@ intel_sdvo_connector_atomic_set_property
struct intel_sdvo_connector_state *sdvo_state = to_intel_sdvo_connector_state(state);
if (property == intel_sdvo_connector->tv_format) {
- val = array_index_nospec(val, TV_FORMAT_NUM);
state->tv.mode = intel_sdvo_connector->tv_format_supported[val];
if (state->crtc) {
diff -aurp a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c 2018-08-10 13:17:43.000000000 -0300
+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c 2018-08-15 09:51:54.042321944 -0300
@@ -1525,7 +1525,6 @@ static int mlx4_en_flow_replace(struct n
u32 qpn;
u64 reg_id;
u32 location;
- u64 ring_cookie;
struct mlx4_net_trans_rule rule = {
.queue_mode = MLX4_NET_TRANS_Q_FIFO,
@@ -1549,10 +1548,8 @@ static int mlx4_en_flow_replace(struct n
cmd->fs.ring_cookie);
return -EINVAL;
}
- ring_cookie = array_index_nospec(cmd->fs.ring_cookie,
- priv->rx_ring_num);
- qpn = priv->rss_map.qps[ring_cookie].qpn;
+ qpn = priv->rss_map.qps[cmd->fs.ring_cookie].qpn;
if (!qpn) {
en_warn(priv, "rxnfc: RX ring (%llu) is inactive\n",
cmd->fs.ring_cookie);
diff -aurp a/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c 2018-08-10 13:17:43.000000000 -0300
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c 2018-08-15 09:54:39.458206629 -0300
@@ -393,8 +393,6 @@ static int validate_flow(struct mlx5e_pr
if (fs->ring_cookie >= priv->channels.params.num_channels &&
fs->ring_cookie != RX_CLS_FLOW_DISC)
return -EINVAL;
- fs->ring_cookie = array_index_nospec(fs->ring_cookie,
- priv->channels.params.num_channels);
switch (fs->flow_type & ~(FLOW_EXT | FLOW_MAC_EXT)) {
case ETHER_FLOW:
diff -aurp a/fs/btrfs/send.c b/fs/btrfs/send.c
--- a/fs/btrfs/send.c 2018-08-10 13:17:43.000000000 -0300
+++ b/fs/btrfs/send.c 2018-08-15 09:07:07.461535085 -0300
@@ -6215,8 +6215,7 @@ long btrfs_ioctl_send(struct file *mnt_f
goto out;
}
- sctx->clone_roots_cnt = array_index_nospec(arg->clone_sources_count,
- ULLONG_MAX / sizeof(*arg->clone_sources) + 1);
+ sctx->clone_roots_cnt = arg->clone_sources_count;
sctx->send_max_size = BTRFS_SEND_BUF_SIZE;
sctx->send_buf = kvmalloc(sctx->send_max_size, GFP_KERNEL);