e293be
diff -Naurp a/kernel/events/core.c b/kernel/events/core.c
e293be
--- a/kernel/events/core.c	2018-08-10 13:17:43.000000000 -0300
e293be
+++ b/kernel/events/core.c	2018-08-15 07:55:47.687515042 -0300
e293be
@@ -7477,7 +7477,6 @@ static void sw_perf_event_destroy(struct
e293be
 
e293be
 	WARN_ON(event->parent);
e293be
 
e293be
-	event_id = array_index_nospec(event_id, PERF_COUNT_SW_MAX);
e293be
 	static_key_slow_dec(&perf_swevent_enabled[event_id]);
e293be
 	swevent_hlist_put(event);
e293be
 }
e293be
@@ -7514,7 +7513,6 @@ static int perf_swevent_init(struct perf
e293be
 		if (err)
e293be
 			return err;
e293be
 
e293be
-		event_id = array_index_nospec(event_id, PERF_COUNT_SW_MAX);
e293be
 		static_key_slow_inc(&perf_swevent_enabled[event_id]);
e293be
 		event->destroy = sw_perf_event_destroy;
e293be
 	}
e293be
diff -aurp a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
e293be
--- a/drivers/block/zram/zram_drv.c	2018-08-10 13:17:43.000000000 -0300
e293be
+++ b/drivers/block/zram/zram_drv.c	2018-08-15 09:11:14.074903632 -0300
e293be
@@ -131,7 +131,6 @@ static inline int valid_io_request_nospe
e293be
 	/* out of range range */
e293be
 	if (unlikely(*start >= bound || end > bound || *start > end))
e293be
 		return 0;
e293be
-	*start = array_index_nospec(*start, bound);
e293be
 
e293be
 	/* I/O request is valid */
e293be
 	return 1;
e293be
diff -aurp a/drivers/gpu/drm/i915/i915_perf.c b/drivers/gpu/drm/i915/i915_perf.c
e293be
--- a/drivers/gpu/drm/i915/i915_perf.c	2018-08-10 13:17:43.000000000 -0300
e293be
+++ b/drivers/gpu/drm/i915/i915_perf.c	2018-08-15 09:47:26.886738292 -0300
e293be
@@ -2758,7 +2758,6 @@ static int read_properties_unlocked(stru
e293be
 					  value);
e293be
 				return -EINVAL;
e293be
 			}
e293be
-			value = array_index_nospec(value, I915_OA_FORMAT_MAX);
e293be
 
e293be
 			if (!dev_priv->perf.oa.oa_formats[value].size) {
e293be
 				DRM_DEBUG("Unsupported OA report format %llu\n",
e293be
diff -aurp a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
e293be
--- a/drivers/gpu/drm/i915/intel_sdvo.c	2018-08-10 13:17:43.000000000 -0300
e293be
+++ b/drivers/gpu/drm/i915/intel_sdvo.c	2018-08-15 09:21:16.000040109 -0300
e293be
@@ -2112,7 +2112,6 @@ intel_sdvo_connector_atomic_set_property
e293be
 	struct intel_sdvo_connector_state *sdvo_state = to_intel_sdvo_connector_state(state);
e293be
 
e293be
 	if (property == intel_sdvo_connector->tv_format) {
e293be
-		val = array_index_nospec(val, TV_FORMAT_NUM);
e293be
 		state->tv.mode = intel_sdvo_connector->tv_format_supported[val];
e293be
 
e293be
 		if (state->crtc) {
e293be
diff -aurp a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
e293be
--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c	2018-08-10 13:17:43.000000000 -0300
e293be
+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c	2018-08-15 09:51:54.042321944 -0300
e293be
@@ -1525,7 +1525,6 @@ static int mlx4_en_flow_replace(struct n
e293be
 	u32 qpn;
e293be
 	u64 reg_id;
e293be
 	u32 location;
e293be
-	u64 ring_cookie;
e293be
 
e293be
 	struct mlx4_net_trans_rule rule = {
e293be
 		.queue_mode = MLX4_NET_TRANS_Q_FIFO,
e293be
@@ -1549,10 +1548,8 @@ static int mlx4_en_flow_replace(struct n
e293be
 				cmd->fs.ring_cookie);
e293be
 			return -EINVAL;
e293be
 		}
e293be
-		ring_cookie = array_index_nospec(cmd->fs.ring_cookie,
e293be
-						 priv->rx_ring_num);
e293be
 
e293be
-		qpn = priv->rss_map.qps[ring_cookie].qpn;
e293be
+		qpn = priv->rss_map.qps[cmd->fs.ring_cookie].qpn;
e293be
 		if (!qpn) {
e293be
 			en_warn(priv, "rxnfc: RX ring (%llu) is inactive\n",
e293be
 				cmd->fs.ring_cookie);
e293be
diff -aurp a/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c
e293be
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c	2018-08-10 13:17:43.000000000 -0300
e293be
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c	2018-08-15 09:54:39.458206629 -0300
e293be
@@ -393,8 +393,6 @@ static int validate_flow(struct mlx5e_pr
e293be
 	if (fs->ring_cookie >= priv->channels.params.num_channels &&
e293be
 	    fs->ring_cookie != RX_CLS_FLOW_DISC)
e293be
 		return -EINVAL;
e293be
-	fs->ring_cookie = array_index_nospec(fs->ring_cookie,
e293be
-					     priv->channels.params.num_channels);
e293be
 
e293be
 	switch (fs->flow_type & ~(FLOW_EXT | FLOW_MAC_EXT)) {
e293be
 	case ETHER_FLOW:
e293be
diff -aurp a/fs/btrfs/send.c b/fs/btrfs/send.c
e293be
--- a/fs/btrfs/send.c	2018-08-10 13:17:43.000000000 -0300
e293be
+++ b/fs/btrfs/send.c	2018-08-15 09:07:07.461535085 -0300
e293be
@@ -6215,8 +6215,7 @@ long btrfs_ioctl_send(struct file *mnt_f
e293be
 		goto out;
e293be
 	}
e293be
 
e293be
-	sctx->clone_roots_cnt = array_index_nospec(arg->clone_sources_count,
e293be
-						   ULLONG_MAX / sizeof(*arg->clone_sources) + 1);
e293be
+	sctx->clone_roots_cnt = arg->clone_sources_count;
e293be
 
e293be
 	sctx->send_max_size = BTRFS_SEND_BUF_SIZE;
e293be
 	sctx->send_buf = kvmalloc(sctx->send_max_size, GFP_KERNEL);