[PATCH] iommu/amd: Use array_index_nospec() for rlookup_table index

[Dheeraj Kumar Srivastava]

Use array_index_nospec() to prevent speculative out-of-bounds
access when indexing pci_seg->rlookup_table with a user provided
device id.

Signed-off-by: Dheeraj Kumar Srivastava <dheerajkumar.srivastava@xxxxxxx>
Reviewed-by: Sairaj Kodilkar <Sairaj.ArunKodilkar@xxxxxxx>
Reported-by: kernel test robot <lkp@xxxxxxxxx>
Reported-by: Dan Carpenter <error27@xxxxxxxxx>
Closes: https://lore.kernel.org/r/202510281233.q4cBnp3z-lkp@xxxxxxxxx/
---
 drivers/iommu/amd/debugfs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/iommu/amd/debugfs.c b/drivers/iommu/amd/debugfs.c
index 10fa217a7119..4990f6db99ef 100644
--- a/drivers/iommu/amd/debugfs.c
+++ b/drivers/iommu/amd/debugfs.c
@@ -174,6 +174,7 @@ static ssize_t devid_write(struct file *filp, const char __user *ubuf,
 			kfree(srcid_ptr);
 			return -EINVAL;
 		}
+		devid = array_index_nospec(devid, (u32)pci_seg->last_bdf + 1);
 		iommu = pci_seg->rlookup_table[devid];
 		if (!iommu) {
 			kfree(srcid_ptr);
-- 
2.25.1