AZL-97269

In the Linux kernel, the following vulnerability has been resolved:

Input: evdev - sanitize event type index when fetching event masks

The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK ioctls is used to index the static counts array in evdevgetmaskcnt() and client evmasks array in evdevget_mask().

While the event type is architecturally bounded by EV_CNT, speculative execution may mispredict bounds checks and perform out-of-bounds loads.

Sanitize the event type index in evdevgetmaskcnt() branchlessly using arrayindexmasknospec(). This clamps the index to 0 for safe array access and forces the returned count to 0 speculatively when the index is out of bounds.

We do not need additional arrayindexnospec() calls in evdevgetmask() because evdevgetmaskcnt() speculatively forces the count (and resulting xfersize) to 0 for out-of-bounds types, preventing any speculative memory access to client evmasks array.