--- /dev/null
+From 532a0c57d7ff75e8f07d4e25cba4184989e2a241 Mon Sep 17 00:00:00 2001
+From: Dave Hansen <dave.hansen@linux.intel.com>
+Date: Tue, 12 Mar 2024 07:27:57 -0700
+Subject: Revert "x86/bugs: Use fixed addressing for VERW operand"
+
+From: Dave Hansen <dave.hansen@linux.intel.com>
+
+commit 532a0c57d7ff75e8f07d4e25cba4184989e2a241 upstream.
+
+This was reverts commit 8009479ee919b9a91674f48050ccbff64eafedaa.
+
+It was originally in x86/urgent, but was deemed wrong so got zapped.
+But in the meantime, x86/urgent had been merged into x86/apic to
+resolve a conflict. I didn't notice the merge so didn't zap it
+from x86/apic and it managed to make it up with the x86/apic
+material.
+
+The reverted commit is known to cause some KASAN problems.
+
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/include/asm/nospec-branch.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -332,7 +332,7 @@
+ * Note: Only the memory operand variant of VERW clears the CPU buffers.
+ */
+ .macro CLEAR_CPU_BUFFERS
+- ALTERNATIVE "", __stringify(verw mds_verw_sel), X86_FEATURE_CLEAR_CPU_BUF
++ ALTERNATIVE "", __stringify(verw _ASM_RIP(mds_verw_sel)), X86_FEATURE_CLEAR_CPU_BUF
+ .endm
+
+ #else /* __ASSEMBLY__ */