@samitouri / QOSamiQemu / commits / f093ee7ac3

tdx: fix use-after-free in tdx_fetch_cpuid

This is mostly harmless right now because the "if" is never hit, but the code as written makes no sense. Reported-by: Stefan Weil <sw@weilnetz.de> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Paolo Bonzini committed Mar 23, 2026 at 09:55 UTC f093ee7ac3af06e4ed7c86663717cf571b42241e
1 file changed +1 -1
target/i386/kvm/tdx.c
+1 -1
@@ -848,7 +848,7 @@ static struct kvm_cpuid2 *tdx_fetch_cpuid(CPUState *cpu, int *ret)
848 r = tdx_vcpu_ioctl(cpu, KVM_TDX_GET_CPUID, 0, fetch_cpuid, &local_err);
849 if (r == -E2BIG) {
850 g_free(fetch_cpuid);
851 - size = fetch_cpuid->nent;
851 + size *= 2;
852 }
853 } while (r == -E2BIG);
854