Re: [PATCH] i386/tdx: Fix the UAF issue in tdx_fetch_cpuid()

[Xiaoyao Li <xiaoyao.li@intel.com>]

On 3/24/2026 1:35 PM, Philippe Mathieu-Daudé wrote:
> On 24/3/26 02:23, Xiaoyao Li wrote:
>> Fix the UAF issue by reading the returned size before freeing the
>> fetch_cpuid structure.
>>
>> Link: https://lore.kernel.org/ 
>> r/758d7f2c-938f-49cb-89fc-980fc8e020b2@weilnetz.de
> 
> Fixes: e3d1a4a6d1d ("i386/tdx: Fetch and validate CPUID of TD guest")

Oh, I missed this.

Thanks for providing it!

>> Reported-by: Stefan Weil <sw@weilnetz.de>
>> Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
>> ---
>>   target/i386/kvm/tdx.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
>> index 4cae99c281ac..e578110df4da 100644
>> --- a/target/i386/kvm/tdx.c
>> +++ b/target/i386/kvm/tdx.c
>> @@ -847,8 +847,8 @@ static struct kvm_cpuid2 *tdx_fetch_cpuid(CPUState 
>> *cpu, int *ret)
>>           fetch_cpuid->nent = size;
>>           r = tdx_vcpu_ioctl(cpu, KVM_TDX_GET_CPUID, 0, fetch_cpuid, 
>> &local_err);
>>           if (r == -E2BIG) {
>> -            g_free(fetch_cpuid);
>>               size = fetch_cpuid->nent;
>> +            g_free(fetch_cpuid);
>>           }
>>       } while (r == -E2BIG);
>