tdx: fix use-after-free in tdx_fetch_cpuid

[PATCH] tdx: fix use-after-free in tdx_fetch_cpuid

Paolo Bonzini posted 1 patch 1 week, 4 days ago

Download mbox

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20260323085527.2083921-1-pbonzini@redhat.com

Maintainers: Paolo Bonzini <pbonzini@redhat.com>, Marcelo Tosatti <mtosatti@redhat.com>

target/i386/kvm/tdx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

Expand all Fold all

[PATCH] tdx: fix use-after-free in tdx_fetch_cpuid

Posted by Paolo Bonzini 1 week, 4 days ago

This is mostly harmless right now because the "if" is never
hit, but the code as written makes no sense.

Reported-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/tdx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 4cae99c281a..4714c9d514e 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -848,7 +848,7 @@ static struct kvm_cpuid2 *tdx_fetch_cpuid(CPUState *cpu, int *ret)
         r = tdx_vcpu_ioctl(cpu, KVM_TDX_GET_CPUID, 0, fetch_cpuid, &local_err);
         if (r == -E2BIG) {
             g_free(fetch_cpuid);
-            size = fetch_cpuid->nent;
+            size *= 2;
         }
     } while (r == -E2BIG);
 
-- 
2.53.0

Re: [PATCH] tdx: fix use-after-free in tdx_fetch_cpuid

Posted by Stefan Weil via qemu development 1 week, 4 days ago

Am 23.03.26 um 09:55 schrieb Paolo Bonzini:

> This is mostly harmless right now because the "if" is never
> hit, but the code as written makes no sense.
>
> Reported-by: Stefan Weil <sw@weilnetz.de>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> ---
>   target/i386/kvm/tdx.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
> index 4cae99c281a..4714c9d514e 100644
> --- a/target/i386/kvm/tdx.c
> +++ b/target/i386/kvm/tdx.c
> @@ -848,7 +848,7 @@ static struct kvm_cpuid2 *tdx_fetch_cpuid(CPUState *cpu, int *ret)
>           r = tdx_vcpu_ioctl(cpu, KVM_TDX_GET_CPUID, 0, fetch_cpuid, &local_err);
>           if (r == -E2BIG) {
>               g_free(fetch_cpuid);
> -            size = fetch_cpuid->nent;
> +            size *= 2;
>           }
>       } while (r == -E2BIG);


Reviewed-by: Stefan Weil <sw@weilnetz.de>

Paolo, thank you for the fast fix. The GitHub code scanning currently 
reports 23 issues with severity critical (one fixed with the commit 
above) or high. It might be a good idea to enable CodeQL for the 
official mirror https://github.com/qemu/qemu.

Regards

Stefan