Re: [PATCH v2] KVM: TDX: Reject concurrent change to CPUID entry count

[Sean Christopherson]

On Fri, 10 Jul 2026 11:53:23 +0800, Binbin Wu wrote:
> Reject KVM_TDX_INIT_VM if userspace changes cpuid.nent between the
> initial read and the subsequent copy of the initialization data.
> 
> tdx_td_init() first reads user_data->cpuid.nent to size the flexible
> kvm_tdx_init_vm copy.  The copied structure also contains cpuid.nent,
> and that field can differ from the value used to size the allocation if
> userspace modifies the input concurrently.  setup_tdparams_cpuids() later
> passes init_vm->cpuid.nent to kvm_find_cpuid_entry2(), which uses it as
> the array bound for the copied entries.
> 
> [...]

Applied to kvm-x86 fixes, thanks!

[1/1] KVM: TDX: Reject concurrent change to CPUID entry count
      https://github.com/kvm-x86/linux/commit/cfbebb55e512

--
https://github.com/kvm-x86/linux/tree/next