Commit f093ee7ac3 for qemu.org

commit f093ee7ac3af06e4ed7c86663717cf571b42241e
Author: Paolo Bonzini <pbonzini@redhat.com>
Date:   Mon Mar 23 09:55:20 2026 +0100

    tdx: fix use-after-free in tdx_fetch_cpuid

    This is mostly harmless right now because the "if" is never
    hit, but the code as written makes no sense.

    Reported-by: Stefan Weil <sw@weilnetz.de>
    Cc: qemu-stable@nongnu.org
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 4cae99c281..4714c9d514 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -848,7 +848,7 @@ static struct kvm_cpuid2 *tdx_fetch_cpuid(CPUState *cpu, int *ret)
         r = tdx_vcpu_ioctl(cpu, KVM_TDX_GET_CPUID, 0, fetch_cpuid, &local_err);
         if (r == -E2BIG) {
             g_free(fetch_cpuid);
-            size = fetch_cpuid->nent;
+            size *= 2;
         }
     } while (r == -E2BIG);