On Fri, 2025-01-24 at 08:20 -0500, Xiaoyao Li wrote: > diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c > index 45867dbe0839..e35a9fbd687e 100644 > --- a/accel/kvm/kvm-all.c > +++ b/accel/kvm/kvm-all.c > @@ -540,8 +540,15 @@ int kvm_init_vcpu(CPUState *cpu, Error **errp) > > trace_kvm_init_vcpu(cpu->cpu_index, kvm_arch_vcpu_id(cpu)); > > + /* > + * tdx_pre_create_vcpu() may call cpu_x86_cpuid(). It in turn > may call > + * kvm_vm_ioctl(). Set cpu->kvm_state in advance to avoid NULL > pointer > + * dereference. > + */ > + cpu->kvm_state = s; This assignment should be removed from kvm_create_vcpu(), as now it's redundant there. > ret = kvm_arch_pre_create_vcpu(cpu, errp); > if (ret < 0) { > + cpu->kvm_state = NULL; No need to reset cpu->kvm_state to NULL, there already are other error conditions under which cpu->kvm_state remains initialized. > goto err; > } > > @@ -550,6 +557,7 @@ int kvm_init_vcpu(CPUState *cpu, Error **errp) > error_setg_errno(errp, -ret, > "kvm_init_vcpu: kvm_create_vcpu failed > (%lu)", > kvm_arch_vcpu_id(cpu)); > + cpu->kvm_state = NULL; Same here.