From: Dave Hansen There are two 'kvm_cpuid2' pointers involved here. There's an "input" side: 'td_cpuid' which is a normal kernel pointer and an 'output' side. The output here is userspace and there is an attempt at properly annotating the variable with __user: struct kvm_cpuid2 __user *output, *td_cpuid; But, alas, this is wrong. The __user in the definition applies to both 'output' and 'td_cpuid'. Fix it up by completely separating the two definitions so that it is obviously correct without even having to know what the C syntax rules even are. Signed-off-by: Dave Hansen Cc: Xiaoyao Li Cc: Sean Christopherson Cc: Paolo Bonzini Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: x86@kernel.org Cc: "H. Peter Anvin" Cc: "Kirill A. Shutemov" Cc: Rick Edgecombe Cc: kvm@vger.kernel.org Cc: linux-kernel@vger.kernel.org --- b/arch/x86/kvm/vmx/tdx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff -puN arch/x86/kvm/vmx/tdx.c~tdx-sparse-fix-3 arch/x86/kvm/vmx/tdx.c --- a/arch/x86/kvm/vmx/tdx.c~tdx-sparse-fix-3 2025-10-29 12:10:10.375383704 -0700 +++ b/arch/x86/kvm/vmx/tdx.c 2025-10-29 12:10:10.379384154 -0700 @@ -3054,7 +3054,8 @@ static int tdx_vcpu_get_cpuid_leaf(struc static int tdx_vcpu_get_cpuid(struct kvm_vcpu *vcpu, struct kvm_tdx_cmd *cmd) { - struct kvm_cpuid2 __user *output, *td_cpuid; + struct kvm_cpuid2 __user *output; + struct kvm_cpuid2 *td_cpuid; int r = 0, i = 0, leaf; u32 level; _ From: Dave Hansen sparse moans: ... arch/x86/kvm/vmx/tdx.c:859:38: warning: Using plain integer as NULL pointer for several TDX pointer initializations. While I love a good ptr=0 now and then, it's good to have quiet sparse builds. Fix the sites up. Signed-off-by: Dave Hansen Cc: Xiaoyao Li Cc: Sean Christopherson Cc: Paolo Bonzini Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: x86@kernel.org Cc: "H. Peter Anvin" Cc: "Kirill A. Shutemov" Cc: Rick Edgecombe Cc: kvm@vger.kernel.org Cc: linux-kernel@vger.kernel.org --- b/arch/x86/kvm/vmx/tdx.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff -puN arch/x86/kvm/vmx/tdx.c~tdx-sparse-fix-1 arch/x86/kvm/vmx/tdx.c --- a/arch/x86/kvm/vmx/tdx.c~tdx-sparse-fix-1 2025-10-29 12:10:11.114466713 -0700 +++ b/arch/x86/kvm/vmx/tdx.c 2025-10-29 12:10:11.119467274 -0700 @@ -856,7 +856,7 @@ void tdx_vcpu_free(struct kvm_vcpu *vcpu } if (tdx->vp.tdvpr_page) { tdx_reclaim_control_page(tdx->vp.tdvpr_page); - tdx->vp.tdvpr_page = 0; + tdx->vp.tdvpr_page = NULL; tdx->vp.tdvpr_pa = 0; } @@ -2642,7 +2642,7 @@ free_tdcs: free_tdr: if (tdr_page) __free_page(tdr_page); - kvm_tdx->td.tdr_page = 0; + kvm_tdx->td.tdr_page = NULL; free_hkid: tdx_hkid_free(kvm_tdx); @@ -3016,7 +3016,7 @@ free_tdcx: free_tdvpr: if (tdx->vp.tdvpr_page) __free_page(tdx->vp.tdvpr_page); - tdx->vp.tdvpr_page = 0; + tdx->vp.tdvpr_page = NULL; tdx->vp.tdvpr_pa = 0; return ret; _