Re: [PATCH] KVM: x86: Fix null pointer dereference in trace_kvm_inj_exception

[Thomas Weißschuh]

Hi Sean,

On Fri, Jul 10, 2026 at 11:42:47AM -0700, Sean Christopherson wrote:
> +The Other Thomas

Thanks for the forward.

> Just as an FYI, commit 754e38d2d1ae ("tracing: Use explicit array size instead of
> sentinel elements in symbol printing") broke KVM abuse of __print_symbolic() where
> KVM deliberately passed in an "null" array to avoid printing 0x0 when there is no
> error code.
> 
> I did a half-assed search through the other usage of __print_symbolic() and didn't
> see anything, but just in case someone else comes complaining...
> 
> On Fri, Jul 10, 2026, Daniel Paziyski wrote:
> > The trace_kvm_inj_exception tracepoint takes as arguments the exception
> > vector, whether the exception has an error code (and subsequently, the
> > error code), and whether it is being reinjected. The error code is
> > formatted to the trace log as a string using __print_symbolic,
> > which takes an integer value and an array of structs containing a mask
> > value and a string. An empty struct is being passed, which makes the
> > kernel derefence a NULL pointer when the error code is 0. Remove this
> > stray struct in the invocation of __print_symbolic.
> 
> Fixes: 754e38d2d1ae ("tracing: Use explicit array size instead of sentinel elements in symbol printing")
> Cc: stable@xxxxxxxxxxxxxxx
> 
> In the future please provide a splat in the changelog, especially in this age of
> agentic bug hunters that are prone to making things up.  My initial reaction to
> this was "no way".  Thankfully, I tried reproducing the bug before making an ass
> out of myself :-)
> 
>   BUG: kernel NULL pointer dereference, address: 0000000000000000
>   #PF: supervisor read access in kernel mode
>   #PF: error_code(0x0000) - not-present page
>   PGD 0 P4D 0 
>   Oops: Oops: 0000 [#1] SMP
>   CPU: 20 UID: 0 PID: 791 Comm: less Not tainted 7.2.0-rc2-3ffd29d795c9-x86_trace_ex_null_ptr_deref-vm #401 PREEMPT 
>   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
>   RIP: 0010:strlen+0x0/0x20
>   Call Trace:
>    <TASK>
>    trace_seq_puts+0x18/0x80
>    trace_print_symbols_seq+0x68/0xa0
>    trace_raw_output_kvm_inj_exception+0x64/0xf0 [kvm]
>    s_show+0x47/0x110
>    seq_read_iter+0x2a5/0x4c0
>    seq_read+0xfd/0x130
>    vfs_read+0xb6/0x330
>    ? vfs_write+0x2f2/0x3f0
>    ksys_read+0x61/0xd0
>    do_syscall_64+0xb7/0x570
>    entry_SYSCALL_64_after_hwframe+0x4b/0x53
>   RIP: 0033:0x7ff283714862
>    </TASK>
> 
> I'll also massage the changelog to explain why KVM is absuing __print_symbolic()
> (see commit 21d4c575eb4a ("KVM: x86: Print error code in exception injection
> tracepoint iff valid")).
> 
> No need for a v2, I'll fixup when applying.
> 
> Thanks!
> 
> > Signed-off-by: Daniel Paziyski <danielpaziyski@xxxxxxxxx>

Reviewed-by: Thomas Weißschuh <thomas.weissschuh@xxxxxxxxxxxxx>

> > ---
> >  arch/x86/kvm/trace.h | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/arch/x86/kvm/trace.h b/arch/x86/kvm/trace.h
> > index 0db25bba1..93de876c3 100644
> > --- a/arch/x86/kvm/trace.h
> > +++ b/arch/x86/kvm/trace.h
> > @@ -490,7 +490,7 @@ TRACE_EVENT(kvm_inj_exception,
> >  	TP_printk("%s%s%s%s%s",
> >  		  __print_symbolic(__entry->exception, kvm_trace_sym_exc),
> >  		  !__entry->has_error ? "" : " (",
> > -		  !__entry->has_error ? "" : __print_symbolic(__entry->error_code, { }),
> > +		  !__entry->has_error ? "" : __print_symbolic(__entry->error_code),

You could use a printf precision to reduce the hackery and get the desired behavior:

TP_printk("...%.*s...",
          ...
	  __entry->has_error && __entry->error_code != 0 ? 100 : 0,
	  __print_symbolic(__entry->error_code),
          ...

(Unfortunately Linux printf does not handle negative precisions correctly.)

> >  		  !__entry->has_error ? "" : ")",
> >  		  __entry->reinjected ? " [reinjected]" : "")
> >  );
> > -- 
> > 2.55.0
> >