[PATCH] KVM: x86: Fix null pointer dereference in trace_kvm_inj_exception

[PATCH] KVM: x86: Fix null pointer dereference in trace_kvm_inj_exception

[Daniel Paziyski]

The trace_kvm_inj_exception tracepoint takes as arguments the exception
vector, whether the exception has an error code (and subsequently, the
error code), and whether it is being reinjected. The error code is
formatted to the trace log as a string using __print_symbolic,
which takes an integer value and an array of structs containing a mask
value and a string. An empty struct is being passed, which makes the
kernel derefence a NULL pointer when the error code is 0. Remove this
stray struct in the invocation of __print_symbolic.

Signed-off-by: Daniel Paziyski <danielpaziyski@gmail.com>
---
 arch/x86/kvm/trace.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kvm/trace.h b/arch/x86/kvm/trace.h
index 0db25bba1..93de876c3 100644
--- a/arch/x86/kvm/trace.h
+++ b/arch/x86/kvm/trace.h
@@ -490,7 +490,7 @@ TRACE_EVENT(kvm_inj_exception,
 	TP_printk("%s%s%s%s%s",
 		  __print_symbolic(__entry->exception, kvm_trace_sym_exc),
 		  !__entry->has_error ? "" : " (",
-		  !__entry->has_error ? "" : __print_symbolic(__entry->error_code, { }),
+		  !__entry->has_error ? "" : __print_symbolic(__entry->error_code),
 		  !__entry->has_error ? "" : ")",
 		  __entry->reinjected ? " [reinjected]" : "")
 );
-- 
2.55.0

Re: [PATCH] KVM: x86: Fix null pointer dereference in trace_kvm_inj_exception

[Sean Christopherson]

+The Other Thomas

Just as an FYI, commit 754e38d2d1ae ("tracing: Use explicit array size instead of
sentinel elements in symbol printing") broke KVM abuse of __print_symbolic() where
KVM deliberately passed in an "null" array to avoid printing 0x0 when there is no
error code.

I did a half-assed search through the other usage of __print_symbolic() and didn't
see anything, but just in case someone else comes complaining...

On Fri, Jul 10, 2026, Daniel Paziyski wrote:
> The trace_kvm_inj_exception tracepoint takes as arguments the exception
> vector, whether the exception has an error code (and subsequently, the
> error code), and whether it is being reinjected. The error code is
> formatted to the trace log as a string using __print_symbolic,
> which takes an integer value and an array of structs containing a mask
> value and a string. An empty struct is being passed, which makes the
> kernel derefence a NULL pointer when the error code is 0. Remove this
> stray struct in the invocation of __print_symbolic.

Fixes: 754e38d2d1ae ("tracing: Use explicit array size instead of sentinel elements in symbol printing")
Cc: stable@vger.kernel.org

In the future please provide a splat in the changelog, especially in this age of
agentic bug hunters that are prone to making things up.  My initial reaction to
this was "no way".  Thankfully, I tried reproducing the bug before making an ass
out of myself :-)

  BUG: kernel NULL pointer dereference, address: 0000000000000000
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  PGD 0 P4D 0 
  Oops: Oops: 0000 [#1] SMP
  CPU: 20 UID: 0 PID: 791 Comm: less Not tainted 7.2.0-rc2-3ffd29d795c9-x86_trace_ex_null_ptr_deref-vm #401 PREEMPT 
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
  RIP: 0010:strlen+0x0/0x20
  Call Trace:
   <TASK>
   trace_seq_puts+0x18/0x80
   trace_print_symbols_seq+0x68/0xa0
   trace_raw_output_kvm_inj_exception+0x64/0xf0 [kvm]
   s_show+0x47/0x110
   seq_read_iter+0x2a5/0x4c0
   seq_read+0xfd/0x130
   vfs_read+0xb6/0x330
   ? vfs_write+0x2f2/0x3f0
   ksys_read+0x61/0xd0
   do_syscall_64+0xb7/0x570
   entry_SYSCALL_64_after_hwframe+0x4b/0x53
  RIP: 0033:0x7ff283714862
   </TASK>

I'll also massage the changelog to explain why KVM is absuing __print_symbolic()
(see commit 21d4c575eb4a ("KVM: x86: Print error code in exception injection
tracepoint iff valid")).

No need for a v2, I'll fixup when applying.

Thanks!

> Signed-off-by: Daniel Paziyski <danielpaziyski@gmail.com>
> ---
>  arch/x86/kvm/trace.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/x86/kvm/trace.h b/arch/x86/kvm/trace.h
> index 0db25bba1..93de876c3 100644
> --- a/arch/x86/kvm/trace.h
> +++ b/arch/x86/kvm/trace.h
> @@ -490,7 +490,7 @@ TRACE_EVENT(kvm_inj_exception,
>  	TP_printk("%s%s%s%s%s",
>  		  __print_symbolic(__entry->exception, kvm_trace_sym_exc),
>  		  !__entry->has_error ? "" : " (",
> -		  !__entry->has_error ? "" : __print_symbolic(__entry->error_code, { }),
> +		  !__entry->has_error ? "" : __print_symbolic(__entry->error_code),
>  		  !__entry->has_error ? "" : ")",
>  		  __entry->reinjected ? " [reinjected]" : "")
>  );
> -- 
> 2.55.0
> 

Re: [PATCH] KVM: x86: Fix null pointer dereference in trace_kvm_inj_exception

[Daniel Paziyski]

Thank you for the response!

Re: [PATCH] KVM: x86: Fix null pointer dereference in trace_kvm_inj_exception

[Thomas Weißschuh]

Hi Sean,

On Fri, Jul 10, 2026 at 11:42:47AM -0700, Sean Christopherson wrote:
> +The Other Thomas

Thanks for the forward.

> Just as an FYI, commit 754e38d2d1ae ("tracing: Use explicit array size instead of
> sentinel elements in symbol printing") broke KVM abuse of __print_symbolic() where
> KVM deliberately passed in an "null" array to avoid printing 0x0 when there is no
> error code.
> 
> I did a half-assed search through the other usage of __print_symbolic() and didn't
> see anything, but just in case someone else comes complaining...
> 
> On Fri, Jul 10, 2026, Daniel Paziyski wrote:
> > The trace_kvm_inj_exception tracepoint takes as arguments the exception
> > vector, whether the exception has an error code (and subsequently, the
> > error code), and whether it is being reinjected. The error code is
> > formatted to the trace log as a string using __print_symbolic,
> > which takes an integer value and an array of structs containing a mask
> > value and a string. An empty struct is being passed, which makes the
> > kernel derefence a NULL pointer when the error code is 0. Remove this
> > stray struct in the invocation of __print_symbolic.
> 
> Fixes: 754e38d2d1ae ("tracing: Use explicit array size instead of sentinel elements in symbol printing")
> Cc: stable@vger.kernel.org
> 
> In the future please provide a splat in the changelog, especially in this age of
> agentic bug hunters that are prone to making things up.  My initial reaction to
> this was "no way".  Thankfully, I tried reproducing the bug before making an ass
> out of myself :-)
> 
>   BUG: kernel NULL pointer dereference, address: 0000000000000000
>   #PF: supervisor read access in kernel mode
>   #PF: error_code(0x0000) - not-present page
>   PGD 0 P4D 0 
>   Oops: Oops: 0000 [#1] SMP
>   CPU: 20 UID: 0 PID: 791 Comm: less Not tainted 7.2.0-rc2-3ffd29d795c9-x86_trace_ex_null_ptr_deref-vm #401 PREEMPT 
>   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
>   RIP: 0010:strlen+0x0/0x20
>   Call Trace:
>    <TASK>
>    trace_seq_puts+0x18/0x80
>    trace_print_symbols_seq+0x68/0xa0
>    trace_raw_output_kvm_inj_exception+0x64/0xf0 [kvm]
>    s_show+0x47/0x110
>    seq_read_iter+0x2a5/0x4c0
>    seq_read+0xfd/0x130
>    vfs_read+0xb6/0x330
>    ? vfs_write+0x2f2/0x3f0
>    ksys_read+0x61/0xd0
>    do_syscall_64+0xb7/0x570
>    entry_SYSCALL_64_after_hwframe+0x4b/0x53
>   RIP: 0033:0x7ff283714862
>    </TASK>
> 
> I'll also massage the changelog to explain why KVM is absuing __print_symbolic()
> (see commit 21d4c575eb4a ("KVM: x86: Print error code in exception injection
> tracepoint iff valid")).
> 
> No need for a v2, I'll fixup when applying.
> 
> Thanks!
> 
> > Signed-off-by: Daniel Paziyski <danielpaziyski@gmail.com>

Reviewed-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>

> > ---
> >  arch/x86/kvm/trace.h | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/arch/x86/kvm/trace.h b/arch/x86/kvm/trace.h
> > index 0db25bba1..93de876c3 100644
> > --- a/arch/x86/kvm/trace.h
> > +++ b/arch/x86/kvm/trace.h
> > @@ -490,7 +490,7 @@ TRACE_EVENT(kvm_inj_exception,
> >  	TP_printk("%s%s%s%s%s",
> >  		  __print_symbolic(__entry->exception, kvm_trace_sym_exc),
> >  		  !__entry->has_error ? "" : " (",
> > -		  !__entry->has_error ? "" : __print_symbolic(__entry->error_code, { }),
> > +		  !__entry->has_error ? "" : __print_symbolic(__entry->error_code),

You could use a printf precision to reduce the hackery and get the desired behavior:

TP_printk("...%.*s...",
          ...
	  __entry->has_error && __entry->error_code != 0 ? 100 : 0,
	  __print_symbolic(__entry->error_code),
          ...

(Unfortunately Linux printf does not handle negative precisions correctly.)

> >  		  !__entry->has_error ? "" : ")",
> >  		  __entry->reinjected ? " [reinjected]" : "")
> >  );
> > -- 
> > 2.55.0
> > 

Re: [PATCH] KVM: x86: Fix null pointer dereference in trace_kvm_inj_exception

[Sean Christopherson]

On Fri, 10 Jul 2026 15:40:54 +0200, Daniel Paziyski wrote:
> The trace_kvm_inj_exception tracepoint takes as arguments the exception
> vector, whether the exception has an error code (and subsequently, the
> error code), and whether it is being reinjected. The error code is
> formatted to the trace log as a string using __print_symbolic,
> which takes an integer value and an array of structs containing a mask
> value and a string. An empty struct is being passed, which makes the
> kernel derefence a NULL pointer when the error code is 0. Remove this
> stray struct in the invocation of __print_symbolic.
> 
> [...]

Applied to kvm-x86 fixes, thanks!

[1/1] KVM: x86: Fix null pointer dereference in trace_kvm_inj_exception
      https://github.com/kvm-x86/linux/commit/9c66085e6dcf

--
https://github.com/kvm-x86/linux/tree/next