KVM: x86: Fix null pointer deref due to dummy array in trace_kvm_inj_exception()

The trace_kvm_inj_exception tracepoint takes as arguments the exception
vector, whether the exception has an error code (and subsequently, the
error code), and whether it is being reinjected.  Because '0' is a valid
error code, KVM uses __print_symbolic() to format the error code as a
string to avoid printing the error code entirely if the exception doesn't
have an error code (see commit 21d4c575eb4a ("KVM: x86: Print error code
in exception injection tracepoint iff valid").

KVM's abuse of __print_symbolic() was all fine and dandy, until commit
754e38d2d1ae ("tracing: Use explicit array size instead of sentinel
elements in symbol printing") reworked the printing to avoid terminating
the arrays with NULL/0 values, and missed KVM's clever use of not-quite
empty array of symbols.

  BUG: kernel NULL pointer dereference, address: 0000000000000000
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  PGD 0 P4D 0
  Oops: Oops: 0000 [#1] SMP
  CPU: 20 UID: 0 PID: 791 Comm: less Not tainted 7.2.0-rc2 #401 PREEMPT
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
  RIP: 0010:strlen+0x0/0x20
  Call Trace:
   <TASK>
   trace_seq_puts+0x18/0x80
   trace_print_symbols_seq+0x68/0xa0
   trace_raw_output_kvm_inj_exception+0x64/0xf0 [kvm]
   s_show+0x47/0x110
   seq_read_iter+0x2a5/0x4c0
   seq_read+0xfd/0x130
   vfs_read+0xb6/0x330
   ? vfs_write+0x2f2/0x3f0
   ksys_read+0x61/0xd0
   do_syscall_64+0xb7/0x570
   entry_SYSCALL_64_after_hwframe+0x4b/0x53
  RIP: 0033:0x7ff283714862
   </TASK>

Simply drop the dummy array entirely, so that __print_symbolic() generates
a truly empty array.

Signed-off-by: Daniel Paziyski <danielpaziyski@gmail.com>
Fixes: 754e38d2d1ae ("tracing: Use explicit array size instead of sentinel elements in symbol printing")
Reviewed-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Link: https://patch.msgid.link/20260710134055.16432-1-danielpaziyski@gmail.com
[sean: massage changelog, add splat, add Fixes, cc stable]
Signed-off-by: Sean Christopherson <seanjc@google.com>

diff --git a/arch/x86/kvm/trace.h b/arch/x86/kvm/trace.h
index 0db25bba17f6e82ab59f6a49230c6e5d98605701..93de876c318ce581136b1123786986455a907218 100644 (file)
--- a/arch/x86/kvm/trace.h
+++ b/arch/x86/kvm/trace.h
@@ -490,7 +490,7 @@ TRACE_EVENT(kvm_inj_exception,
        TP_printk("%s%s%s%s%s",
                  __print_symbolic(__entry->exception, kvm_trace_sym_exc),
                  !__entry->has_error ? "" : " (",
-                 !__entry->has_error ? "" : __print_symbolic(__entry->error_code, { }),
+                 !__entry->has_error ? "" : __print_symbolic(__entry->error_code),
                  !__entry->has_error ? "" : ")",
                  __entry->reinjected ? " [reinjected]" : "")
 );