Re: [PATCH] KVM: x86: Fix null pointer dereference in trace_kvm_inj_exception

[Sean Christopherson <seanjc@google.com>]

On Fri, Jul 10, 2026, sashiko-bot@kernel.org wrote:
> > An empty struct is being passed, which makes the
> > kernel derefence a NULL pointer when the error code is 0. Remove this
> > stray struct in the invocation of __print_symbolic.
> 
> [Severity: Medium]
> Is this description of a null pointer dereference accurate?

Yes, it is.  Sashiko apparently applied to an old base (pre-7.1).  As of commit
754e38d2d1ae ("tracing: Use explicit array size instead of sentinel elements in
symbol printing") (spoiler alert), trace_print_symbols_seq() is:

	for (i = 0; i < symbol_array_size; i++) {

		if (val != symbol_array[i].mask)
			continue;

		trace_seq_puts(p, symbol_array[i].name);
		break;
	}

> Looking at how __print_symbolic expands, the empty struct { } safely
> initializes the first element's name pointer to NULL. When
> trace_print_symbols_seq() is called, it handles this gracefully:
> 
> kernel/trace/trace_output.c:trace_print_symbols_seq() {
>     ...
>     for (i = 0;  symbol_array[i].name; i++) {
>     ...
> }
> 
> Since the name field is NULL for the first element, the loop is bypassed
> entirely and the function safely falls back to printing the error code as a
> hex string without dereferencing a NULL pointer.
> 
> > diff --git a/arch/x86/kvm/trace.h b/arch/x86/kvm/trace.h
> > --- a/arch/x86/kvm/trace.h
> > +++ b/arch/x86/kvm/trace.h
> > @@ -490,7 +490,7 @@ TRACE_EVENT(kvm_inj_exception,
> >  	TP_printk("%s%s%s%s%s",
> >  		  __print_symbolic(__entry->exception, kvm_trace_sym_exc),
> >  		  !__entry->has_error ? "" : " (",
> > -		  !__entry->has_error ? "" : __print_symbolic(__entry->error_code, { }),
> > +		  !__entry->has_error ? "" : __print_symbolic(__entry->error_code),
> 
> [Severity: Low]
> Will this change break the kernel build?

No, beacuse again, Sashiko applied to an old base for some reason.