[PATCH net-next v3] net: Replace %pK output with 0

[PATCH net-next v3] net: Replace %pK output with 0

[Sebastian Andrzej Siewior]

Commit 71338aa7d050c ("net: convert %p usage to %pK") which is from
2011 and changed the %p annotation for pointer to %pK. Back then the
default behaviour for %p was to print the pointer. The %pK modifier was
introduced to able to control the behaviour of specific pointer values
without changing the behaviour of %p for everyone. It was dedicated to
avoid leaking pointers via /proc.

There was also the idea to remove the check from formatting the string
and move to the open callback with some helpers but this did not happen.

Things changed over time. The default behaviour for %p is now to print a
hash pointer which does not leak the address but allows to correlate if
two pointers are equal.
The policy on %p is to not introduce new ones. This is somehow in
between since it already exists. The pointer are usually socket pointers
and I don't see any value in exposing them. Therefore I am following the
recommendation of removing them. Since their usage in /proc/ can be
considered ABI I replace the pointer with a 0.

Replace the %pK annotation with 0 value. Correct the spacing for the
cases where pointer is at the beginning. Use %ps in CAN where the read
callback is used.

Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
---
v2…v3: https://lore.kernel.org/all/20260720144031.oU6azheV@linutronix.de/
 - seq_printf() with static strings have been replaced with seq_puts()
   (checkpatch)
 - Added missing fixed length in the CAN_EFF_FLAG case
   (can_print_rcvlist(), sashiko)
 - Added missing 0 in get_timewait6_sock() (Jakub)
 - Added back padding to the unix_seq_show() output. There is a selftest
   which checks the length of the first line. (kernel test robot
   <oliver.sang@intel.com>)

v1…v2: https://lore.kernel.org/all/20260706073824.xixrLxoD@linutronix.de
 - This follows Kees' feedback regarding the general policy and "is it
   really needed?". Since I don't think that this is of general usage I
   replaced them all with 0 and corrected the spacing at the beginning.

 - can_print_rcvlist() is now using a %ps to print the name of the
   function. Everything is a sock pointer (or some other data structure)
   and is now 0.

 net/atm/proc.c           |  7 +++----
 net/can/bcm.c            |  4 +---
 net/can/proc.c           | 12 ++++--------
 net/ipv4/ping.c          |  5 ++---
 net/ipv4/raw.c           |  4 ++--
 net/ipv4/tcp_ipv4.c      | 13 ++++++-------
 net/ipv4/udp.c           |  5 ++---
 net/ipv6/datagram.c      |  5 ++---
 net/ipv6/tcp_ipv6.c      | 12 ++++++------
 net/key/af_key.c         |  5 ++---
 net/netlink/af_netlink.c |  5 ++---
 net/packet/af_packet.c   |  7 ++-----
 net/phonet/socket.c      |  5 ++---
 net/sctp/proc.c          |  6 +++---
 net/unix/af_unix.c       |  3 +--
 15 files changed, 40 insertions(+), 58 deletions(-)

diff --git a/net/atm/proc.c b/net/atm/proc.c
index 8f20b49b9c02a..ca0fc6b90998c 100644
--- a/net/atm/proc.c
+++ b/net/atm/proc.c
@@ -159,7 +159,7 @@ static void vcc_info(struct seq_file *seq, struct atm_vcc *vcc)
 {
 	struct sock *sk = sk_atm(vcc);
 
-	seq_printf(seq, "%pK ", vcc);
+	seq_puts(seq, "      0 ");
 	if (!vcc->dev)
 		seq_printf(seq, "Unassigned    ");
 	else
@@ -228,9 +228,8 @@ static const struct seq_operations pvc_seq_ops = {
 static int vcc_seq_show(struct seq_file *seq, void *v)
 {
 	if (v == SEQ_START_TOKEN) {
-		seq_printf(seq, sizeof(void *) == 4 ? "%-8s%s" : "%-16s%s",
-			"Address ", "Itf VPI VCI   Fam Flags Reply "
-			"Send buffer     Recv buffer      [refcnt]\n");
+		seq_puts(seq, "Address Itf VPI VCI   Fam Flags Reply "
+			 "Send buffer     Recv buffer     [refcnt]\n");
 	} else {
 		struct vcc_state *state = seq->private;
 		struct atm_vcc *vcc = atm_sk(state->sk);
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 3d637a1e0ac1a..794faf83e0e4f 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -220,9 +220,7 @@ static int bcm_proc_show(struct seq_file *m, void *v)
 	struct bcm_sock *bo = bcm_sk(sk);
 	struct bcm_op *op;
 
-	seq_printf(m, ">>> socket %pK", sk->sk_socket);
-	seq_printf(m, " / sk %pK", sk);
-	seq_printf(m, " / bo %pK", bo);
+	seq_puts(m, ">>> socket 0 / sk 0 / bo 0");
 	seq_printf(m, " / dropped %lu", bo->dropped_usr_msgs);
 	seq_printf(m, " / bound %s", bcm_proc_getifname(net, ifname, bo->ifindex));
 	seq_printf(m, " <<<\n");
diff --git a/net/can/proc.c b/net/can/proc.c
index de4d05ae34597..4314180fd7a14 100644
--- a/net/can/proc.c
+++ b/net/can/proc.c
@@ -192,12 +192,11 @@ static void can_print_rcvlist(struct seq_file *m, struct hlist_head *rx_list,
 
 	hlist_for_each_entry_rcu(r, rx_list, list) {
 		char *fmt = (r->can_id & CAN_EFF_FLAG)?
-			"   %-5s  %08x  %08x  %pK  %pK  %8ld  %s\n" :
-			"   %-5s     %03x    %08x  %pK  %pK  %8ld  %s\n";
+			"   %-5s  %08x  %08x  %-20ps %8u %8ld  %s\n" :
+			"   %-5s     %03x    %08x  %-20ps %8u %8ld  %s\n";
 
 		seq_printf(m, fmt, DNAME(dev), r->can_id, r->mask,
-			   r->func, r->data, atomic_long_read(&r->matches),
-			   r->ident);
+			   r->func, 0, atomic_long_read(&r->matches), r->ident);
 	}
 }
 
@@ -207,10 +206,7 @@ static void can_print_recv_banner(struct seq_file *m)
 	 *                  can1.  00000000  00000000  00000000
 	 *                 .......          0  tp20
 	 */
-	if (IS_ENABLED(CONFIG_64BIT))
-		seq_puts(m, "  device   can_id   can_mask      function          userdata       matches  ident\n");
-	else
-		seq_puts(m, "  device   can_id   can_mask  function  userdata   matches  ident\n");
+	seq_puts(m, "  device   can_id   can_mask  function             userdata  matches  ident\n");
 }
 
 static int can_stats_proc_show(struct seq_file *m, void *v)
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index d36f1e273fde4..223a0108b74cc 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -1095,15 +1095,14 @@ static void ping_v4_format_sock(struct sock *sp, struct seq_file *f,
 	__u16 srcp = ntohs(inet->inet_sport);
 
 	seq_printf(f, "%5d: %08X:%04X %08X:%04X"
-		" %02X %08X:%08X %02X:%08lX %08X %5u %8d %llu %d %pK %u",
+		" %02X %08X:%08X %02X:%08lX %08X %5u %8d %llu %d 0 %u",
 		bucket, src, srcp, dest, destp, sp->sk_state,
 		sk_wmem_alloc_get(sp),
 		sk_rmem_alloc_get(sp),
 		0, 0L, 0,
 		from_kuid_munged(seq_user_ns(f), sk_uid(sp)),
 		0, sock_i_ino(sp),
-		refcount_read(&sp->sk_refcnt), sp,
-		sk_drops_read(sp));
+		refcount_read(&sp->sk_refcnt), sk_drops_read(sp));
 }
 
 static int ping_v4_seq_show(struct seq_file *seq, void *v)
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index d756e5e31b90d..9d01006d8189e 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -1054,14 +1054,14 @@ static void raw_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
 	      srcp  = inet->inet_num;
 
 	seq_printf(seq, "%4d: %08X:%04X %08X:%04X"
-		" %02X %08X:%08X %02X:%08lX %08X %5u %8d %llu %d %pK %u\n",
+		" %02X %08X:%08X %02X:%08lX %08X %5u %8d %llu %d 0 %u\n",
 		i, src, srcp, dest, destp, sp->sk_state,
 		sk_wmem_alloc_get(sp),
 		sk_rmem_alloc_get(sp),
 		0, 0L, 0,
 		from_kuid_munged(seq_user_ns(seq), sk_uid(sp)),
 		0, sock_i_ino(sp),
-		refcount_read(&sp->sk_refcnt), sp, sk_drops_read(sp));
+		refcount_read(&sp->sk_refcnt), sk_drops_read(sp));
 }
 
 static int raw_seq_show(struct seq_file *seq, void *v)
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index b8887cdd66c57..2cd8ae4a0e4b6 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2748,7 +2748,7 @@ static void get_openreq4(const struct request_sock *req,
 	long delta = req->rsk_timer.expires - jiffies;
 
 	seq_printf(f, "%4d: %08X:%04X %08X:%04X"
-		" %02X %08X:%08X %02X:%08lX %08X %5u %8d %u %d %pK",
+		" %02X %08X:%08X %02X:%08lX %08X %5u %8d %u %d 0",
 		i,
 		ireq->ir_loc_addr,
 		ireq->ir_num,
@@ -2763,8 +2763,7 @@ static void get_openreq4(const struct request_sock *req,
 				 sk_uid(req->rsk_listener)),
 		0,  /* non standard timer */
 		0, /* open_requests have no inode */
-		0,
-		req);
+		0);
 }
 
 static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i)
@@ -2811,7 +2810,7 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i)
 				      READ_ONCE(tp->copied_seq), 0);
 
 	seq_printf(f, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX "
-			"%08X %5u %8d %llu %d %pK %lu %lu %u %u %d",
+			"%08X %5u %8d %llu %d 0 %lu %lu %u %u %d",
 		i, src, srcp, dest, destp, state,
 		READ_ONCE(tp->write_seq) - tp->snd_una,
 		rx_queue,
@@ -2821,7 +2820,7 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i)
 		from_kuid_munged(seq_user_ns(f), sk_uid(sk)),
 		READ_ONCE(icsk->icsk_probes_out),
 		sock_i_ino(sk),
-		refcount_read(&sk->sk_refcnt), sk,
+		refcount_read(&sk->sk_refcnt),
 		jiffies_to_clock_t(icsk->icsk_rto),
 		jiffies_to_clock_t(icsk->icsk_ack.ato),
 		(icsk->icsk_ack.quick << 1) | inet_csk_in_pingpong_mode(sk),
@@ -2844,10 +2843,10 @@ static void get_timewait4_sock(const struct inet_timewait_sock *tw,
 	srcp  = ntohs(tw->tw_sport);
 
 	seq_printf(f, "%4d: %08X:%04X %08X:%04X"
-		" %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK",
+		" %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d 0",
 		i, src, srcp, dest, destp, READ_ONCE(tw->tw_substate), 0, 0,
 		3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
-		refcount_read(&tw->tw_refcnt), tw);
+		refcount_read(&tw->tw_refcnt));
 }
 
 #define TMPSZ 150
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index af96032174441..a01db598c00bf 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -3283,15 +3283,14 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
 	__u16 srcp	  = ntohs(inet->inet_sport);
 
 	seq_printf(f, "%5d: %08X:%04X %08X:%04X"
-		" %02X %08X:%08X %02X:%08lX %08X %5u %8d %llu %d %pK %u",
+		" %02X %08X:%08X %02X:%08lX %08X %5u %8d %llu %d 0 %u",
 		bucket, src, srcp, dest, destp, sp->sk_state,
 		sk_wmem_alloc_get(sp),
 		udp_rqueue_get(sp),
 		0, 0L, 0,
 		from_kuid_munged(seq_user_ns(f), sk_uid(sp)),
 		0, sock_i_ino(sp),
-		refcount_read(&sp->sk_refcnt), sp,
-		sk_drops_read(sp));
+		refcount_read(&sp->sk_refcnt), sk_drops_read(sp));
 }
 
 static int udp4_seq_show(struct seq_file *seq, void *v)
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 38d7b48452817..191c9733ff9fa 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -1102,7 +1102,7 @@ void __ip6_dgram_sock_seq_show(struct seq_file *seq, struct sock *sp,
 	src   = &sp->sk_v6_rcv_saddr;
 	seq_printf(seq,
 		   "%5d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
-		   "%02X %08X:%08X %02X:%08lX %08X %5u %8d %llu %d %pK %u\n",
+		   "%02X %08X:%08X %02X:%08lX %08X %5u %8d %llu %d 0 %u\n",
 		   bucket,
 		   src->s6_addr32[0], src->s6_addr32[1],
 		   src->s6_addr32[2], src->s6_addr32[3], srcp,
@@ -1115,6 +1115,5 @@ void __ip6_dgram_sock_seq_show(struct seq_file *seq, struct sock *sp,
 		   from_kuid_munged(seq_user_ns(seq), sk_uid(sp)),
 		   0,
 		   sock_i_ino(sp),
-		   refcount_read(&sp->sk_refcnt), sp,
-		   sk_drops_read(sp));
+		   refcount_read(&sp->sk_refcnt), sk_drops_read(sp));
 }
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 9e9155b1b3aa7..87dbdc9086045 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -2103,7 +2103,7 @@ static void get_openreq6(struct seq_file *seq,
 
 	seq_printf(seq,
 		   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
-		   "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d %pK\n",
+		   "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d 0\n",
 		   i,
 		   src->s6_addr32[0], src->s6_addr32[1],
 		   src->s6_addr32[2], src->s6_addr32[3],
@@ -2120,7 +2120,7 @@ static void get_openreq6(struct seq_file *seq,
 				    sk_uid(req->rsk_listener)),
 		   0,  /* non standard timer */
 		   0, /* open_requests have no inode */
-		   0, req);
+		   0);
 }
 
 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
@@ -2171,7 +2171,7 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
 
 	seq_printf(seq,
 		   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
-		   "%02X %08X:%08X %02X:%08lX %08X %5u %8d %llu %d %pK %lu %lu %u %u %d\n",
+		   "%02X %08X:%08X %02X:%08lX %08X %5u %8d %llu %d 0 %lu %lu %u %u %d\n",
 		   i,
 		   src->s6_addr32[0], src->s6_addr32[1],
 		   src->s6_addr32[2], src->s6_addr32[3], srcp,
@@ -2186,7 +2186,7 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
 		   from_kuid_munged(seq_user_ns(seq), sk_uid(sp)),
 		   READ_ONCE(icsk->icsk_probes_out),
 		   sock_i_ino(sp),
-		   refcount_read(&sp->sk_refcnt), sp,
+		   refcount_read(&sp->sk_refcnt),
 		   jiffies_to_clock_t(icsk->icsk_rto),
 		   jiffies_to_clock_t(icsk->icsk_ack.ato),
 		   (icsk->icsk_ack.quick << 1) | inet_csk_in_pingpong_mode(sp),
@@ -2211,7 +2211,7 @@ static void get_timewait6_sock(struct seq_file *seq,
 
 	seq_printf(seq,
 		   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
-		   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
+		   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d 0\n",
 		   i,
 		   src->s6_addr32[0], src->s6_addr32[1],
 		   src->s6_addr32[2], src->s6_addr32[3], srcp,
@@ -2219,7 +2219,7 @@ static void get_timewait6_sock(struct seq_file *seq,
 		   dest->s6_addr32[2], dest->s6_addr32[3], destp,
 		   READ_ONCE(tw->tw_substate), 0, 0,
 		   3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
-		   refcount_read(&tw->tw_refcnt), tw);
+		   refcount_read(&tw->tw_refcnt));
 }
 
 static int tcp6_seq_show(struct seq_file *seq, void *v)
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 1d8965d7f4f3c..d215b33b7492c 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3803,10 +3803,9 @@ static int pfkey_seq_show(struct seq_file *f, void *v)
 	struct sock *s = sk_entry(v);
 
 	if (v == SEQ_START_TOKEN)
-		seq_printf(f ,"sk       RefCnt Rmem   Wmem   User   Inode\n");
+		seq_puts(f, "sk RefCnt Rmem   Wmem   User   Inode\n");
 	else
-		seq_printf(f, "%pK %-6d %-6u %-6u %-6u %-6llu\n",
-			       s,
+		seq_printf(f, "0  %-6d %-6u %-6u %-6u %-6llu\n",
 			       refcount_read(&s->sk_refcnt),
 			       sk_rmem_alloc_get(s),
 			       sk_wmem_alloc_get(s),
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index e6b1d9758c9c9..537562aacb7ef 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2700,14 +2700,13 @@ static int netlink_native_seq_show(struct seq_file *seq, void *v)
 {
 	if (v == SEQ_START_TOKEN) {
 		seq_puts(seq,
-			 "sk               Eth Pid        Groups   "
+			 "sk Eth Pid        Groups   "
 			 "Rmem     Wmem     Dump  Locks    Drops    Inode\n");
 	} else {
 		struct sock *s = v;
 		struct netlink_sock *nlk = nlk_sk(s);
 
-		seq_printf(seq, "%pK %-3d %-10u %08x %-8d %-8d %-5d %-8d %-8u %-8llu\n",
-			   s,
+		seq_printf(seq, "0  %-3d %-10u %08x %-8d %-8d %-5d %-8d %-8u %-8llu\n",
 			   s->sk_protocol,
 			   nlk->portid,
 			   nlk->groups ? (u32)nlk->groups[0] : 0,
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 435756877abaa..9ebf1605fec1a 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -4744,16 +4744,13 @@ static void packet_seq_stop(struct seq_file *seq, void *v)
 static int packet_seq_show(struct seq_file *seq, void *v)
 {
 	if (v == SEQ_START_TOKEN)
-		seq_printf(seq,
-			   "%*sRefCnt Type Proto  Iface R Rmem   User   Inode\n",
-			   IS_ENABLED(CONFIG_64BIT) ? -17 : -9, "sk");
+		seq_puts(seq, "sk RefCnt Type Proto  Iface R Rmem   User   Inode\n");
 	else {
 		struct sock *s = sk_entry(v);
 		const struct packet_sock *po = pkt_sk(s);
 
 		seq_printf(seq,
-			   "%pK %-6d %-4d %04x   %-5d %1d %-6u %-6u %-6llu\n",
-			   s,
+			   "0  %-6d %-4d %04x   %-5d %1d %-6u %-6u %-6llu\n",
 			   refcount_read(&s->sk_refcnt),
 			   s->sk_type,
 			   ntohs(READ_ONCE(po->num)),
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index 631a99cdbd006..ad12b746d4fca 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -586,14 +586,13 @@ static int pn_sock_seq_show(struct seq_file *seq, void *v)
 		struct pn_sock *pn = pn_sk(sk);
 
 		seq_printf(seq, "%2d %04X:%04X:%02X %02X %08X:%08X %5d %llu "
-			"%d %pK %u",
+			"%d 0 %u",
 			sk->sk_protocol, pn->sobject, pn->dobject,
 			pn->resource, sk->sk_state,
 			sk_wmem_alloc_get(sk), sk_rmem_alloc_get(sk),
 			from_kuid_munged(seq_user_ns(seq), sk_uid(sk)),
 			sock_i_ino(sk),
-			refcount_read(&sk->sk_refcnt), sk,
-			sk_drops_read(sk));
+			refcount_read(&sk->sk_refcnt), sk_drops_read(sk));
 	}
 	seq_pad(seq, '\n');
 	return 0;
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index 43433d7e2acd7..7ea123b90aa59 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -174,7 +174,7 @@ static int sctp_eps_seq_show(struct seq_file *seq, void *v)
 		sk = ep->base.sk;
 		if (!net_eq(sock_net(sk), seq_file_net(seq)))
 			continue;
-		seq_printf(seq, "%8pK %8pK %-3d %-3d %-4d %-5d %5u %5llu ", ep, sk,
+		seq_printf(seq, "%8d %8d %-3d %-3d %-4d %-5d %5u %5llu ", 0, 0,
 			   sctp_sk(sk)->type, sk->sk_state, hash,
 			   ep->base.bind_addr.port,
 			   from_kuid_munged(seq_user_ns(seq), sk_uid(sk)),
@@ -260,9 +260,9 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
 	sk = epb->sk;
 
 	seq_printf(seq,
-		   "%8pK %8pK %-3d %-3d %-2d %-4d "
+		   "%8d %8d %-3d %-3d %-2d %-4d "
 		   "%4d %8d %8d %7u %5llu %-5d %5d ",
-		   assoc, sk, sctp_sk(sk)->type, sk->sk_state,
+		   0, 0, sctp_sk(sk)->type, sk->sk_state,
 		   assoc->state, 0,
 		   assoc->assoc_id,
 		   assoc->sndbuf_used,
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 10ed9421e43aa..8f32bafd36c86 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -3555,8 +3555,7 @@ static int unix_seq_show(struct seq_file *seq, void *v)
 		struct unix_sock *u = unix_sk(s);
 		unix_state_lock(s);
 
-		seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5llu",
-			s,
+		seq_printf(seq, "%08u: %08X %08X %08X %04X %02X %5llu", 0,
 			refcount_read(&s->sk_refcnt),
 			0,
 			s->sk_state == TCP_LISTEN ? __SO_ACCEPTCON : 0,
-- 
2.55.0

Re: [PATCH net-next v3] net: Replace %pK output with 0

[Kees Cook]

On Wed, Aug 12, 2026 at 01:05:31PM +0200, Sebastian Andrzej Siewior wrote:
> Commit 71338aa7d050c ("net: convert %p usage to %pK") which is from
> 2011 and changed the %p annotation for pointer to %pK. Back then the
> default behaviour for %p was to print the pointer. The %pK modifier was
> introduced to able to control the behaviour of specific pointer values
> without changing the behaviour of %p for everyone. It was dedicated to
> avoid leaking pointers via /proc.
> 
> There was also the idea to remove the check from formatting the string
> and move to the open callback with some helpers but this did not happen.
> 
> Things changed over time. The default behaviour for %p is now to print a
> hash pointer which does not leak the address but allows to correlate if
> two pointers are equal.
> The policy on %p is to not introduce new ones. This is somehow in
> between since it already exists. The pointer are usually socket pointers
> and I don't see any value in exposing them. Therefore I am following the
> recommendation of removing them. Since their usage in /proc/ can be
> considered ABI I replace the pointer with a 0.
> 
> Replace the %pK annotation with 0 value. Correct the spacing for the
> cases where pointer is at the beginning. Use %ps in CAN where the read
> callback is used.
> 
> Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>

I love this kind of replacement. :)

Reviewed-by: Kees Cook <kees@kernel.org>

-- 
Kees Cook

Re: [PATCH net-next v3] net: Replace %pK output with 0

[Jakub Kicinski]

Hi Sebastian!

We have upgraded the slop...itifier since v2, it has more comments now...
The one about %ps potentially leaking more rather than less looks legit?
---
This is an AI-generated review of your patch.
---
net: Replace %pK output with 0

This replaces the %pK socket/object pointers printed by various /proc/net
files with a literal 0, adjusts the spacing of the affected header lines,
and switches the CAN receive list to print the receive callback with %ps.

> diff --git a/net/atm/proc.c b/net/atm/proc.c
> index 8f20b49b9c02..ca0fc6b90998 100644
> --- a/net/atm/proc.c
> +++ b/net/atm/proc.c

The changelog says:

    The pointer are usually socket pointers and I don't see any value in
    exposing them. Therefore I am following the recommendation of removing
    them.

[Severity: Low]
This isn't something introduced by this patch, but after it is applied
net/bluetooth/af_bluetooth.c bt_seq_show() is the only remaining %pK
socket-pointer printer under net/:

  net/bluetooth/af_bluetooth.c:bt_seq_show() {
      ...
      seq_printf(seq,
                 "%pK %-6d %-6u %-6u %-6u %-6llu %-6llu",
                 sk,
                 refcount_read(&sk->sk_refcnt),
      ...
  }

That site was converted by the very commit 71338aa7d050c quoted in the
changelog.  Was it intentionally left out, and could the changelog say so
(for example that net/bluetooth goes through a separate tree)?

> @@ -159,7 +159,7 @@ static void vcc_info(struct seq_file *seq, struct atm_vcc *vcc)
>  {
>  	struct sock *sk = sk_atm(vcc);
>  
> -	seq_printf(seq, "%pK ", vcc);
> +	seq_puts(seq, "      0 ");
>  	if (!vcc->dev)
>  		seq_printf(seq, "Unassigned    ");
>  	else
> @@ -228,9 +228,8 @@ static const struct seq_operations pvc_seq_ops = {
>  static int vcc_seq_show(struct seq_file *seq, void *v)
>  {
>  	if (v == SEQ_START_TOKEN) {
> -		seq_printf(seq, sizeof(void *) == 4 ? "%-8s%s" : "%-16s%s",
> -			"Address ", "Itf VPI VCI   Fam Flags Reply "
> -			"Send buffer     Recv buffer      [refcnt]\n");
> +		seq_puts(seq, "Address Itf VPI VCI   Fam Flags Reply "
> +			 "Send buffer     Recv buffer     [refcnt]\n");

[Severity: Low]
The changelog describes this as "Correct the spacing for the cases where
pointer is at the beginning", but the first column changes width in
several files, so the byte offsets of every following column move:

  vcc_seq_show()            /proc/net/atm/vc     16 -> 8 chars (64-bit)
  netlink_native_seq_show() /proc/net/netlink    17 -> 3
  packet_seq_show()         /proc/net/packet     17 -> 3
  pfkey_seq_show()          /proc/net/pfkey       9 -> 3
  unix_seq_show()           /proc/net/unix       18 -> 10

Whitespace/field-index parsers still work since the trailing column widths
are preserved, but anything indexing by fixed byte offset sees a new
layout.  Is that worth spelling out in the changelog, given it also states
that the /proc format can be considered ABI?

Separately, this hunk drops one space before "[refcnt]" in the header
("Recv buffer      [refcnt]" becomes "Recv buffer     [refcnt]"), which
isn't mentioned in the changelog at all.  Was that intended?

> diff --git a/net/can/proc.c b/net/can/proc.c
> index de4d05ae3459..4314180fd7a1 100644
> --- a/net/can/proc.c
> +++ b/net/can/proc.c
> @@ -192,12 +192,11 @@ static void can_print_rcvlist(struct seq_file *m, struct hlist_head *rx_list,
>  
>  	hlist_for_each_entry_rcu(r, rx_list, list) {
>  		char *fmt = (r->can_id & CAN_EFF_FLAG)?
> -			"   %-5s  %08x  %08x  %pK  %pK  %8ld  %s\n" :
> -			"   %-5s     %03x    %08x  %pK  %pK  %8ld  %s\n";
> +			"   %-5s  %08x  %08x  %-20ps %8u %8ld  %s\n" :
> +			"   %-5s     %03x    %08x  %-20ps %8u %8ld  %s\n";
>  
>  		seq_printf(m, fmt, DNAME(dev), r->can_id, r->mask,
> -			   r->func, r->data, atomic_long_read(&r->matches),
> -			   r->ident);
> +			   r->func, 0, atomic_long_read(&r->matches), r->ident);
>  	}
>  }

[Severity: Medium]
Does this widen what unprivileged readers can see, rather than narrow it?
The rcvlist_* files are created world readable by can_init_proc():

  net/can/proc.c:can_init_proc() {
      ...
      net->can.pde_rcvlist_all = proc_create_net_single(CAN_PROC_RCVLIST_ALL,
                      0644, net->can.proc_dir, can_rcvlist_proc_show,
                      (void *)RX_ALL);
      ...
  }

Unlike %pK, %ps is not filtered by kptr_restrict and is never hashed.  With
CONFIG_KALLSYMS=n, symbol_string() takes the fallback branch:

  lib/vsprintf.c:symbol_string() {
      ...
      return string_nocheck(buf, end, sym, spec);
  #else
      return special_hex_number(buf, end, value, sizeof(void *));
  #endif
  }

so the raw kernel/module text address of the receive callback is printed to
any local reader, even with kptr_restrict=2.

With CONFIG_KALLSYMS=y the address is not printed, but the symbol plus the
owning module name is now disclosed unconditionally, since
__sprint_symbol() appends the module:

  kernel/kallsyms.c:__sprint_symbol() {
      ...
      if (modname) {
              len += sprintf(buffer + len, " [%s", modname);
      ...
  }

Previously kptr_restrict >= 1 censored this field for readers without
CAP_SYSLOG.  Would the literal 0 placeholder used for the other 14 sites
work here too?

> @@ -207,10 +206,7 @@ static void can_print_recv_banner(struct seq_file *m)
>  	 *                  can1.  00000000  00000000  00000000
>  	 *                 .......          0  tp20
>  	 */

[Severity: Low]
This example comment still shows the old layout, where the receive callback
was an 8-hex-digit %pK value (the third 00000000 column) and userdata was a
pointer.  can_print_rcvlist() now emits a left-justified symbol name via
%-20ps and a constant 0 for userdata, so nothing the code can produce
matches this example.  Should the comment be refreshed?

> -	if (IS_ENABLED(CONFIG_64BIT))
> -		seq_puts(m, "  device   can_id   can_mask      function          userdata       matches  ident\n");
> -	else
> -		seq_puts(m, "  device   can_id   can_mask  function  userdata   matches  ident\n");
> +	seq_puts(m, "  device   can_id   can_mask  function             userdata  matches  ident\n");
>  }

[Severity: Low]
The new banner advertises a fixed 20-character "function" column, but does
the row format actually stay inside it?

Module symbols printed by %ps carry the module suffix, e.g.
"bcm_rx_handler [can_bcm]" (24 chars), "j1939_can_recv [can_j1939]" (26)
or "isotp_rcv [can_isotp]" (21), so userdata/matches/ident get pushed to
the right whenever can_bcm, can_isotp or can_j1939 is loaded.

In the CONFIG_KALLSYMS=n case symbol_string() calls

      return special_hex_number(buf, end, value, sizeof(void *));

which discards the caller's spec, so the field is an unpadded 18-character
0xffffffffXXXXXXXX and the following columns shift left instead.

[Severity: Low]
Documentation/networking/can.rst still documents the previous output of
/proc/net/can/rcvlist_*:

        device   can_id   can_mask  function  userdata   matches  ident
         vcan0     000    00000000  f88e6370  f6c6f400         0  raw

After this change the banner is spaced differently, "function" is a symbol
name that may itself contain a space before "[module]", and "userdata" is
always 0.  Should can.rst be updated in the same patch?

> diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
> index b8887cdd66c5..2cd8ae4a0e4b 100644
> --- a/net/ipv4/tcp_ipv4.c
> +++ b/net/ipv4/tcp_ipv4.c

[ ... ]

> @@ -2811,7 +2810,7 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i)
>  					      READ_ONCE(tp->copied_seq), 0);
>  
>  	seq_printf(f, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX "
> -			"%08X %5u %8d %llu %d %pK %lu %lu %u %u %d",
> +			"%08X %5u %8d %llu %d 0 %lu %lu %u %u %d",

[Severity: Low]
Documentation/networking/proc_net_tcp.rst still describes this field as the

    |          |    |     |    |------------------> location of socket in memory

and names tcp4_seq_show()/tcp6_seq_show() as the implementation, with a
nonzero example value.  With get_tcp4_sock(), get_tcp6_sock(),
get_openreq4()/get_openreq6() and get_timewait4_sock()/get_timewait6_sock()
all emitting a literal 0 there, no code path can produce the documented
value any more.  Could that documentation be adjusted along with this
change?

[ ... ]
-- 
pw-bot: cr

Re: [PATCH net-next v3] net: Replace %pK output with 0

[Oliver Hartkopp]

Hi Sebastian,

On 14.08.26 03:58, Jakub Kicinski wrote:

>> diff --git a/net/can/proc.c b/net/can/proc.c
>> index de4d05ae3459..4314180fd7a1 100644
>> --- a/net/can/proc.c
>> +++ b/net/can/proc.c
>> @@ -192,12 +192,11 @@ static void can_print_rcvlist(struct seq_file *m, struct hlist_head *rx_list,
>>   
>>   	hlist_for_each_entry_rcu(r, rx_list, list) {
>>   		char *fmt = (r->can_id & CAN_EFF_FLAG)?
>> -			"   %-5s  %08x  %08x  %pK  %pK  %8ld  %s\n" :
>> -			"   %-5s     %03x    %08x  %pK  %pK  %8ld  %s\n";
>> +			"   %-5s  %08x  %08x  %-20ps %8u %8ld  %s\n" :
>> +			"   %-5s     %03x    %08x  %-20ps %8u %8ld  %s\n";
>>   
>>   		seq_printf(m, fmt, DNAME(dev), r->can_id, r->mask,
>> -			   r->func, r->data, atomic_long_read(&r->matches),
>> -			   r->ident);
>> +			   r->func, 0, atomic_long_read(&r->matches), r->ident);
>>   	}
>>   }
> 
> [Severity: Medium]
> Does this widen what unprivileged readers can see, rather than narrow it?
> The rcvlist_* files are created world readable by can_init_proc():
> 
>    net/can/proc.c:can_init_proc() {
>        ...
>        net->can.pde_rcvlist_all = proc_create_net_single(CAN_PROC_RCVLIST_ALL,
>                        0644, net->can.proc_dir, can_rcvlist_proc_show,
>                        (void *)RX_ALL);
>        ...
>    }
> 
> Unlike %pK, %ps is not filtered by kptr_restrict and is never hashed.  With
> CONFIG_KALLSYMS=n, symbol_string() takes the fallback branch:

I got the point but the patch rendered the CAN proc outputs partly 
useless and it is definitely time to give it a rework.

It is pretty cool following your suggestion to be able to see the 
function calls like "bcm_rx_handler [can_bcm]". This is always what I 
wanted and brings no new security nor privacy issues. It mainly makes 
the ident string obsolete.

Instead of the other "data" it makes sense to provide the sock inode 
number to identify the relevant socket where possible (for raw/bcm/isotp).

If its ok for you I would provide a separate patch for can-next 
reworking the CAN proc output?!? So you would be able to continue with 
the other hunks only.

I'll put you and netdev ML in CC.

Best regards,
Oliver

> 
>    lib/vsprintf.c:symbol_string() {
>        ...
>        return string_nocheck(buf, end, sym, spec);
>    #else
>        return special_hex_number(buf, end, value, sizeof(void *));
>    #endif
>    }
> 
> so the raw kernel/module text address of the receive callback is printed to
> any local reader, even with kptr_restrict=2.
> 
> With CONFIG_KALLSYMS=y the address is not printed, but the symbol plus the
> owning module name is now disclosed unconditionally, since
> __sprint_symbol() appends the module:
> 
>    kernel/kallsyms.c:__sprint_symbol() {
>        ...
>        if (modname) {
>                len += sprintf(buffer + len, " [%s", modname);
>        ...
>    }
> 
> Previously kptr_restrict >= 1 censored this field for readers without
> CAP_SYSLOG.  Would the literal 0 placeholder used for the other 14 sites
> work here too?
> 
>> @@ -207,10 +206,7 @@ static void can_print_recv_banner(struct seq_file *m)
>>   	 *                  can1.  00000000  00000000  00000000
>>   	 *                 .......          0  tp20
>>   	 */
> 
> [Severity: Low]
> This example comment still shows the old layout, where the receive callback
> was an 8-hex-digit %pK value (the third 00000000 column) and userdata was a
> pointer.  can_print_rcvlist() now emits a left-justified symbol name via
> %-20ps and a constant 0 for userdata, so nothing the code can produce
> matches this example.  Should the comment be refreshed?
> 
>> -	if (IS_ENABLED(CONFIG_64BIT))
>> -		seq_puts(m, "  device   can_id   can_mask      function          userdata       matches  ident\n");
>> -	else
>> -		seq_puts(m, "  device   can_id   can_mask  function  userdata   matches  ident\n");
>> +	seq_puts(m, "  device   can_id   can_mask  function             userdata  matches  ident\n");
>>   }
> 
> [Severity: Low]
> The new banner advertises a fixed 20-character "function" column, but does
> the row format actually stay inside it?
> 
> Module symbols printed by %ps carry the module suffix, e.g.
> "bcm_rx_handler [can_bcm]" (24 chars), "j1939_can_recv [can_j1939]" (26)
> or "isotp_rcv [can_isotp]" (21), so userdata/matches/ident get pushed to
> the right whenever can_bcm, can_isotp or can_j1939 is loaded.
> 
> In the CONFIG_KALLSYMS=n case symbol_string() calls
> 
>        return special_hex_number(buf, end, value, sizeof(void *));
> 
> which discards the caller's spec, so the field is an unpadded 18-character
> 0xffffffffXXXXXXXX and the following columns shift left instead.
> 
> [Severity: Low]
> Documentation/networking/can.rst still documents the previous output of
> /proc/net/can/rcvlist_*:
> 
>          device   can_id   can_mask  function  userdata   matches  ident
>           vcan0     000    00000000  f88e6370  f6c6f400         0  raw
> 
> After this change the banner is spaced differently, "function" is a symbol
> name that may itself contain a space before "[module]", and "userdata" is
> always 0.  Should can.rst be updated in the same patch?
> 
>> diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
>> index b8887cdd66c5..2cd8ae4a0e4b 100644
>> --- a/net/ipv4/tcp_ipv4.c
>> +++ b/net/ipv4/tcp_ipv4.c
> 
> [ ... ]
> 
>> @@ -2811,7 +2810,7 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i)
>>   					      READ_ONCE(tp->copied_seq), 0);
>>   
>>   	seq_printf(f, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX "
>> -			"%08X %5u %8d %llu %d %pK %lu %lu %u %u %d",
>> +			"%08X %5u %8d %llu %d 0 %lu %lu %u %u %d",
> 
> [Severity: Low]
> Documentation/networking/proc_net_tcp.rst still describes this field as the
> 
>      |          |    |     |    |------------------> location of socket in memory
> 
> and names tcp4_seq_show()/tcp6_seq_show() as the implementation, with a
> nonzero example value.  With get_tcp4_sock(), get_tcp6_sock(),
> get_openreq4()/get_openreq6() and get_timewait4_sock()/get_timewait6_sock()
> all emitting a literal 0 there, no code path can produce the documented
> value any more.  Could that documentation be adjusted along with this
> change?
> 
> [ ... ]

Re: [PATCH net-next v3] net: Replace %pK output with 0

[Sebastian Andrzej Siewior]

On 2026-08-13 18:58:01 [-0700], Jakub Kicinski wrote:
> Hi Sebastian!
Hi Jakub,

> We have upgraded the slop...itifier since v2, it has more comments now...
> The one about %ps potentially leaking more rather than less looks legit?

It complains about %ps leaking the pointer if kallsym is switched off.
This isn't unique to can and I pointed this out to Kees. 
Oliver Hartkopp mentioned that he wanted to rework the can output.

I'm going to tell vsprintf to route the %ps output the same as %p for
!kallsym so this goes away. 

Depending on what you prefer we can keep it as it or I drop the can bits
and repost everything else as-it. And then address later the other
sashiko bits where the documentation mentions "location of socket in
memory".

Sebastian

Re: [PATCH net-next v3] net: Replace %pK output with 0

[Jakub Kicinski]

On Fri, 14 Aug 2026 12:58:12 +0200 Sebastian Andrzej Siewior wrote:
> > We have upgraded the slop...itifier since v2, it has more comments now...
> > The one about %ps potentially leaking more rather than less looks legit?  
> 
> It complains about %ps leaking the pointer if kallsym is switched off.
> This isn't unique to can and I pointed this out to Kees. 
> Oliver Hartkopp mentioned that he wanted to rework the can output.
> 
> I'm going to tell vsprintf to route the %ps output the same as %p for
> !kallsym so this goes away. 
> 
> Depending on what you prefer we can keep it as it or I drop the can bits
> and repost everything else as-it. And then address later the other
> sashiko bits where the documentation mentions "location of socket in
> memory".

Not my expertise, TBH, I'd err on the side of caution since these are
security/hardening measures. IDK how much this all matters, or if
anyone uses !kallsym. 

Note that any rework has a solid chance of missing 7.3.

It should be most expedient to take the controversial part out and
repost. Or we can ask Kees for a recommendation?

Re: [PATCH net-next v3] net: Replace %pK output with 0

[Sebastian Andrzej Siewior]

On 2026-08-14 06:55:42 [-0700], Jakub Kicinski wrote:
> Not my expertise, TBH, I'd err on the side of caution since these are
> security/hardening measures. IDK how much this all matters, or if
> anyone uses !kallsym. 
> 
> Note that any rework has a solid chance of missing 7.3.
> 
> It should be most expedient to take the controversial part out and
> repost. Or we can ask Kees for a recommendation?

I dropped the can bits in the meantime since Oliver posted his rework
already. So I would repost it if it is okay. If you say it will miss
7.3 anyway then can of course wait until net-next opens again.

Sebastian