Re: [PATCH v2 1/2] vsprintf: Don't leak pointers for %ps without KALLSYMS enabled

[Sebastian Andrzej Siewior <bigeasy@linutronix.de>]

On 2026-08-26 17:56:12 [+0200], Petr Mladek wrote:
> On Fri 2026-08-21 17:26:13, Sebastian Andrzej Siewior wrote:
> > The "%ps" format modifier prints the name of the symbol which is more
> > valuable in terms of debugging and does not leak the actual pointer.
> > 
> > Without KALLSYMS it will leak the pointer which is not intended. The
> > default policy for pointers is to print a hashed value and not to leak
> > the actual pointer.
> > 
> > For !KALLSYMS, print "(unknown)" for any symbol resolution. If hashed
> > pointer are disabled print the bare number.
> > 
> > Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
> > ---
> >  lib/vsprintf.c | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> > 
> > diff --git a/lib/vsprintf.c b/lib/vsprintf.c
> > index 2bc6ef483576c..fcb63f22b1997 100644
> > --- a/lib/vsprintf.c
> > +++ b/lib/vsprintf.c
> > @@ -1008,7 +1008,9 @@ char *symbol_string(char *buf, char *end, void *ptr,
> >  
> >  	return string_nocheck(buf, end, sym, spec);
> >  #else
> > -	return special_hex_number(buf, end, value, sizeof(void *));
> > +	if (unlikely(no_hash_pointers))
> > +		return special_hex_number(buf, end, value, sizeof(void *));
> > +	return string_nocheck(buf, end, "(unknown)", spec);
> >  #endif
> >  }
> 
> My understanding was that we were going to use
> 
> 	return default_pointer(buf, end, ptr, spec);
> 
> It would print the hashed pointer unless no_hash_pointers was set.
> IMHO, it would make the handling of pointer values more consistent.

The difference is that prints "Unknown" instead a value where a name was
expected. Look at this, we have now:

| # cat /proc/timer_list
…
|  next_event:     89340000000 nsecs
|  set_next_event: (unknown)
|  shutdown:       (unknown)
|  periodic:       (unknown)
|  oneshot:        (unknown)
|  oneshot stopped: (unknown)
|  event_handler:  (unknown)
…
| [    1.584810] ------------[ cut here ]------------
| [    1.584811] WARNING: init/main.c:1572 at (unknown), CPU#2: swapper/0/1
| [    1.584813] Modules linked in:
| [    1.584816] CPU: 2 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.2.0+ #66 PREEMPT_{RT,(lazy)}
| [    1.584819] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 2026.05-2 08/06/2026
| [    1.584820] RIP: 0010:(unknown)
| [    1.584821] Code: 74 46 e8 89 7c 2d ff e8 14 e5 42 ff e8 df c8 09 ff e8 ba 01 21 ff c7 05 04 2d 75 00 03 00 00 00 e8 8b bf 2b ff e8 56 1b 5c ff <0f> 0b 48 8b 3d bd 41 4a 00 48 85 ff 74 33 e8 33 60 09 ff 85 c0 75
| [    1.584823] RSP: 0018:ffffc90000023f30 EFLAGS: 00010292
| [    1.584825] RAX: ffff8881f8d0b000 RBX: ffffffff8216a030 RCX: ffff888102cae000
| [    1.584826] RDX: 0000000000000000 RSI: 0000000000000012 RDI: ffff8881002a3480
| [    1.584827] RBP: 0000000000000000 R08: ffff8881002a3480 R09: ffffea00040b2b80
| [    1.584828] R10: ffff888100041180 R11: ffffc90000023ec0 R12: ffffc90000023f58
| [    1.584829] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
| [    1.584833] FS:  0000000000000000(0000) GS:ffff8881f8d0b000(0000) knlGS:0000000000000000
| [    1.584834] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
| [    1.584835] CR2: 0000000000000000 CR3: 0000000002e46000 CR4: 00000000003506f0
| [    1.584837] Call Trace:
| [    1.584846]  <TASK>
| [    1.584847]  (unknown)
| [    1.584847]  ? (unknown)
| [    1.584849]  (unknown)
| [    1.584850]  </TASK>
| [    1.584850] ---[ end trace 0000000000000000 ]---

while printing a hashed pointer instead would give you:
| # cat /proc/timer_list
…
| next_event:     66384000000 nsecs
| set_next_event: 0000000095ee31e0
| shutdown:       00000000c838001a
| periodic:       000000002e3ab76e
| oneshot:        0000000019def7ac
| oneshot stopped: 00000000c838001a
| event_handler:  0000000053e7a80d
…
| [    1.498126] ------------[ cut here ]------------
| [    1.498127] WARNING: init/main.c:1572 at 000000007224a107, CPU#6: swapper/0/1
| [    1.498131] Modules linked in:
| [    1.498135] CPU: 6 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.2.0+ #68 PREEMPT_{RT,(lazy)}
| [    1.498138] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 2026.05-2 08/06/2026
| [    1.498140] RIP: 0010:000000007224a107
| [    1.498142] Code: 74 46 e8 e9 7c 2d ff e8 74 e5 42 ff e8 3f c9 09 ff e8 1a 02 21 ff c7 05 64 2d 75 00 03 00 00 00 e8 eb bf 2b ff e8 b6 1b 5c ff <0f> 0b 48 8b 3d 1d 42 4a 00 48 85 ff 74 33 e8 93 60 09 ff 85 c0 75
| [    1.498145] RSP: 0018:ffffc90000023f30 EFLAGS: 00010292
| [    1.498147] RAX: ffff8881f8e0b000 RBX: ffffffff82169fd0 RCX: ffff888102d9d2a0
| [    1.498149] RDX: 0000000000000000 RSI: 000000000000001e RDI: ffff8881002a3480
| [    1.498150] RBP: 0000000000000000 R08: ffff8881002a3480 R09: ffffea00040b6740
| [    1.498152] R10: ffff888100041180 R11: ffffc90000023ec0 R12: ffffc90000023f58
| [    1.498153] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
| [    1.498159] FS:  0000000000000000(0000) GS:ffff8881f8e0b000(0000) knlGS:0000000000000000
| [    1.498161] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
| [    1.498162] CR2: 0000000000000000 CR3: 0000000002e46000 CR4: 00000000003506f0
| [    1.498164] Call Trace:
| [    1.498171]  <TASK>
| [    1.498172]  00000000cb9bc262
| [    1.498174]  ? 00000000eb5021dd
| [    1.498176]  00000000ed1a9938
| [    1.498178]  </TASK>
| [    1.498179] ---[ end trace 0000000000000000 ]---

isn't this confusing? There is no added value in printing some random
numbers. Before this change you would also see "other" random values
with address randomisation. It confuses at best imho.

> Best Regards,
> Petr

Sebastian