[PATCH 0/2] vsprintf: Don't leak pointers

[PATCH 0/2] vsprintf: Don't leak pointers

[Sebastian Andrzej Siewior]

It is possible to leak pointers via %ps without KALLSYMS enabled.
With KALLSYMS pointers can be leaked if they can not be resolved.

The tiny series has two patches, one for each issue.

Sebastian Andrzej Siewior (2):
  vsprintf: Don't leak pointers for %ps without KALLSYMS enabled
  kallsyms: Don't leak pointers for unresolved symbols.

 kernel/kallsyms.c | 2 +-
 lib/vsprintf.c    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

-- 
2.55.0

[PATCH 1/2] vsprintf: Don't leak pointers for %ps without KALLSYMS enabled

[Sebastian Andrzej Siewior]

The "%ps" format modifier prints the name of the symbol which is more
valuable in terms of debugging and does not leak the actual pointer.

Without KALLSYMS it will leak the pointer which is not intended. The
default policy for pointers is to print a hashed value and not to leak
the actual pointer.

Print "(unknown)" for any symbol resolution witout KALLSYMS enabled.

Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
---
 lib/vsprintf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 2bc6ef483576c..ac954cc7bfb31 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -1008,7 +1008,7 @@ char *symbol_string(char *buf, char *end, void *ptr,
 
 	return string_nocheck(buf, end, sym, spec);
 #else
-	return special_hex_number(buf, end, value, sizeof(void *));
+	return string_nocheck(buf, end, "(unknown)", spec);
 #endif
 }
 
-- 
2.55.0

[PATCH 2/2] kallsyms: Don't leak pointers for unresolved symbols.

[Sebastian Andrzej Siewior]

__sprint_symbol() is supposed to resolve the passed address to a symbol
name. If the symbol can not be resolved it will print the actual pointer
that was passed. The pointer policy is to not reveal actual pointer
values.

Backtraces used to print the address followed by the symbol name. The
address has been removed leaving just the resolved symbol. If the
pointer can not be resolved to a symbol, it shouldn't be printed as the
bare value.

Print "(unknown)" for any symbol that can not be resolved.

Cc: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
---
 kernel/kallsyms.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
index aec2f06858afd..c70adaa97c24b 100644
--- a/kernel/kallsyms.c
+++ b/kernel/kallsyms.c
@@ -483,7 +483,7 @@ static int __sprint_symbol(char *buffer, unsigned long address,
 	len = kallsyms_lookup_buildid(address, &size, &offset, &modname, &buildid,
 				       buffer);
 	if (!len)
-		return sprintf(buffer, "0x%lx", address - symbol_offset);
+		return sprintf(buffer, "(unknown)");
 
 	offset -= symbol_offset;
 
-- 
2.55.0

Re: [PATCH 2/2] kallsyms: Don't leak pointers for unresolved symbols.

[Bradley Morgan]

LGTM,

Reviewed-by: Bradley Morgan <include@grrlz.net> # kernel/
Thanks!

Re: [PATCH 0/2] vsprintf: Don't leak pointers

[Andrew Morton]

On Fri, 14 Aug 2026 16:48:52 +0200 Sebastian Andrzej Siewior <bigeasy@linutronix.de> wrote:

> It is possible to leak pointers via %ps without KALLSYMS enabled.
> With KALLSYMS pointers can be leaked if they can not be resolved.
> 
> The tiny series has two patches, one for each issue.
> 

Thanks.

fwiw, Sashiko flagged a few possible issues:
	https://sashiko.dev/#/patchset/20260814144854.746840-1-bigeasy@linutronix.de

Re: [PATCH 1/2] vsprintf: Don't leak pointers for %ps without KALLSYMS enabled

[Andy Shevchenko]

On Fri, Aug 14, 2026 at 04:48:53PM +0200, Sebastian Andrzej Siewior wrote:
> The "%ps" format modifier prints the name of the symbol which is more
> valuable in terms of debugging and does not leak the actual pointer.
> 
> Without KALLSYMS it will leak the pointer which is not intended. The
> default policy for pointers is to print a hashed value and not to leak
> the actual pointer.
> 
> Print "(unknown)" for any symbol resolution witout KALLSYMS enabled.

Hmm... I would expect some test cases to be added/modified.
-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH 1/2] vsprintf: Don't leak pointers for %ps without KALLSYMS enabled

[Sebastian Andrzej Siewior]

On 2026-08-15 11:58:03 [+0300], Andy Shevchenko wrote:
> On Fri, Aug 14, 2026 at 04:48:53PM +0200, Sebastian Andrzej Siewior wrote:
> > The "%ps" format modifier prints the name of the symbol which is more
> > valuable in terms of debugging and does not leak the actual pointer.
> > 
> > Without KALLSYMS it will leak the pointer which is not intended. The
> > default policy for pointers is to print a hashed value and not to leak
> > the actual pointer.
> > 
> > Print "(unknown)" for any symbol resolution witout KALLSYMS enabled.
> 
> Hmm... I would expect some test cases to be added/modified.

No bot complained so far, so maybe not ;)

Sebastian

Re: [PATCH 0/2] vsprintf: Don't leak pointers

[Petr Mladek]

On Fri 2026-08-14 12:56:47, Andrew Morton wrote:
> On Fri, 14 Aug 2026 16:48:52 +0200 Sebastian Andrzej Siewior <bigeasy@linutronix.de> wrote:
> 
> > It is possible to leak pointers via %ps without KALLSYMS enabled.
> > With KALLSYMS pointers can be leaked if they can not be resolved.
> > 
> > The tiny series has two patches, one for each issue.
> > 
> 
> Thanks.
> 
> fwiw, Sashiko flagged a few possible issues:
> 	https://sashiko.dev/#/patchset/20260814144854.746840-1-bigeasy@linutronix.de

Sashiko basically complains about that this might make
dump_stack(), panics, and oopses useless on systems without KALLSYMS
which is typical on embedded systems.

IMHO, it is a good point. What about using default_pointer() resp. %p
as the fallback? It would allow to see the pointers with
"no_hash_pointers" kernel parameter.

Best Regards,
Petr

Re: [PATCH 0/2] vsprintf: Don't leak pointers

[Sebastian Andrzej Siewior]

On 2026-08-20 17:28:25 [+0200], Petr Mladek wrote:
> On Fri 2026-08-14 12:56:47, Andrew Morton wrote:
> > On Fri, 14 Aug 2026 16:48:52 +0200 Sebastian Andrzej Siewior <bigeasy@linutronix.de> wrote:
> > 
> > > It is possible to leak pointers via %ps without KALLSYMS enabled.
> > > With KALLSYMS pointers can be leaked if they can not be resolved.
> > > 
> > > The tiny series has two patches, one for each issue.
> > > 
> > 
> > Thanks.
> > 
> > fwiw, Sashiko flagged a few possible issues:
> > 	https://sashiko.dev/#/patchset/20260814144854.746840-1-bigeasy@linutronix.de
> 
> Sashiko basically complains about that this might make
> dump_stack(), panics, and oopses useless on systems without KALLSYMS
> which is typical on embedded systems.
> 
> IMHO, it is a good point. What about using default_pointer() resp. %p
> as the fallback? It would allow to see the pointers with
> "no_hash_pointers" kernel parameter.

I didn't repost it yet. But this is what I did locally. #1 takes
no_hash_pointers into consideration and #2 is just a comment _why_ we
"leak" the actual pointer.

> Best Regards,
> Petr

Sebastian

Re: [PATCH 1/2] vsprintf: Don't leak pointers for %ps without KALLSYMS enabled

[Petr Mladek]

On Thu 2026-08-20 16:24:26, Sebastian Andrzej Siewior wrote:
> On 2026-08-15 11:58:03 [+0300], Andy Shevchenko wrote:
> > On Fri, Aug 14, 2026 at 04:48:53PM +0200, Sebastian Andrzej Siewior wrote:
> > > The "%ps" format modifier prints the name of the symbol which is more
> > > valuable in terms of debugging and does not leak the actual pointer.
> > > 
> > > Without KALLSYMS it will leak the pointer which is not intended. The
> > > default policy for pointers is to print a hashed value and not to leak
> > > the actual pointer.
> > > 
> > > Print "(unknown)" for any symbol resolution witout KALLSYMS enabled.
> > 
> > Hmm... I would expect some test cases to be added/modified.
> 
> No bot complained so far, so maybe not ;)

It seems that we really do not have test cases for this. I guess
that it is because it is so tricky with the various fallbacks, ...

The existing test cases for %p are tricky as well. As a result
they are an infinite source of problems ;-)

Best Regards,
Petr