Re: [PATCH v2 1/2] vsprintf: Don't leak pointers for %ps without KALLSYMS enabled

[Petr Mladek <pmladek@suse.com>]

On Thu 2026-08-27 11:14:07, Sebastian Andrzej Siewior wrote:
> On 2026-08-26 17:56:12 [+0200], Petr Mladek wrote:
> > On Fri 2026-08-21 17:26:13, Sebastian Andrzej Siewior wrote:
> > > The "%ps" format modifier prints the name of the symbol which is more
> > > valuable in terms of debugging and does not leak the actual pointer.
> > > 
> > > Without KALLSYMS it will leak the pointer which is not intended. The
> > > default policy for pointers is to print a hashed value and not to leak
> > > the actual pointer.
> > > 
> > > For !KALLSYMS, print "(unknown)" for any symbol resolution. If hashed
> > > pointer are disabled print the bare number.
> > > 
> > > Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
> > > ---
> > >  lib/vsprintf.c | 4 +++-
> > >  1 file changed, 3 insertions(+), 1 deletion(-)
> > > 
> > > diff --git a/lib/vsprintf.c b/lib/vsprintf.c
> > > index 2bc6ef483576c..fcb63f22b1997 100644
> > > --- a/lib/vsprintf.c
> > > +++ b/lib/vsprintf.c
> > > @@ -1008,7 +1008,9 @@ char *symbol_string(char *buf, char *end, void *ptr,
> > >  
> > >  	return string_nocheck(buf, end, sym, spec);
> > >  #else
> > > -	return special_hex_number(buf, end, value, sizeof(void *));
> > > +	if (unlikely(no_hash_pointers))
> > > +		return special_hex_number(buf, end, value, sizeof(void *));
> > > +	return string_nocheck(buf, end, "(unknown)", spec);
> > >  #endif
> > >  }
> > 
> > My understanding was that we were going to use
> > 
> > 	return default_pointer(buf, end, ptr, spec);
> > 
> > It would print the hashed pointer unless no_hash_pointers was set.
> > IMHO, it would make the handling of pointer values more consistent.
> 
> The difference is that prints "Unknown" instead a value where a name was
> expected. Look at this, we have now:
> 
> | # cat /proc/timer_list
> …
> |  next_event:     89340000000 nsecs
> |  set_next_event: (unknown)
> |  shutdown:       (unknown)
> |  periodic:       (unknown)
> |  oneshot:        (unknown)
> |  oneshot stopped: (unknown)
> |  event_handler:  (unknown)
> …
> | [    1.584810] ------------[ cut here ]------------
> | [    1.584811] WARNING: init/main.c:1572 at (unknown), CPU#2: swapper/0/1
> | [    1.584813] Modules linked in:
> | [    1.584816] CPU: 2 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.2.0+ #66 PREEMPT_{RT,(lazy)}
> | [    1.584819] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 2026.05-2 08/06/2026
> | [    1.584820] RIP: 0010:(unknown)
> | [    1.584821] Code: 74 46 e8 89 7c 2d ff e8 14 e5 42 ff e8 df c8 09 ff e8 ba 01 21 ff c7 05 04 2d 75 00 03 00 00 00 e8 8b bf 2b ff e8 56 1b 5c ff <0f> 0b 48 8b 3d bd 41 4a 00 48 85 ff 74 33 e8 33 60 09 ff 85 c0 75
> | [    1.584823] RSP: 0018:ffffc90000023f30 EFLAGS: 00010292
> | [    1.584825] RAX: ffff8881f8d0b000 RBX: ffffffff8216a030 RCX: ffff888102cae000
> | [    1.584826] RDX: 0000000000000000 RSI: 0000000000000012 RDI: ffff8881002a3480
> | [    1.584827] RBP: 0000000000000000 R08: ffff8881002a3480 R09: ffffea00040b2b80
> | [    1.584828] R10: ffff888100041180 R11: ffffc90000023ec0 R12: ffffc90000023f58
> | [    1.584829] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
> | [    1.584833] FS:  0000000000000000(0000) GS:ffff8881f8d0b000(0000) knlGS:0000000000000000
> | [    1.584834] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> | [    1.584835] CR2: 0000000000000000 CR3: 0000000002e46000 CR4: 00000000003506f0
> | [    1.584837] Call Trace:
> | [    1.584846]  <TASK>
> | [    1.584847]  (unknown)
> | [    1.584847]  ? (unknown)
> | [    1.584849]  (unknown)
> | [    1.584850]  </TASK>
> | [    1.584850] ---[ end trace 0000000000000000 ]---
> 
> while printing a hashed pointer instead would give you:
> | # cat /proc/timer_list
> …
> | next_event:     66384000000 nsecs
> | set_next_event: 0000000095ee31e0
> | shutdown:       00000000c838001a
> | periodic:       000000002e3ab76e
> | oneshot:        0000000019def7ac
> | oneshot stopped: 00000000c838001a
> | event_handler:  0000000053e7a80d
> …
> | [    1.498126] ------------[ cut here ]------------
> | [    1.498127] WARNING: init/main.c:1572 at 000000007224a107, CPU#6: swapper/0/1
> | [    1.498131] Modules linked in:
> | [    1.498135] CPU: 6 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.2.0+ #68 PREEMPT_{RT,(lazy)}
> | [    1.498138] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 2026.05-2 08/06/2026
> | [    1.498140] RIP: 0010:000000007224a107
> | [    1.498142] Code: 74 46 e8 e9 7c 2d ff e8 74 e5 42 ff e8 3f c9 09 ff e8 1a 02 21 ff c7 05 64 2d 75 00 03 00 00 00 e8 eb bf 2b ff e8 b6 1b 5c ff <0f> 0b 48 8b 3d 1d 42 4a 00 48 85 ff 74 33 e8 93 60 09 ff 85 c0 75
> | [    1.498145] RSP: 0018:ffffc90000023f30 EFLAGS: 00010292
> | [    1.498147] RAX: ffff8881f8e0b000 RBX: ffffffff82169fd0 RCX: ffff888102d9d2a0
> | [    1.498149] RDX: 0000000000000000 RSI: 000000000000001e RDI: ffff8881002a3480
> | [    1.498150] RBP: 0000000000000000 R08: ffff8881002a3480 R09: ffffea00040b6740
> | [    1.498152] R10: ffff888100041180 R11: ffffc90000023ec0 R12: ffffc90000023f58
> | [    1.498153] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
> | [    1.498159] FS:  0000000000000000(0000) GS:ffff8881f8e0b000(0000) knlGS:0000000000000000
> | [    1.498161] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> | [    1.498162] CR2: 0000000000000000 CR3: 0000000002e46000 CR4: 00000000003506f0
> | [    1.498164] Call Trace:
> | [    1.498171]  <TASK>
> | [    1.498172]  00000000cb9bc262
> | [    1.498174]  ? 00000000eb5021dd
> | [    1.498176]  00000000ed1a9938
> | [    1.498178]  </TASK>
> | [    1.498179] ---[ end trace 0000000000000000 ]---
> 
> isn't this confusing? There is no added value in printing some random
> numbers. Before this change you would also see "other" random values
> with address randomisation. It confuses at best imho.

I think that it is a matter of taste. I could understand that
"(unknown)" might look more obvious to some people.

I would still prefer the hashed pointer. It make it consistent with
%p handling. Both print addresses in this case.

The motivation for the hash in %p is that it is slightly more useful
than a static string, e.g. "(address)" or "(pointer)". The hash allows
to match the same addresses. It is not 100% reliable but better
than nothing.

Also the hash makes it more obvious the connection with "no_hash_pointer"
option.

IMHO, the only drawback is that people might confuse the hash with
a real value. But it is easier on 64-bit systems because the higher
32-bits are zeros.

Best Regards,
Petr