Re: [PATCH v8 2/4] rust: kernel: Add pointer wrapper types for safe pointer formatting

[Gary Guo <gary@garyguo.net>]

On Fri, 2 Jan 2026 08:57:16 +0100
Dirk Behme <dirk.behme@de.bosch.com> wrote:

> On 01/01/2026 09:16, Ke Sun wrote:
> > Add two pointer wrapper types (HashedPtr, RawPtr) to rust/kernel/ptr.rs
> > that correspond to C kernel's printk format specifiers %p and %px. These
> > types provide type-safe pointer formatting that matches C kernel patterns.
> > 
> > These wrapper types implement core::fmt::Pointer and delegate to the
> > corresponding kernel formatting functions, enabling safe pointer
> > formatting in Rust code that prevents information leaks about kernel
> > memory layout.
> > 
> > Users can explicitly use these types:
> >      pr_info!("{:p}\n", HashedPtr(ptr));
> >      pr_info!("{:p}\n", RawPtr(ptr));
> > 
> > HashedPtr uses ptr_to_hashval() to hash pointers before printing,
> > providing the default safe behavior for kernel pointers. RawPtr prints
> > the raw address and should only be used for debugging purposes.
> > 
> > Signed-off-by: Ke Sun <sunke@kylinos.cn>
> > Suggested-by: Dirk Behme <dirk.behme@gmail.com>
> > Suggested-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> > ---
> >   rust/kernel/ptr.rs | 133 ++++++++++++++++++++++++++++++++++++++++++++-
> >   1 file changed, 130 insertions(+), 3 deletions(-)
> > 
> > diff --git a/rust/kernel/ptr.rs b/rust/kernel/ptr.rs
> > index e3893ed04049d..77132eaaef73b 100644
> > --- a/rust/kernel/ptr.rs
> > +++ b/rust/kernel/ptr.rs
> > @@ -1,11 +1,22 @@
> >   // SPDX-License-Identifier: GPL-2.0
> >   
> >   //! Types and functions to work with pointers and addresses.
> > +//!
> > +//! This module provides wrapper types for formatting kernel pointers that correspond to the
> > +//! C kernel's printk format specifiers `%p` and `%px`.
> >   
> > -use core::mem::align_of;
> > -use core::num::NonZero;
> > +use core::{
> > +    fmt,
> > +    fmt::Pointer,
> > +    mem::align_of,
> > +    num::NonZero, //
> > +};
> >   
> > -use crate::build_assert;
> > +use crate::{
> > +    bindings,
> > +    build_assert,
> > +    prelude::*, //
> > +};
> >   
> >   /// Type representing an alignment, which is always a power of two.
> >   ///
> > @@ -225,3 +236,119 @@ fn align_up(self, alignment: Alignment) -> Option<Self> {
> >   }
> >   
> >   impl_alignable_uint!(u8, u16, u32, u64, usize);
> > +
> > +/// Placeholder string used when pointer hashing is not ready yet.
> > +const PTR_PLACEHOLDER: &str = if size_of::<*const c_void>() == 8 {
> > +    "(____ptrval____)"
> > +} else {
> > +    "(ptrval)"
> > +};
> > +
> > +/// Helper function to hash a pointer and format it.
> > +///
> > +/// Returns `Ok(())` if the hash was successfully computed and formatted,
> > +/// or the placeholder string if hashing is not ready yet.
> > +fn format_hashed_ptr(ptr: *const c_void, f: &mut fmt::Formatter<'_>) -> fmt::Result {
> > +    let mut hashval: crate::ffi::c_ulong = 0;
> > +    // SAFETY: We're calling the kernel's ptr_to_hashval function which handles
> > +    // hashing. This is safe as long as ptr is a valid pointer value.
> > +    let ret = unsafe { bindings::ptr_to_hashval(ptr, &mut hashval) };
> > +
> > +    if ret != 0 {
> > +        // Hash not ready yet, print placeholder with formatting options applied
> > +        // Using `pad()` ensures width, alignment, and padding options are respected
> > +        return f.pad(PTR_PLACEHOLDER);
> > +    }
> > +
> > +    // Successfully got hash value, format it using Pointer::fmt to preserve
> > +    // formatting options (width, alignment, padding, etc.)
> > +    Pointer::fmt(&(hashval as *const c_void), f)
> > +}
> > +
> > +/// A pointer that will be hashed when printed (corresponds to `%p`).
> > +///
> > +/// This is the default behavior for kernel pointers - they are hashed to prevent
> > +/// leaking information about the kernel memory layout.
> > +///
> > +/// # Example
> > +///
> > +/// ```
> > +/// use kernel::{
> > +///     prelude::fmt,
> > +///     ptr::HashedPtr,
> > +///     str::CString, //
> > +/// };
> > +///
> > +/// let ptr = HashedPtr(0x12345678 as *const u8);
> > +/// pr_info!("Hashed pointer: {:016p}\n", ptr);
> > +///
> > +/// // Width option test
> > +/// let cstr = CString::try_from_fmt(fmt!("{:30p}", ptr))?;
> > +/// let width_30 = cstr.to_str()?;
> > +/// assert_eq!(width_30.len(), 30);
> > +/// # Ok::<(), kernel::error::Error>(())
> > +/// ```
> > +#[repr(transparent)]
> > +#[derive(Copy, Clone)]
> > +pub struct HashedPtr<T>(pub *const T);
> > +
> > +impl<T> fmt::Pointer for HashedPtr<T> {
> > +    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
> > +        // Handle NULL pointers - print them directly
> > +        let ptr = self.0.cast::<c_void>();
> > +        if ptr.is_null() {
> > +            return Pointer::fmt(&ptr, f);
> > +        }
> > +
> > +        format_hashed_ptr(ptr, f)
> > +    }
> > +}
> > +
> > +/// A pointer that will be printed as its raw address (corresponds to `%px`).
> > +///
> > +/// **Warning**: This exposes the real kernel address and should only be used
> > +/// for debugging purposes. Consider using [`HashedPtr`] instead for production code.
> > +///
> > +/// # Example
> > +///
> > +/// ```
> > +/// use kernel::{
> > +///     prelude::fmt,
> > +///     ptr::RawPtr,
> > +///     str::CString, //
> > +/// };
> > +///
> > +/// let ptr = RawPtr(0x12345678 as *const u8);
> > +///
> > +/// // Basic formatting
> > +/// let cstr = CString::try_from_fmt(fmt!("{:p}", ptr))?;
> > +/// let formatted = cstr.to_str()?;
> > +/// assert_eq!(formatted, "0x12345678");
> > +///
> > +/// // Right align with zero padding, width 30
> > +/// let cstr = CString::try_from_fmt(fmt!("{:0>30p}", ptr))?;
> > +/// let right_zero = cstr.to_str()?;
> > +/// assert_eq!(right_zero, "000000000000000000000x12345678");
> > +///
> > +/// // Left align with zero padding, width 30
> > +/// let cstr = CString::try_from_fmt(fmt!("{:0<30p}", ptr))?;
> > +/// let left_zero = cstr.to_str()?;
> > +/// assert_eq!(left_zero, "0x1234567800000000000000000000");
> > +///
> > +/// // Center align with zero padding, width 30
> > +/// let cstr = CString::try_from_fmt(fmt!("{:0^30p}", ptr))?;
> > +/// let center_zero = cstr.to_str()?;
> > +/// assert_eq!(center_zero, "00000000000x123456780000000000");
> > +/// # Ok::<(), kernel::error::Error>(())
> > +/// ```
> > +#[repr(transparent)]
> > +#[derive(Copy, Clone)]
> > +pub struct RawPtr<T>(pub *const T);  
> 
> 
> In the thread "[PATCH] gpu: nova-core: bitfield: use &mut self setters 
> instead of builder pattern" [1] Gary proposed to add `#[must_use]`. 
> Would that be an option here as well?
> 
> Thanks
> 
> Dirk

Hi Dirk,

I don't think that's necessary here. Adding `#[must_use]` on a type means
that any function returning it becomes automatically `#[must_use]`, but I
find it hard to find a case where misuse can happen without such
attributes, let alone I don't think people would return `RawPtr` from
function in the first place?

Best,
Gary

> 
> [1] 
> https://lore.kernel.org/rust-for-linux/20260101042851.08576bdb.gary@garyguo.net/
> 
> > +
> > +impl<T> fmt::Pointer for RawPtr<T> {
> > +    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
> > +        // Directly format the raw address - no hashing or restriction.
> > +        // This corresponds to %px behavior.
> > +        Pointer::fmt(&self.0.cast::<c_void>(), f)
> > +    }
> > +}  
>