Re: [PATCH v6 2/4] rust: kernel: Add pointer wrapper types for safe pointer formatting

[Ke Sun <sk.alvin.x@gmail.com>]

On 12/29/25 14:44, Dirk Behme wrote:
> On 27.12.25 04:39, Ke Sun wrote:
>> Add three pointer wrapper types (HashedPtr, RestrictedPtr, RawPtr) to
>> rust/kernel/ptr.rs that correspond to C kernel's printk format specifiers
>> %p, %pK, and %px. These types provide type-safe pointer formatting that
>> matches C kernel patterns.
>>
>> These wrapper types implement core::fmt::Pointer and delegate to the
>> corresponding kernel formatting functions, enabling safe pointer
>> formatting in Rust code that prevents information leaks about kernel
>> memory layout.
>>
>> Users can explicitly use these types:
>>      pr_info!("{:p}\n", HashedPtr::from(ptr));
>>      pr_info!("{:p}\n", RestrictedPtr::from(ptr));
>>      pr_info!("{:p}\n", RawPtr::from(ptr));
>>
>> Signed-off-by: Ke Sun <sunke@kylinos.cn>
>> ---
>>   rust/helpers/fmt.c     |  65 +++++++++++
>>   rust/helpers/helpers.c |   3 +-
>>   rust/kernel/ptr.rs     | 241 ++++++++++++++++++++++++++++++++++++++++-
>>   3 files changed, 305 insertions(+), 4 deletions(-)
>>   create mode 100644 rust/helpers/fmt.c
>>
> ....
>> diff --git a/rust/kernel/ptr.rs b/rust/kernel/ptr.rs
>> index e3893ed04049d..8b58221c2ec4b 100644
>> --- a/rust/kernel/ptr.rs
>> +++ b/rust/kernel/ptr.rs
> ....
>> +/// A pointer that will be hashed when printed (corresponds to `%p`).
>> +///
>> +/// This is the default behavior for kernel pointers - they are hashed to prevent
>> +/// leaking information about the kernel memory layout.
>> +///
>> +/// # Example
>> +///
>> +/// ```
>> +/// use kernel::{
>> +///     prelude::fmt,
>> +///     ptr::HashedPtr,
>> +///     str::CString, //
>> +/// };
>> +///
>> +/// let ptr = HashedPtr::from(0x12345678 as *const u8);
>> +/// pr_info!("Hashed pointer: {:016p}\n", ptr);
>> +///
>> +/// // Width option test
>> +/// let cstr = CString::try_from_fmt(fmt!("{:30p}", ptr))?;
>> +/// let width_30 = cstr.to_str()?;
>> +/// assert_eq!(width_30.len(), 30);
>> +/// # Ok::<(), kernel::error::Error>(())
>> +/// ```
>> +#[repr(transparent)]
>> +#[derive(Copy, Clone, Debug)]
>
> I wonder if the `Debug` could be used to expose the raw pointer where
> it shouldn't?

You're right. If we implement Debug for these pointer wrapper types, 
using {:?} would expose the

raw pointer address.

> Dirk
>
>
>> +pub struct HashedPtr(*const c_void);
>> +
>> +impl fmt::Pointer for HashedPtr {
>> +    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
>> +        // Handle NULL pointers - print them directly
>> +        if self.0.is_null() {
>> +            return Pointer::fmt(&self.0, f);
>> +        }
>> +
>> +        format_hashed_ptr(self.0, f)
>> +    }
>> +}
>> +
>> +/// A pointer that will be restricted based on `kptr_restrict` when printed (corresponds to `%pK`).
>> +///
>> +/// This is intended for use in procfs/sysfs files that are read by userspace.
>> +/// The behavior depends on the `kptr_restrict` sysctl setting.
>> +///
>> +/// # Example
>> +///
>> +/// ```
>> +/// use kernel::{
>> +///     prelude::fmt,
>> +///     ptr::RestrictedPtr,
>> +///     str::CString, //
>> +/// };
>> +///
>> +/// let ptr = RestrictedPtr::from(0x12345678 as *const u8);
>> +/// pr_info!("Restricted pointer: {:016p}\n", ptr);
>> +///
>> +/// // Width option test
>> +/// let cstr = CString::try_from_fmt(fmt!("{:30p}", ptr))?;
>> +/// let width_30 = cstr.to_str()?;
>> +/// assert_eq!(width_30.len(), 30);
>> +/// # Ok::<(), kernel::error::Error>(())
>> +/// ```
>> +#[repr(transparent)]
>> +#[derive(Copy, Clone, Debug)]
>> +pub struct RestrictedPtr(*const c_void);
>> +
>> +impl fmt::Pointer for RestrictedPtr {
>> +    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
>> +        // Handle NULL pointers
>> +        if self.0.is_null() {
>> +            return Pointer::fmt(&self.0, f);
>> +        }
>> +
>> +        // Use kptr_restrict_value to handle all kptr_restrict cases.
>> +        // SAFETY: kptr_restrict_value handles capability checks and IRQ context.
>> +        // - Returns NULL if no permission, IRQ context, or kptr_restrict >= 2
>> +        // - Returns the original pointer if kptr_restrict == 0 (needs hashing)
>> +        // - Returns the original pointer if kptr_restrict == 1 with permission (print raw)
>> +        let restricted_ptr = unsafe { bindings::kptr_restrict_value(self.0) };
>> +
>> +        if restricted_ptr.is_null() {
>> +            // No permission, IRQ context, or kptr_restrict >= 2 - print 0
>> +            return Pointer::fmt(&core::ptr::null::<c_void>(), f);
>> +        }
>> +
>> +        // restricted_ptr is non-null, meaning we should print something.
>> +        // SAFETY: Reading kptr_restrict is safe as it's a kernel variable.
>> +        let restrict = unsafe { bindings::kptr_restrict };
>> +
>> +        if restrict == 0 {
>> +            // kptr_restrict == 0: hash the pointer (same as %p)
>> +            format_hashed_ptr(self.0, f)
>> +        } else {
>> +            // kptr_restrict == 1 with permission: print the raw pointer directly (like %px)
>> +            // This matches C behavior: pointer_string() prints the raw address
>> +            Pointer::fmt(&restricted_ptr, f)
>> +        }
>> +    }
>> +}
>> +
>> +/// A pointer that will be printed as its raw address (corresponds to `%px`).
>> +///
>> +/// **Warning**: This exposes the real kernel address and should only be used
>> +/// for debugging purposes. Consider using [`HashedPtr`] or [`RestrictedPtr`] instead.
>> +///
>> +/// # Example
>> +///
>> +/// ```
>> +/// use kernel::{
>> +///     prelude::fmt,
>> +///     ptr::RawPtr,
>> +///     str::CString, //
>> +/// };
>> +///
>> +/// let ptr = RawPtr::from(0x12345678 as *const u8);
>> +///
>> +/// // Basic formatting
>> +/// let cstr = CString::try_from_fmt(fmt!("{:p}", ptr))?;
>> +/// let formatted = cstr.to_str()?;
>> +/// assert_eq!(formatted, "0x12345678");
>> +///
>> +/// // Right align with zero padding, width 30
>> +/// let cstr = CString::try_from_fmt(fmt!("{:0>30p}", ptr))?;
>> +/// let right_zero = cstr.to_str()?;
>> +/// assert_eq!(right_zero, "000000000000000000000x12345678");
>> +///
>> +/// // Left align with zero padding, width 30
>> +/// let cstr = CString::try_from_fmt(fmt!("{:0<30p}", ptr))?;
>> +/// let left_zero = cstr.to_str()?;
>> +/// assert_eq!(left_zero, "0x1234567800000000000000000000");
>> +///
>> +/// // Center align with zero padding, width 30
>> +/// let cstr = CString::try_from_fmt(fmt!("{:0^30p}", ptr))?;
>> +/// let center_zero = cstr.to_str()?;
>> +/// assert_eq!(center_zero, "00000000000x123456780000000000");
>> +/// # Ok::<(), kernel::error::Error>(())
>> +/// ```
>> +#[repr(transparent)]
>> +#[derive(Copy, Clone, Debug)]
>> +pub struct RawPtr(*const c_void);
>> +
>> +impl fmt::Pointer for RawPtr {
>> +    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
>> +        // Directly format the raw address - no hashing or restriction.
>> +        // This corresponds to %px behavior.
>> +        Pointer::fmt(&self.0, f)
>> +    }
>> +}
>> +
>> +// Implement common methods for all pointer wrapper types
>> +impl_ptr_wrapper!(
>> +    HashedPtr,
>> +    RawPtr,
>> +    RestrictedPtr, //
>> +);