Re: [PATCH v5 0/2] vsprintf: Don't leak pointers

[Petr Mladek <pmladek@suse.com>]

On Fri 2026-10-23 18:46:22, Sebastian Andrzej Siewior wrote:
> It is possible to leak pointers via %ps without KALLSYMS enabled.
> With KALLSYMS pointers can be leaked if they can not be resolved.
> 
> The tiny series has two patches, one for each issue.
> I do follow the %p format instead of printing "(unknown)" since I care
> more about getting it out of the way than the actual content (as long as
> it is not the leaked pointer). Last time the discussion added the h:
> prefix to a hashed pointer to identify it as such. I would like to keep
> this part out of the series since there are few users that expect a
> certain pointer width and adding two extra characters would break that
> (we could strip the two 0 on 64bit but again, not related to this
> problem here).
> 
> v4…v5: https://patch.msgid.link/20261019-vsprintf_kallsym-v4-0-ffd3c012d00c@linutronix.de
>  - Use %p instead snprintf_default_pointer(). This might recurse back to
>    vsnprintf() if used by '%ps' but it already did so. Suggested by Petr
>    Mladek.
> 
> v3…v4: https://patch.msgid.link/20261015-vsprintf_kallsym-v3-0-c175c27f38b7@linutronix.de
>  - In symbol_string(), !CONFIG_KALLSYMS case, use the 'value' argument
>    instead 'ptr' to consider the '%pR' case. Noticed by lkp@intel.com.
>  - The kerneldoc for snprintf_default_pointer() must describe the 'len'
>    argument instead the not existing 'size'. Noticed by lkp@intel.com.
>  - sashiko noticed that the string isn't properly terminated if the
>    input buffer is too small.
> 
> v2…v3: https://lore.kernel.org/all/20260821152614.2202196-1-bigeasy@linutronix.de/
>  - Instead of "(unknown)" the hashed pointer is printed. This follows
>    the generic %p flow.
>  - In v2 I argued that it is better so print the actual pointer instead
>    hiding it for post-mortem analysis. After looking at some backtraces
>    with invalid pointers (not part of the kernel image) I realised the
>    the PC is already part of the register dump. There I changed it back
>    to what %p would do if it can't resolve a pointer. Again, following
>    %p flow so it can be overridden at boot.
> 
> v1…v2: https://lore.kernel.org/all/20260814144854.746840-1-bigeasy@linutronix.de/
>  - For %ps and !KALLSYMS no_hash_pointers is used to decide if the
>    pointer should be written or not. This aligns with the %p policy.
>  - For %ps and KALLSYMS, unresolved pointer continue to be leaked. It
>    has been pointed out it might be useful to see them in backtraces/
>    crashes if the return address became invalid.
> 
> ---
> Sebastian Andrzej Siewior (2):
>       vsprintf: Don't leak pointers for %ps without KALLSYMS enabled
>       kallsyms: Don't leak pointers for unresolved symbols
> 
>  kernel/kallsyms.c | 2 +-
>  lib/vsprintf.c    | 2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)

JFYI, the patchset has been committed into printk/linux.git,
branch for-7.5-vsprintf-kallsyms.

Best Regards,
Petr