Adding Linus into Cc.
On Fri 2026-08-21 17:26:14, Sebastian Andrzej Siewior wrote:
> __sprint_symbol() is supposed to resolve the passed address to a symbol
> name. If the symbol can not be resolved it will print the actual pointer
> that was passed. The pointer policy is to not reveal actual pointer
> values. However for post-mortem analysis of crashes it is helpful to see
> the raw pointer if it is a corrupted pointer.
>
> Document why raw unresolved pointers are printed.
> --- a/kernel/kallsyms.c
> +++ b/kernel/kallsyms.c
> @@ -482,8 +482,13 @@ static int __sprint_symbol(char *buffer, unsigned long
> address,
> address += symbol_offset;
> len = kallsyms_lookup_buildid(address, &size, &offset, &modname,
> &buildid,
> buffer);
> - if (!len)
> + if (!len) {
> + /*
> + * Print the raw pointer to allow post-mortem analysis of
> corrupted
> + * pointer in backtraces.
This might be acceptable when the system is going to panic().
But is this formatting used only during panic?
> + */
> return sprintf(buffer, "0x%lx", address - symbol_offset);
I expected that we would replace this by "%p" so that the pointer got
hashed by default. After all, we suggest to use %ps because it should
not leak pointers.
Hmm, I see %ps or %pS used by many interfaces, like procfs, sysfs,
ftrace. Many of them are accessible only by root. Maybe, people expect
to see the valid pointers.
But we do not want to repeate the %pK eperience here. We could not
reliably check the access rights of the vsprintf() caller.
So, we should agree on the default behavior which does not
depend on the caller.
And I think that we want to reduce the risk of leaking.
So, I would use %p here.
If some callers really want to always print the real pointer when
the symbol is not resolved then we might add some modifier for
this, e.g. %p[SsB][R][p], where p would mean plain. But I am
not sure if we really want it.
> + }
>
> offset -= symbol_offset;
Best Regards,
Petr
