Commit 643a7c306b8c ("rust: fmt: route {:p} through HashedPtr to prevent address leaks") made {:p} go through the kernel's %p so that pointers are hashed by default. However, it formats them with %#0*p, where the '#' flag prepends a '0x' prefix that the plain %p does not produce in C. Thus the same pointer is printed differently from C and from Rust: C %p 00000000e8efa736 Rust {:p} 0x00000000e8efa736 The prefix is a leftover from 'core::fmt::Pointer', which always adds one. However, doing so deviates from the %p format documented in Documentation/core-api/printk-formats.rst and makes it harder to correlate the same pointer across C and Rust messages. Format the pointer with '%0*p' instead and adjust the default field width accordingly, so that {:p} produces exactly the same output as plain %p which is zero-padded to the width of a pointer and without any prefix, both for hashed pointers and for real addresses under 'no_hash_pointers'. Update the KUnit test expectations to match. Note this patch focuses only on fixing the '{:p}' prefix to match %p. The '#' flag remains ignored as before, so the '{:#p}' equivalent to %#p should be sent as a follow up patch. Fixes: 643a7c306b8c ("rust: fmt: route {:p} through HashedPtr to prevent address leaks") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Carlos Llamas --- rust/kernel/fmt.rs | 48 ++++++++++++++++++++++++---------------------- 1 file changed, 25 insertions(+), 23 deletions(-) diff --git a/rust/kernel/fmt.rs b/rust/kernel/fmt.rs index 29582b053ab1..b35858a28d38 100644 --- a/rust/kernel/fmt.rs +++ b/rust/kernel/fmt.rs @@ -64,6 +64,9 @@ pub trait Pointer { /// By default, `%p` prints a hashed representation of the pointer address to prevent kernel address /// leaks. When the `no_hash_pointers` kernel command-line parameter is enabled, the real address is /// printed instead (for debugging purposes). +/// +/// The output matches that of `%p` in C: zero-padded to the width of a pointer and, unlike +/// [`core::fmt::Pointer`], without a `0x` prefix. pub struct HashedPtr(pub *const T); impl Pointer for HashedPtr { @@ -72,33 +75,32 @@ fn fmt(&self, f: &mut Formatter<'_>) -> Result { let mut buf = [0u8; 32]; - // Use `%#0*p` for the `0x` prefix and zero-padding; `+2` compensates for - // the prefix counting toward the field width. - let default_width = (2 * size_of::() + 2) as c_int; + // Like `%p`, zero-pad to the width of a pointer and do not add a `0x` prefix. + let default_width = (2 * size_of::()) as c_int; let width = match (f.sign_aware_zero_pad(), f.width()) { (true, Some(w)) if w > 0 => w.min(buf.len() - 1) as c_int, _ => default_width, }; // SAFETY: `buf` is a valid, writable 32-byte buffer, sufficient for - // all architectures (max 19 bytes for 64-bit under the default width). + // all architectures (max 17 bytes for 64-bit under the default width). // The format string is null-terminated; `width` (c_int) and pointer // match the `%*` and `%p` specifiers. let len = unsafe { crate::bindings::scnprintf( buf.as_mut_ptr().cast(), buf.len(), - c"%#0*p".as_char_ptr(), + c"%0*p".as_char_ptr(), width, self.0.cast::(), ) }; - // SAFETY: `%#0*p` produces only ASCII, which is valid UTF-8. + // SAFETY: `%0*p` produces only ASCII, which is valid UTF-8. let s = unsafe { core::str::from_utf8_unchecked(&buf[..len as usize]) }; if f.sign_aware_zero_pad() { - // `scnprintf` already applied the width and zero-padding via `%#0*p`. + // `scnprintf` already applied the width and zero-padding via `%0*p`. f.write_str(s) } else { f.pad(s) @@ -224,26 +226,26 @@ mod tests { mod expected { pub(super) const PTR_VALUE: usize = 0xffffffffdeadbeef; pub(super) const PTR_VAL_NO_CRNG: &str = "(____ptrval____)"; - pub(super) const HASHED_PREFIX: &str = "0x00000000"; - pub(super) const RAW_POINTER: &str = "0xffffffffdeadbeef"; - pub(super) const PADDED_RIGHT: &str = " 0xffffffffdeadbeef"; - pub(super) const ZERO_PADDED: &str = "0x000000ffffffffdeadbeef"; - pub(super) const HASHED_PADDED_RIGHT_PREFIX: &str = " "; - pub(super) const HASHED_ZERO_PADDED_PREFIX: &str = "0x00000000000000"; - pub(super) const CLAMPED: &str = "0x0000000000000ffffffffdeadbeef"; + pub(super) const HASHED_PREFIX: &str = "00000000"; + pub(super) const RAW_POINTER: &str = "ffffffffdeadbeef"; + pub(super) const PADDED_RIGHT: &str = " ffffffffdeadbeef"; + pub(super) const ZERO_PADDED: &str = "00000000ffffffffdeadbeef"; + pub(super) const HASHED_PADDED_RIGHT_PREFIX: &str = " "; + pub(super) const HASHED_ZERO_PADDED_PREFIX: &str = "0000000000000000"; + pub(super) const CLAMPED: &str = "000000000000000ffffffffdeadbeef"; } #[cfg(not(CONFIG_64BIT))] mod expected { pub(super) const PTR_VALUE: usize = 0xdeadbeef; pub(super) const PTR_VAL_NO_CRNG: &str = "(ptrval)"; - pub(super) const HASHED_PREFIX: &str = "0x"; - pub(super) const RAW_POINTER: &str = "0xdeadbeef"; - pub(super) const PADDED_RIGHT: &str = " 0xdeadbeef"; - pub(super) const ZERO_PADDED: &str = "0x00000000000000deadbeef"; - pub(super) const HASHED_PADDED_RIGHT_PREFIX: &str = " "; - pub(super) const HASHED_ZERO_PADDED_PREFIX: &str = "0x00000000000000"; - pub(super) const CLAMPED: &str = "0x0000000000000000000000deadbeef"; + pub(super) const HASHED_PREFIX: &str = ""; + pub(super) const RAW_POINTER: &str = "deadbeef"; + pub(super) const PADDED_RIGHT: &str = " deadbeef"; + pub(super) const ZERO_PADDED: &str = "0000000000000000deadbeef"; + pub(super) const HASHED_PADDED_RIGHT_PREFIX: &str = " "; + pub(super) const HASHED_ZERO_PADDED_PREFIX: &str = "0000000000000000"; + pub(super) const CLAMPED: &str = "00000000000000000000000deadbeef"; } #[test] @@ -289,8 +291,8 @@ fn test_ptr_formatting() -> core::result::Result<(), crate::error::Error> { let cstr = CString::try_from_fmt(fmt!("{:0100p}", ptr))?; let output = cstr.to_str()?; - assert!(output.starts_with("0x")); - assert!(!output[2..].chars().all(|c| c == '0')); + assert_eq!(output.len(), expected::CLAMPED.len()); + assert!(!output.chars().all(|c| c == '0')); } Ok(()) -- 2.56.0.385.gd3acb90ef8-goog