linux-kernel - Re: [PATCH RESEND] ref_tracker: use %p instead of %px in debugfs dentry name

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aRZX4JgN9nOEjIPg@intel.com>
Date: Fri, 14 Nov 2025 00:12:48 +0200
From: Ville Syrjälä <ville.syrjala@...ux.intel.com>
To: Jeff Layton <jlayton@...nel.org>
Cc: Andrew Morton <akpm@...ux-foundation.org>,
	Jakub Kicinski <kuba@...nel.org>,
	Eric Dumazet <edumazet@...gle.com>, Kees Cook <kees@...nel.org>,
	netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH RESEND] ref_tracker: use %p instead of %px in debugfs
 dentry name

On Fri, Aug 08, 2025 at 07:45:23AM -0400, Jeff Layton wrote:
> As Kees points out, this is a kernel address leak, and debugging is
> not a sufficiently good reason to expose the real kernel address.
> 
> Fixes: 65b584f53611 ("ref_tracker: automatically register a file in debugfs for a ref_tracker_dir")
> Reported-by: Kees Cook <kees@...nel.org>
> Closes: https://lore.kernel.org/netdev/202507301603.62E553F93@keescook/
> Signed-off-by: Jeff Layton <jlayton@...nel.org>
> ---
> Resending since I didn't get a response from Andrew. This time I've
> included netdev in the mailing list in case Jakub wants to pick this up
> instead.
> ---
>  lib/ref_tracker.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/lib/ref_tracker.c b/lib/ref_tracker.c
> index a9e6ffcff04b1da162a5a6add6bff075c2c9405e..cce12287708ea43e9eda9fe42f82a80423cea4e3 100644
> --- a/lib/ref_tracker.c
> +++ b/lib/ref_tracker.c
> @@ -434,7 +434,7 @@ void ref_tracker_dir_debugfs(struct ref_tracker_dir *dir)
>  	if (dentry && !xa_is_err(dentry))
>  		return;
>  
> -	ret = snprintf(name, sizeof(name), "%s@%px", dir->class, dir);
> +	ret = snprintf(name, sizeof(name), "%s@%p", dir->class, dir);

This now results in attempts to register the same nonsense looking
debugfs file multiple times, which leads to errors in dmesg:
"debugfs: 'netdev@(____ptrval____)' already exists in 'ref_tracker'"

And we end up with a single file instead the one per network
interface (or whatever it was trying to achieve here):
 # tree /sys/kernel/debug/ref_tracker/
 /sys/kernel/debug/ref_tracker/
 └── netdev@(____ptrval____)

>  	name[sizeof(name) - 1] = '\0';
>  
>  	if (ret < sizeof(name)) {
> 
> ---
> base-commit: 260f6f4fda93c8485c8037865c941b42b9cba5d2
> change-id: 20250731-reftrack-dbgfs-f99ad92068bc
> 
> Best regards,
> -- 
> Jeff Layton <jlayton@...nel.org>
> 

-- 
Ville Syrjälä
Intel