rust: Add safe pointer formatting support

The impl_fmt_adapter_forward! macro forwards Pointer for Adapter<T> by destructuring self into a local t, causing {:p} to print the address of that temporary stack variable rather than the actual pointer.

Remove Pointer from the macro and provide a manual impl for Adapter<&T> that passes self.0 directly.

Signed-off-by Ke Sun <[email protected]>

The impl_fmt_adapter_forward! macro forwards Pointer for Adapter<T> by destructuring self into a local t, causing {:p} to print the address of that temporary stack variable rather than the actual pointer.

Remove Pointer from the macro and provide a manual impl for Adapter<&T> that passes self.0 directly.

Signed-off-by Ke Sun <[email protected]>

---
 rust/kernel/fmt.rs | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

Define a custom kernel::fmt::Pointer trait and HashedPtr wrapper so that {:p} formatting uses the kernel's %p hashed format instead of printing raw pointer values, preventing kernel address space leaks.

Signed-off-by Ke Sun <[email protected]>

rust/kernel/fmt.rs +8 -0

+impl<T: ?Sized> Pointer for HashedPtr<T> {
+    fn fmt(&self, f: &mut Formatter<'_>) -> Result {
+        use crate::str::CStrExt as _;
+
+        let mut buf = [0u8; 32];
+
+        // SAFETY: `buf` is a valid, writable buffer of 32 bytes, sufficient for all architectures
+        // (max 19 bytes for 64-bit). The format string `c"0x%p"` is null-terminated and `%p`

Quoted 5 lines · Ke Sun

Define a custom kernel::fmt::Pointer trait and HashedPtr wrapper so that {:p} formatting uses the kernel's %p hashed format instead of printing raw pointer values, preventing kernel address space leaks.

Signed-off-by Ke Sun <[email protected]>

Overall looks good to me, but one thing:

Quoted 14 lines

rust/kernel/fmt.rs +14 -0

+impl<T: ?Sized> Pointer for HashedPtr<T> {
+    fn fmt(&self, f: &mut Formatter<'_>) -> Result {
+        use crate::str::CStrExt as _;
+
+        let mut buf = [0u8; 32];
+
+        // SAFETY: `buf` is a valid, writable buffer of 32 bytes, sufficient for all architectures
+        // (max 19 bytes for 64-bit). The format string `c"0x%p"` is null-terminated and `%p`
+        // matches the pointer argument.
+        let len = unsafe {
+            crate::bindings::scnprintf(
+                buf.as_mut_ptr().cast(),
+                buf.len(),
+                // Rust's `{:p}` includes a "0x" prefix, the kernel's `%p` does not.

rust/kernel/fmt.rs fn fmt(&self, f: &mut Formatter<'_>) -> Result { · line 84

Quoted 4 lines

rust/kernel/fmt.rs +4 -0

+                c"0x%p".as_char_ptr(),
+                self.0.cast::<core::ffi::c_void>(),
+            )
+        };

When given a null pointer, this will print 0x(null), which seems a bit weird. It may also print 0x(ptrval) or 0x(____ptrval____) during early boot.

It seems like it'd be nice to special-case these to provide better output in those cases.

Alice

Quoted 21 lines · Alice Ryhl

Quoted 5 lines · Ke Sun

Define a custom kernel::fmt::Pointer trait and HashedPtr wrapper so that {:p} formatting uses the kernel's %p hashed format instead of printing raw pointer values, preventing kernel address space leaks.

Signed-off-by Ke Sun <[email protected]>

Overall looks good to me, but one thing:

Quoted 13 lines

rust/kernel/fmt.rs +13 -0

+impl<T: ?Sized> Pointer for HashedPtr<T> {
+    fn fmt(&self, f: &mut Formatter<'_>) -> Result {
+        use crate::str::CStrExt as _;
+
+        let mut buf = [0u8; 32];
+
+        // SAFETY: `buf` is a valid, writable buffer of 32 bytes, sufficient for all architectures
+        // (max 19 bytes for 64-bit). The format string `c"0x%p"` is null-terminated and `%p`
+        // matches the pointer argument.
+        let len = unsafe {
+            crate::bindings::scnprintf(
+                buf.as_mut_ptr().cast(),
+                buf.len(),

Quoted 8 lines

rust/kernel/fmt.rs fn fmt(&self, f: &mut Formatter<'_>) -> Result { · line 84

Quoted 5 lines

rust/kernel/fmt.rs +5 -0

+                // Rust's `{:p}` includes a "0x" prefix, the kernel's `%p` does not.
+                c"0x%p".as_char_ptr(),
+                self.0.cast::<core::ffi::c_void>(),
+            )
+        };

When given a null pointer, this will print 0x(null), which seems a bit weird. It may also print 0x(ptrval) or 0x(____ptrval____) during early boot.

I’ve also seen a bunch of 0x(ptrval) during testing.

This series resolves a mystery where I thought I was crazy since addresses of pointers and references were never what I thought they were, and instead were always on the stack, thanks a lot for resolving this!

Tested-by Link Mauve <[email protected]>

Quoted 6 lines

It seems like it'd be nice to special-case these to provide better output in those cases.

Alice

Quoted 5 lines · Ke Sun

Define a custom kernel::fmt::Pointer trait and HashedPtr wrapper so that {:p} formatting uses the kernel's %p hashed format instead of printing raw pointer values, preventing kernel address space leaks.

Signed-off-by Ke Sun <[email protected]>

Overall looks good to me, but one thing:

Quoted 13 lines

rust/kernel/fmt.rs +13 -0

+impl<T: ?Sized> Pointer for HashedPtr<T> {
+    fn fmt(&self, f: &mut Formatter<'_>) -> Result {
+        use crate::str::CStrExt as _;
+
+        let mut buf = [0u8; 32];
+
+        // SAFETY: `buf` is a valid, writable buffer of 32 bytes, sufficient for all architectures
+        // (max 19 bytes for 64-bit). The format string `c"0x%p"` is null-terminated and `%p`
+        // matches the pointer argument.
+        let len = unsafe {
+            crate::bindings::scnprintf(
+                buf.as_mut_ptr().cast(),
+                buf.len(),

rust/kernel/fmt.rs fn fmt(&self, f: &mut Formatter<'_>) -> Result { · line 84

Quoted 5 lines

rust/kernel/fmt.rs +5 -0

+                // Rust's `{:p}` includes a "0x" prefix, the kernel's `%p` does not.
+                c"0x%p".as_char_ptr(),
+                self.0.cast::<core::ffi::c_void>(),
+            )
+        };

When given a null pointer, this will print 0x(null), which seems a bit weird. It may also print 0x(ptrval) or 0x(____ptrval____) during early boot.

It seems like it'd be nice to special-case these to provide better output in those cases.

Alice

Define a custom kernel::fmt::Pointer trait and HashedPtr wrapper so that {:p} formatting uses the kernel's %p hashed format instead of printing raw pointer values, preventing kernel address space leaks.

Signed-off-by Ke Sun <[email protected]>

---
 rust/kernel/fmt.rs | 166 ++++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 164 insertions(+), 2 deletions(-)

rust/kernel/fmt.rs +24 -2

index cd7d9664ff5b9..3d154dad06f64 100644
@@ -39,13 +39,106 @@ fn fmt(&self, f: &mut Formatter<'_>) -> Result {
     LowerExp,
     LowerHex,
     Octal,
-    Pointer,
     UpperExp,
     UpperHex, //
 };
+use core::ptr::NonNull;
 impl_fmt_adapter_forward!(Debug, LowerHex, UpperHex, Octal, Binary, LowerExp, UpperExp);
 
-impl<T: ?Sized + Pointer> Pointer for Adapter<&T> {
+/// A copy of [`core::fmt::Pointer`] that allows implementing pointer formatting for foreign types.
+///
+/// Together with the [`Adapter`] type and [`fmt!`] macro, it enables raw pointer formatting to be
+/// intercepted and routed to [`HashedPtr`] (kernel's `%p` hashed format), preventing kernel address
+/// leaks.
+///
+/// [`fmt!`]: crate::prelude::fmt!
+pub trait Pointer {
+    /// Same as [`core::fmt::Pointer::fmt`].
+    fn fmt(&self, f: &mut Formatter<'_>) -> Result;
+}
+
+/// A wrapper for pointers that formats them using kernel's `%p` format specifier.
+///
+/// By default, `%p` prints a hashed representation of the pointer address to prevent kernel address
+/// leaks. When the `no_hash_pointers` kernel command-line parameter is enabled, the real address is
+/// printed instead (for debugging purposes).
+pub struct HashedPtr<T: ?Sized>(pub *const T);
+
+impl<T: ?Sized> Pointer for HashedPtr<T> {
+    fn fmt(&self, f: &mut Formatter<'_>) -> Result {
+        use crate::str::CStrExt as _;
+

rust/kernel/fmt.rs +15 -0

+            if let Some(width) = f.width() {
+                if hashed_str.len() < width && hashed_str.starts_with("0x") {
+                    return write!(f, "0x{:0>width$}", &hashed_str[2..], width = width - 2);
+                }
+            }
+        }
+
+        // Use `f.pad` to handle width/alignment formatting.
+        f.pad(hashed_str)
+    }
+}
+
+// Raw pointers are formatted via `HashedPtr` (kernel `%p`: hashed by default, plain with
+// `no_hash_pointers`).
+impl<T: ?Sized> Pointer for *const T {

rust/kernel/fmt.rs +26 -0

+    }
+}
+
+impl<T: ?Sized> Pointer for &T {
+    #[inline]
+    fn fmt(&self, f: &mut Formatter<'_>) -> Result {
+        <*const T as Pointer>::fmt(&core::ptr::from_ref(*self), f)
+    }
+}
+
+impl<T: ?Sized> Pointer for &mut T {
+    #[inline]
+    fn fmt(&self, f: &mut Formatter<'_>) -> Result {
+        <*const T as Pointer>::fmt(&core::ptr::from_ref(*self), f)
+    }
+}
+
+impl<T: ?Sized> Pointer for NonNull<T> {
+    #[inline]
+    fn fmt(&self, f: &mut Formatter<'_>) -> Result {
+        <*const T as Pointer>::fmt(&self.as_ptr().cast_const(), f)
+    }
+}
+
+// `Adapter<&T>` bridges our `Pointer` trait to `core::fmt::Pointer`
+impl<T: Pointer> core::fmt::Pointer for Adapter<&T> {
     #[inline]
     fn fmt(&self, f: &mut Formatter<'_>) -> Result {
         Pointer::fmt(self.0, f)

@@ -112,3 +205,72 @@ fn fmt(&self, f: &mut Formatter<'_>) -> Result {
     {<T: ?Sized>} crate::sync::Arc<T> {where crate::sync::Arc<T>: core::fmt::Display},
     {<T: ?Sized>} crate::sync::UniqueArc<T> {where crate::sync::UniqueArc<T>: core::fmt::Display},
 );

Quoted 48 lines · Ke Sun

Define a custom kernel::fmt::Pointer trait and HashedPtr wrapper so that {:p} formatting uses the kernel's %p hashed format instead of printing raw pointer values, preventing kernel address space leaks.

Signed-off-by Ke Sun <[email protected]>

---
  rust/kernel/fmt.rs | 166 ++++++++++++++++++++++++++++++++++++++++++++++++++++-
  1 file changed, 164 insertions(+), 2 deletions(-)

rust/kernel/fmt.rs +24 -2

index cd7d9664ff5b9..3d154dad06f64 100644
@@ -39,13 +39,106 @@ fn fmt(&self, f: &mut Formatter<'_>) -> Result {
      LowerExp,
      LowerHex,
      Octal,
-    Pointer,
      UpperExp,
      UpperHex, //
  };
+use core::ptr::NonNull;
  impl_fmt_adapter_forward!(Debug, LowerHex, UpperHex, Octal, Binary, LowerExp, UpperExp);
 
-impl<T: ?Sized + Pointer> Pointer for Adapter<&T> {
+/// A copy of [`core::fmt::Pointer`] that allows implementing pointer formatting for foreign types.
+///
+/// Together with the [`Adapter`] type and [`fmt!`] macro, it enables raw pointer formatting to be
+/// intercepted and routed to [`HashedPtr`] (kernel's `%p` hashed format), preventing kernel address
+/// leaks.
+///
+/// [`fmt!`]: crate::prelude::fmt!
+pub trait Pointer {
+    /// Same as [`core::fmt::Pointer::fmt`].
+    fn fmt(&self, f: &mut Formatter<'_>) -> Result;
+}
+
+/// A wrapper for pointers that formats them using kernel's `%p` format specifier.
+///
+/// By default, `%p` prints a hashed representation of the pointer address to prevent kernel address
+/// leaks. When the `no_hash_pointers` kernel command-line parameter is enabled, the real address is
+/// printed instead (for debugging purposes).
+pub struct HashedPtr<T: ?Sized>(pub *const T);
+
+impl<T: ?Sized> Pointer for HashedPtr<T> {
+    fn fmt(&self, f: &mut Formatter<'_>) -> Result {
+        use crate::str::CStrExt as _;
+

rust/kernel/fmt.rs fn fmt(&self, f: &mut Formatter<'_>) -> Result { · line 80

Quoted 10 lines

rust/kernel/fmt.rs +10 -0

+        let mut buf = [0u8; 32];
+
+        // SAFETY: `buf` is a valid, writable buffer of 32 bytes, sufficient for all architectures
+        // (max 19 bytes for 64-bit). The format string `c"0x%p"` is null-terminated and `%p`
+        // matches the pointer argument.
+        let len = unsafe {
+            crate::bindings::scnprintf(
+                buf.as_mut_ptr().cast(),
+                buf.len(),
+                // Rust's `{:p}` includes a "0x" prefix, the kernel's `%p` does not.

%#p should do the trick?

rust/kernel/fmt.rs fn fmt(&self, f: &mut Formatter<'_>) -> Result { · line 90

Quoted 10 lines

rust/kernel/fmt.rs +10 -0

+                c"0x%p".as_char_ptr(),
+                self.0.cast::<core::ffi::c_void>(),
+            )
+        };
+
+        // SAFETY: "0x%p" produces only ASCII, which is valid UTF-8.
+        let hashed_str = unsafe { core::str::from_utf8_unchecked(&buf[..len as usize]) };
+
+        // Handle `{:0width$p}`: insert zeros after "0x" prefix.
+        if f.sign_aware_zero_pad() {

zero pad can be implemented by %0*p.

Quoted 16 lines

rust/kernel/fmt.rs +15 -0

+            if let Some(width) = f.width() {
+                if hashed_str.len() < width && hashed_str.starts_with("0x") {
+                    return write!(f, "0x{:0>width$}", &hashed_str[2..], width = width - 2);
+                }
+            }
+        }
+
+        // Use `f.pad` to handle width/alignment formatting.
+        f.pad(hashed_str)
+    }
+}
+
+// Raw pointers are formatted via `HashedPtr` (kernel `%p`: hashed by default, plain with
+// `no_hash_pointers`).
+impl<T: ?Sized> Pointer for *const T {

rust/kernel/fmt.rs fn fmt(&self, f: &mut Formatter<'_>) -> Result { · line 115

Quoted 10 lines

rust/kernel/fmt.rs +10 -0

+    #[inline]
+    fn fmt(&self, f: &mut Formatter<'_>) -> Result {
+        Pointer::fmt(&HashedPtr(*self), f)
+    }
+}
+
+impl<T: ?Sized> Pointer for *mut T {
+    #[inline]
+    fn fmt(&self, f: &mut Formatter<'_>) -> Result {
+        <*const T as Pointer>::fmt(&(*self).cast_const(), f)

This could just be

     Pointer::fmt(&HashedPtr(*self), f)

by making use of *mut T -> *const T coercion. This would avoid doing multiple indirection. Same for all other impls below.

Best,
Gary

Quoted 34 lines

rust/kernel/fmt.rs +26 -0

+    }
+}
+
+impl<T: ?Sized> Pointer for &T {
+    #[inline]
+    fn fmt(&self, f: &mut Formatter<'_>) -> Result {
+        <*const T as Pointer>::fmt(&core::ptr::from_ref(*self), f)
+    }
+}
+
+impl<T: ?Sized> Pointer for &mut T {
+    #[inline]
+    fn fmt(&self, f: &mut Formatter<'_>) -> Result {
+        <*const T as Pointer>::fmt(&core::ptr::from_ref(*self), f)
+    }
+}
+
+impl<T: ?Sized> Pointer for NonNull<T> {
+    #[inline]
+    fn fmt(&self, f: &mut Formatter<'_>) -> Result {
+        <*const T as Pointer>::fmt(&self.as_ptr().cast_const(), f)
+    }
+}
+
+// `Adapter<&T>` bridges our `Pointer` trait to `core::fmt::Pointer`
+impl<T: Pointer> core::fmt::Pointer for Adapter<&T> {
      #[inline]
      fn fmt(&self, f: &mut Formatter<'_>) -> Result {
          Pointer::fmt(self.0, f)

@@ -112,3 +205,72 @@ fn fmt(&self, f: &mut Formatter<'_>) -> Result {
      {<T: ?Sized>} crate::sync::Arc<T> {where crate::sync::Arc<T>: core::fmt::Display},
      {<T: ?Sized>} crate::sync::UniqueArc<T> {where crate::sync::UniqueArc<T>: core::fmt::Display},
  );

This series fixes two issues with {:p} pointer formatting:
- The impl_fmt_adapter_forward! macro destructures self into a local variable, causing {:p} to print a stack address instead of the actual pointer
- Kernel address leak — {:p} prints raw pointer values, exposing kernel address space layout

I got:
rust/kernel.o: error: objtool: _RNvXs4_NtCskVLJmUDtH0q_6kernel3fmtINtB5_7AdapterRPhENtNtCsfr3MPOfBGpN_4core3fmt7Pointer3fmtB7_() falls through to next function _RNvXs4_NtCskVLJmUDtH0q_6kernel3strShINtNtCsfr3MPOfBGpN_4core7convert5AsRefNtB5_4BStrE6as_ref()

when I built this on x86_64. Miguel, are we missing a function in the list of noreturn functions?

I will send a patch to be applied with this series since we only add the ones we need.