As Kees points out, this is a kernel address leak, and debugging is
not a sufficiently good reason to expose the real kernel address.

Fixes: 65b584f53611 ("ref_tracker: automatically register a file in debugfs for a ref_tracker_dir")
Reported-by: Kees Cook <kees@kernel.org>
Closes: https://lore.kernel.org/netdev/202507301603.62E553F93@keescook/
Signed-off-by: Jeff Layton <jlayton@kernel.org>
---
Resending since I didn't get a response from Andrew. This time I've
included netdev in the mailing list in case Jakub wants to pick this up
instead.
---
 lib/ref_tracker.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/ref_tracker.c b/lib/ref_tracker.c
index a9e6ffcff04b1da162a5a6add6bff075c2c9405e..cce12287708ea43e9eda9fe42f82a80423cea4e3 100644
--- a/lib/ref_tracker.c
+++ b/lib/ref_tracker.c
@@ -434,7 +434,7 @@ void ref_tracker_dir_debugfs(struct ref_tracker_dir *dir)
 	if (dentry && !xa_is_err(dentry))
 		return;
 
-	ret = snprintf(name, sizeof(name), "%s@%px", dir->class, dir);
+	ret = snprintf(name, sizeof(name), "%s@%p", dir->class, dir);
 	name[sizeof(name) - 1] = '\0';
 
 	if (ret < sizeof(name)) {

---
base-commit: 260f6f4fda93c8485c8037865c941b42b9cba5d2
change-id: 20250731-reftrack-dbgfs-f99ad92068bc

Best regards,
-- 
Jeff Layton <jlayton@kernel.org>

On Fri, Aug 08, 2025 at 07:45:23AM -0400, Jeff Layton wrote:
> As Kees points out, this is a kernel address leak, and debugging is
> not a sufficiently good reason to expose the real kernel address.
> 
> Fixes: 65b584f53611 ("ref_tracker: automatically register a file in debugfs for a ref_tracker_dir")
> Reported-by: Kees Cook <kees@kernel.org>
> Closes: https://lore.kernel.org/netdev/202507301603.62E553F93@keescook/
> Signed-off-by: Jeff Layton <jlayton@kernel.org>
> ---
> Resending since I didn't get a response from Andrew. This time I've
> included netdev in the mailing list in case Jakub wants to pick this up
> instead.
> ---
>  lib/ref_tracker.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/lib/ref_tracker.c b/lib/ref_tracker.c
> index a9e6ffcff04b1da162a5a6add6bff075c2c9405e..cce12287708ea43e9eda9fe42f82a80423cea4e3 100644
> --- a/lib/ref_tracker.c
> +++ b/lib/ref_tracker.c
> @@ -434,7 +434,7 @@ void ref_tracker_dir_debugfs(struct ref_tracker_dir *dir)
>  	if (dentry && !xa_is_err(dentry))
>  		return;
>  
> -	ret = snprintf(name, sizeof(name), "%s@%px", dir->class, dir);
> +	ret = snprintf(name, sizeof(name), "%s@%p", dir->class, dir);

This now results in attempts to register the same nonsense looking
debugfs file multiple times, which leads to errors in dmesg:
"debugfs: 'netdev@(____ptrval____)' already exists in 'ref_tracker'"

And we end up with a single file instead the one per network
interface (or whatever it was trying to achieve here):
 # tree /sys/kernel/debug/ref_tracker/
 /sys/kernel/debug/ref_tracker/
 └── netdev@(____ptrval____)

>  	name[sizeof(name) - 1] = '\0';
>  
>  	if (ret < sizeof(name)) {
> 
> ---
> base-commit: 260f6f4fda93c8485c8037865c941b42b9cba5d2
> change-id: 20250731-reftrack-dbgfs-f99ad92068bc
> 
> Best regards,
> -- 
> Jeff Layton <jlayton@kernel.org>
> 

-- 
Ville Syrjälä
Intel

On Fri, Aug 8, 2025 at 4:45 AM Jeff Layton <jlayton@kernel.org> wrote:
>
> As Kees points out, this is a kernel address leak, and debugging is
> not a sufficiently good reason to expose the real kernel address.
>
> Fixes: 65b584f53611 ("ref_tracker: automatically register a file in debugfs for a ref_tracker_dir")
> Reported-by: Kees Cook <kees@kernel.org>
> Closes: https://lore.kernel.org/netdev/202507301603.62E553F93@keescook/
> Signed-off-by: Jeff Layton <jlayton@kernel.org>
> ---

Reviewed-by: Eric Dumazet <edumazet@google.com>