[PATCH v2] coresight: configfs: print the address parameter with %pK

[Junrui Luo via B4 Relay]

From: Junrui Luo <moonafterrain at outlook.com>

The preloaded 'gen_etrig' ETMv4 feature declares its only parameter as
{ .name = "address", .value = (u64)panic }, so on a relocatable kernel
the stored value is the post-KASLR runtime address of panic().

cscfg_param_value_show() prints that value verbatim with "0x%llx", and
CONFIGFS_ATTR() gives the attribute mode 0644 while every enclosing
directory is 0755. Once configfs is mounted, any local user reading
cs-syscfg/features/gen_etrig/params/address/value can recover the kernel
text base; neither kptr_restrict nor a capability check applies on that
path, and the plain u64 print bypasses the pointer-formatting
protections. The parameter exists even without trace hardware, since
cscfg_init() calls cscfg_preload() unconditionally and
coresight-cfg-pstop.o is linked into the core coresight module.

Print a parameter named "address" with "%pK" instead, letting
kptr_restrict decide what an unprivileged reader gets. Parameters holding
plain numbers, such as the strobing 'window' and 'period' counts, keep
the "0x%llx" format.

Fixes: 4b7e62627a38 ("coresight: config: Add preloaded configuration")
Reported-by: Yuhao Jiang <danisjiang at gmail.com>
Suggested-by: Leo Yan <leo.yan at arm.com>
Assisted-by: Claude:claude-opus-5
Cc: stable at vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain at outlook.com>
---
Changes in v2:
- Print a parameter named "address" with "%pK" in cscfg_param_value_show()
  instead of giving it a 0600 'value' attribute (Leo Yan).
- Link to v1: https://lore.kernel.org/r/20260812-coresight-fixes-v1-1-53fbf4e73241@outlook.com
---
 drivers/hwtracing/coresight/coresight-syscfg-configfs.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/hwtracing/coresight/coresight-syscfg-configfs.c b/drivers/hwtracing/coresight/coresight-syscfg-configfs.c
index 2b40e556be87..e084ed0b106b 100644
--- a/drivers/hwtracing/coresight/coresight-syscfg-configfs.c
+++ b/drivers/hwtracing/coresight/coresight-syscfg-configfs.c
@@ -281,7 +281,14 @@ static ssize_t cscfg_param_value_show(struct config_item *item, char *page)
 {
 	struct cscfg_fs_param *param_item = container_of(to_config_group(item),
 							 struct cscfg_fs_param, group);
-	u64 value = param_item->feat_desc->params_desc[param_item->param_idx].value;
+	struct cscfg_parameter_desc *param_desc =
+		&param_item->feat_desc->params_desc[param_item->param_idx];
+	u64 value = param_desc->value;
+
+	/* The kernel address should print with the "%pK" specifier */
+	if (!strcmp(param_desc->name, "address"))
+		return scnprintf(page, PAGE_SIZE, "0x%pK\n",
+				 (void *)(unsigned long)value);
 
 	return scnprintf(page, PAGE_SIZE, "0x%llx\n", value);
 }

---
base-commit: f5bbbfec59b4e2fb7520a91de3df8a6174325d6a
change-id: 20260812-coresight-fixes-9af0df331862

Best regards,
-- 
Junrui Luo <moonafterrain at outlook.com>