1 files changed, 268 insertions, 160 deletions

diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 791b6fa36905..2f003cfe340e 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -593,15 +593,13 @@ char *widen_string(char *buf, int n, char *end, struct printf_spec spec)
         return buf;
 }
 
-static noinline_for_stack
-char *string(char *buf, char *end, const char *s, struct printf_spec spec)
+/* Handle string from a well known address. */
+static char *string_nocheck(char *buf, char *end, const char *s,
+                            struct printf_spec spec)
 {
         int len = 0;
         size_t lim = spec.precision;
 
-        if ((unsigned long)s < PAGE_SIZE)
-                s = "(null)";
-
         while (lim--) {
                 char c = *s++;
                 if (!c)
@@ -614,9 +612,64 @@ char *string(char *buf, char *end, const char *s, struct printf_spec spec)
         return widen_string(buf, len, end, spec);
 }
 
+/* Be careful: error messages must fit into the given buffer. */
+static char *error_string(char *buf, char *end, const char *s,
+                          struct printf_spec spec)
+{
+        /*
+         * Hard limit to avoid a completely insane messages. It actually
+         * works pretty well because most error messages are in
+         * the many pointer format modifiers.
+         */
+        if (spec.precision == -1)
+                spec.precision = 2 * sizeof(void *);
+
+        return string_nocheck(buf, end, s, spec);
+}
+
+/*
+ * Do not call any complex external code here. Nested printk()/vsprintf()
+ * might cause infinite loops. Failures might break printk() and would
+ * be hard to debug.
+ */
+static const char *check_pointer_msg(const void *ptr)
+{
+        if (!ptr)
+                return "(null)";
+
+        if ((unsigned long)ptr < PAGE_SIZE || IS_ERR_VALUE(ptr))
+                return "(efault)";
+
+        return NULL;
+}
+
+static int check_pointer(char **buf, char *end, const void *ptr,
+                         struct printf_spec spec)
+{
+        const char *err_msg;
+
+        err_msg = check_pointer_msg(ptr);
+        if (err_msg) {
+                *buf = error_string(*buf, end, err_msg, spec);
+                return -EFAULT;
+        }
+
+        return 0;
+}
+
 static noinline_for_stack
-char *pointer_string(char *buf, char *end, const void *ptr,
-                     struct printf_spec spec)
+char *string(char *buf, char *end, const char *s,
+             struct printf_spec spec)
+{
+        if (check_pointer(&buf, end, s, spec))
+                return buf;
+
+        return string_nocheck(buf, end, s, spec);
+}
+
+static char *pointer_string(char *buf, char *end,
+                            const void *ptr,
+                            struct printf_spec spec)
 {
         spec.base = 16;
         spec.flags |= SMALL;
@@ -701,7 +754,7 @@ static char *ptr_to_id(char *buf, char *end, const void *ptr,
         if (static_branch_unlikely(&not_filled_random_ptr_key)) {
                 spec.field_width = 2 * sizeof(ptr);
                 /* string length must be less than default_width */
-                return string(buf, end, str, spec);
+                return error_string(buf, end, str, spec);
         }
 
 #ifdef CONFIG_64BIT
@@ -717,6 +770,55 @@ static char *ptr_to_id(char *buf, char *end, const void *ptr,
         return pointer_string(buf, end, (const void *)hashval, spec);
 }
 
+int kptr_restrict __read_mostly;
+
+static noinline_for_stack
+char *restricted_pointer(char *buf, char *end, const void *ptr,
+                         struct printf_spec spec)
+{
+        switch (kptr_restrict) {
+        case 0:
+                /* Handle as %p, hash and do _not_ leak addresses. */
+                return ptr_to_id(buf, end, ptr, spec);
+        case 1: {
+                const struct cred *cred;
+
+                /*
+                 * kptr_restrict==1 cannot be used in IRQ context
+                 * because its test for CAP_SYSLOG would be meaningless.
+                 */
+                if (in_irq() || in_serving_softirq() || in_nmi()) {
+                        if (spec.field_width == -1)
+                                spec.field_width = 2 * sizeof(ptr);
+                        return error_string(buf, end, "pK-error", spec);
+                }
+
+                /*
+                 * Only print the real pointer value if the current
+                 * process has CAP_SYSLOG and is running with the
+                 * same credentials it started with. This is because
+                 * access to files is checked at open() time, but %pK
+                 * checks permission at read() time. We don't want to
+                 * leak pointer values if a binary opens a file using
+                 * %pK and then elevates privileges before reading it.
+                 */
+                cred = current_cred();
+                if (!has_capability_noaudit(current, CAP_SYSLOG) ||
+                    !uid_eq(cred->euid, cred->uid) ||
+                    !gid_eq(cred->egid, cred->gid))
+                        ptr = NULL;
+                break;
+        }
+        case 2:
+        default:
+                /* Always print 0's for %pK */
+                ptr = NULL;
+                break;
+        }
+
+        return pointer_string(buf, end, ptr, spec);
+}
+
 static noinline_for_stack
 char *dentry_name(char *buf, char *end, const struct dentry *d, struct printf_spec spec,
                   const char *fmt)
@@ -736,6 +838,11 @@ char *dentry_name(char *buf, char *end, const struct dentry *d, struct printf_sp
 
         rcu_read_lock();
         for (i = 0; i < depth; i++, d = p) {
+                if (check_pointer(&buf, end, d, spec)) {
+                        rcu_read_unlock();
+                        return buf;
+                }
+
                 p = READ_ONCE(d->d_parent);
                 array[i] = READ_ONCE(d->d_name.name);
                 if (p == d) {
@@ -766,8 +873,12 @@ static noinline_for_stack
 char *bdev_name(char *buf, char *end, struct block_device *bdev,
                 struct printf_spec spec, const char *fmt)
 {
-        struct gendisk *hd = bdev->bd_disk;
-        
+        struct gendisk *hd;
+
+        if (check_pointer(&buf, end, bdev, spec))
+                return buf;
+
+        hd = bdev->bd_disk;
         buf = string(buf, end, hd->disk_name, spec);
         if (bdev->bd_part->partno) {
                 if (isdigit(hd->disk_name[strlen(hd->disk_name)-1])) {
@@ -802,7 +913,7 @@ char *symbol_string(char *buf, char *end, void *ptr,
         else
                 sprint_symbol_no_offset(sym, value);
 
-        return string(buf, end, sym, spec);
+        return string_nocheck(buf, end, sym, spec);
 #else
         return special_hex_number(buf, end, value, sizeof(void *));
 #endif
@@ -886,29 +997,32 @@ char *resource_string(char *buf, char *end, struct resource *res,
         int decode = (fmt[0] == 'R') ? 1 : 0;
         const struct printf_spec *specp;
 
+        if (check_pointer(&buf, end, res, spec))
+                return buf;
+
         *p++ = '[';
         if (res->flags & IORESOURCE_IO) {
-                p = string(p, pend, "io  ", str_spec);
+                p = string_nocheck(p, pend, "io  ", str_spec);
                 specp = &io_spec;
         } else if (res->flags & IORESOURCE_MEM) {
-                p = string(p, pend, "mem ", str_spec);
+                p = string_nocheck(p, pend, "mem ", str_spec);
                 specp = &mem_spec;
         } else if (res->flags & IORESOURCE_IRQ) {
-                p = string(p, pend, "irq ", str_spec);
+                p = string_nocheck(p, pend, "irq ", str_spec);
                 specp = &default_dec_spec;
         } else if (res->flags & IORESOURCE_DMA) {
-                p = string(p, pend, "dma ", str_spec);
+                p = string_nocheck(p, pend, "dma ", str_spec);
                 specp = &default_dec_spec;
         } else if (res->flags & IORESOURCE_BUS) {
-                p = string(p, pend, "bus ", str_spec);
+                p = string_nocheck(p, pend, "bus ", str_spec);
                 specp = &bus_spec;
         } else {
-                p = string(p, pend, "??? ", str_spec);
+                p = string_nocheck(p, pend, "??? ", str_spec);
                 specp = &mem_spec;
                 decode = 0;
         }
         if (decode && res->flags & IORESOURCE_UNSET) {
-                p = string(p, pend, "size ", str_spec);
+                p = string_nocheck(p, pend, "size ", str_spec);
                 p = number(p, pend, resource_size(res), *specp);
         } else {
                 p = number(p, pend, res->start, *specp);
@@ -919,21 +1033,21 @@ char *resource_string(char *buf, char *end, struct resource *res,
         }
         if (decode) {
                 if (res->flags & IORESOURCE_MEM_64)
-                        p = string(p, pend, " 64bit", str_spec);
+                        p = string_nocheck(p, pend, " 64bit", str_spec);
                 if (res->flags & IORESOURCE_PREFETCH)
-                        p = string(p, pend, " pref", str_spec);
+                        p = string_nocheck(p, pend, " pref", str_spec);
                 if (res->flags & IORESOURCE_WINDOW)
-                        p = string(p, pend, " window", str_spec);
+                        p = string_nocheck(p, pend, " window", str_spec);
                 if (res->flags & IORESOURCE_DISABLED)
-                        p = string(p, pend, " disabled", str_spec);
+                        p = string_nocheck(p, pend, " disabled", str_spec);
         } else {
-                p = string(p, pend, " flags ", str_spec);
+                p = string_nocheck(p, pend, " flags ", str_spec);
                 p = number(p, pend, res->flags, default_flag_spec);
         }
         *p++ = ']';
         *p = '\0';
 
-        return string(buf, end, sym, spec);
+        return string_nocheck(buf, end, sym, spec);
 }
 
 static noinline_for_stack
@@ -948,9 +1062,8 @@ char *hex_string(char *buf, char *end, u8 *addr, struct printf_spec spec,
                 /* nothing to print */
                 return buf;
 
-        if (ZERO_OR_NULL_PTR(addr))
-                /* NULL pointer */
-                return string(buf, end, NULL, spec);
+        if (check_pointer(&buf, end, addr, spec))
+                return buf;
 
         switch (fmt[1]) {
         case 'C':
@@ -997,6 +1110,9 @@ char *bitmap_string(char *buf, char *end, unsigned long *bitmap,
         int i, chunksz;
         bool first = true;
 
+        if (check_pointer(&buf, end, bitmap, spec))
+                return buf;
+
         /* reused to print numbers */
         spec = (struct printf_spec){ .flags = SMALL | ZEROPAD, .base = 16 };
 
@@ -1038,6 +1154,9 @@ char *bitmap_list_string(char *buf, char *end, unsigned long *bitmap,
         int cur, rbot, rtop;
         bool first = true;
 
+        if (check_pointer(&buf, end, bitmap, spec))
+                return buf;
+
         rbot = cur = find_first_bit(bitmap, nr_bits);
         while (cur < nr_bits) {
                 rtop = cur;
@@ -1076,6 +1195,9 @@ char *mac_address_string(char *buf, char *end, u8 *addr,
         char separator;
         bool reversed = false;
 
+        if (check_pointer(&buf, end, addr, spec))
+                return buf;
+
         switch (fmt[1]) {
         case 'F':
                 separator = '-';
@@ -1101,7 +1223,7 @@ char *mac_address_string(char *buf, char *end, u8 *addr,
         }
         *p = '\0';
 
-        return string(buf, end, mac_addr, spec);
+        return string_nocheck(buf, end, mac_addr, spec);
 }
 
 static noinline_for_stack
@@ -1264,7 +1386,7 @@ char *ip6_addr_string(char *buf, char *end, const u8 *addr,
         else
                 ip6_string(ip6_addr, addr, fmt);
 
-        return string(buf, end, ip6_addr, spec);
+        return string_nocheck(buf, end, ip6_addr, spec);
 }
 
 static noinline_for_stack
@@ -1275,7 +1397,7 @@ char *ip4_addr_string(char *buf, char *end, const u8 *addr,
 
         ip4_string(ip4_addr, addr, fmt);
 
-        return string(buf, end, ip4_addr, spec);
+        return string_nocheck(buf, end, ip4_addr, spec);
 }
 
 static noinline_for_stack
@@ -1337,7 +1459,7 @@ char *ip6_addr_string_sa(char *buf, char *end, const struct sockaddr_in6 *sa,
         }
         *p = '\0';
 
-        return string(buf, end, ip6_addr, spec);
+        return string_nocheck(buf, end, ip6_addr, spec);
 }
 
 static noinline_for_stack
@@ -1372,7 +1494,42 @@ char *ip4_addr_string_sa(char *buf, char *end, const struct sockaddr_in *sa,
         }
         *p = '\0';
 
-        return string(buf, end, ip4_addr, spec);
+        return string_nocheck(buf, end, ip4_addr, spec);
+}
+
+static noinline_for_stack
+char *ip_addr_string(char *buf, char *end, const void *ptr,
+                     struct printf_spec spec, const char *fmt)
+{
+        char *err_fmt_msg;
+
+        if (check_pointer(&buf, end, ptr, spec))
+                return buf;
+
+        switch (fmt[1]) {
+        case '6':
+                return ip6_addr_string(buf, end, ptr, spec, fmt);
+        case '4':
+                return ip4_addr_string(buf, end, ptr, spec, fmt);
+        case 'S': {
+                const union {
+                        struct sockaddr         raw;
+                        struct sockaddr_in      v4;
+                        struct sockaddr_in6     v6;
+                } *sa = ptr;
+
+                switch (sa->raw.sa_family) {
+                case AF_INET:
+                        return ip4_addr_string_sa(buf, end, &sa->v4, spec, fmt);
+                case AF_INET6:
+                        return ip6_addr_string_sa(buf, end, &sa->v6, spec, fmt);
+                default:
+                        return error_string(buf, end, "(einval)", spec);
+                }}
+        }
+
+        err_fmt_msg = fmt[0] == 'i' ? "(%pi?)" : "(%pI?)";
+        return error_string(buf, end, err_fmt_msg, spec);
 }
 
 static noinline_for_stack
@@ -1387,9 +1544,8 @@ char *escaped_string(char *buf, char *end, u8 *addr, struct printf_spec spec,
         if (spec.field_width == 0)
                 return buf;                             /* nothing to print */
 
-        if (ZERO_OR_NULL_PTR(addr))
-                return string(buf, end, NULL, spec);    /* NULL pointer */
-
+        if (check_pointer(&buf, end, addr, spec))
+                return buf;
 
         do {
                 switch (fmt[count++]) {
@@ -1435,6 +1591,21 @@ char *escaped_string(char *buf, char *end, u8 *addr, struct printf_spec spec,
         return buf;
 }
 
+static char *va_format(char *buf, char *end, struct va_format *va_fmt,
+                       struct printf_spec spec, const char *fmt)
+{
+        va_list va;
+
+        if (check_pointer(&buf, end, va_fmt, spec))
+                return buf;
+
+        va_copy(va, *va_fmt->va);
+        buf += vsnprintf(buf, end > buf ? end - buf : 0, va_fmt->fmt, va);
+        va_end(va);
+
+        return buf;
+}
+
 static noinline_for_stack
 char *uuid_string(char *buf, char *end, const u8 *addr,
                   struct printf_spec spec, const char *fmt)
@@ -1445,6 +1616,9 @@ char *uuid_string(char *buf, char *end, const u8 *addr,
         const u8 *index = uuid_index;
         bool uc = false;
 
+        if (check_pointer(&buf, end, addr, spec))
+                return buf;
+
         switch (*(++fmt)) {
         case 'L':
                 uc = true;              /* fall-through */
@@ -1473,56 +1647,7 @@ char *uuid_string(char *buf, char *end, const u8 *addr,
 
         *p = 0;
 
-        return string(buf, end, uuid, spec);
-}
-
-int kptr_restrict __read_mostly;
-
-static noinline_for_stack
-char *restricted_pointer(char *buf, char *end, const void *ptr,
-                         struct printf_spec spec)
-{
-        switch (kptr_restrict) {
-        case 0:
-                /* Always print %pK values */
-                break;
-        case 1: {
-                const struct cred *cred;
-
-                /*
-                 * kptr_restrict==1 cannot be used in IRQ context
-                 * because its test for CAP_SYSLOG would be meaningless.
-                 */
-                if (in_irq() || in_serving_softirq() || in_nmi()) {
-                        if (spec.field_width == -1)
-                                spec.field_width = 2 * sizeof(ptr);
-                        return string(buf, end, "pK-error", spec);
-                }
-
-                /*
-                 * Only print the real pointer value if the current
-                 * process has CAP_SYSLOG and is running with the
-                 * same credentials it started with. This is because
-                 * access to files is checked at open() time, but %pK
-                 * checks permission at read() time. We don't want to
-                 * leak pointer values if a binary opens a file using
-                 * %pK and then elevates privileges before reading it.
-                 */
-                cred = current_cred();
-                if (!has_capability_noaudit(current, CAP_SYSLOG) ||
-                    !uid_eq(cred->euid, cred->uid) ||
-                    !gid_eq(cred->egid, cred->gid))
-                        ptr = NULL;
-                break;
-        }
-        case 2:
-        default:
-                /* Always print 0's for %pK */
-                ptr = NULL;
-                break;
-        }
-
-        return pointer_string(buf, end, ptr, spec);
+        return string_nocheck(buf, end, uuid, spec);
 }
 
 static noinline_for_stack
@@ -1532,24 +1657,31 @@ char *netdev_bits(char *buf, char *end, const void *addr,
         unsigned long long num;
         int size;
 
+        if (check_pointer(&buf, end, addr, spec))
+                return buf;
+
         switch (fmt[1]) {
         case 'F':
                 num = *(const netdev_features_t *)addr;
                 size = sizeof(netdev_features_t);
                 break;
         default:
-                return ptr_to_id(buf, end, addr, spec);
+                return error_string(buf, end, "(%pN?)", spec);
         }
 
         return special_hex_number(buf, end, num, size);
 }
 
 static noinline_for_stack
-char *address_val(char *buf, char *end, const void *addr, const char *fmt)
+char *address_val(char *buf, char *end, const void *addr,
+                  struct printf_spec spec, const char *fmt)
 {
         unsigned long long num;
         int size;
 
+        if (check_pointer(&buf, end, addr, spec))
+                return buf;
+
         switch (fmt[1]) {
         case 'd':
                 num = *(const dma_addr_t *)addr;
@@ -1601,12 +1733,16 @@ char *time_str(char *buf, char *end, const struct rtc_time *tm, bool r)
 }
 
 static noinline_for_stack
-char *rtc_str(char *buf, char *end, const struct rtc_time *tm, const char *fmt)
+char *rtc_str(char *buf, char *end, const struct rtc_time *tm,
+              struct printf_spec spec, const char *fmt)
 {
         bool have_t = true, have_d = true;
         bool raw = false;
         int count = 2;
 
+        if (check_pointer(&buf, end, tm, spec))
+                return buf;
+
         switch (fmt[count]) {
         case 'd':
                 have_t = false;
@@ -1640,9 +1776,9 @@ char *time_and_date(char *buf, char *end, void *ptr, struct printf_spec spec,
 {
         switch (fmt[1]) {
         case 'R':
-                return rtc_str(buf, end, (const struct rtc_time *)ptr, fmt);
+                return rtc_str(buf, end, (const struct rtc_time *)ptr, spec, fmt);
         default:
-                return ptr_to_id(buf, end, ptr, spec);
+                return error_string(buf, end, "(%ptR?)", spec);
         }
 }
 
@@ -1650,8 +1786,11 @@ static noinline_for_stack
 char *clock(char *buf, char *end, struct clk *clk, struct printf_spec spec,
             const char *fmt)
 {
-        if (!IS_ENABLED(CONFIG_HAVE_CLK) || !clk)
-                return string(buf, end, NULL, spec);
+        if (!IS_ENABLED(CONFIG_HAVE_CLK))
+                return error_string(buf, end, "(%pC?)", spec);
+
+        if (check_pointer(&buf, end, clk, spec))
+                return buf;
 
         switch (fmt[1]) {
         case 'n':
@@ -1659,7 +1798,7 @@ char *clock(char *buf, char *end, struct clk *clk, struct printf_spec spec,
 #ifdef CONFIG_COMMON_CLK
                 return string(buf, end, __clk_get_name(clk), spec);
 #else
-                return ptr_to_id(buf, end, clk, spec);
+                return error_string(buf, end, "(%pC?)", spec);
 #endif
         }
 }
@@ -1692,11 +1831,15 @@ char *format_flags(char *buf, char *end, unsigned long flags,
 }
 
 static noinline_for_stack
-char *flags_string(char *buf, char *end, void *flags_ptr, const char *fmt)
+char *flags_string(char *buf, char *end, void *flags_ptr,
+                   struct printf_spec spec, const char *fmt)
 {
         unsigned long flags;
         const struct trace_print_flags *names;
 
+        if (check_pointer(&buf, end, flags_ptr, spec))
+                return buf;
+
         switch (fmt[1]) {
         case 'p':
                 flags = *(unsigned long *)flags_ptr;
@@ -1713,8 +1856,7 @@ char *flags_string(char *buf, char *end, void *flags_ptr, const char *fmt)
                 names = gfpflag_names;
                 break;
         default:
-                WARN_ONCE(1, "Unsupported flags modifier: %c\n", fmt[1]);
-                return buf;
+                return error_string(buf, end, "(%pG?)", spec);
         }
 
         return format_flags(buf, end, flags, names);
@@ -1736,13 +1878,13 @@ char *device_node_gen_full_name(const struct device_node *np, char *buf, char *e
 
         /* special case for root node */
         if (!parent)
-                return string(buf, end, "/", default_str_spec);
+                return string_nocheck(buf, end, "/", default_str_spec);
 
         for (depth = 0; parent->parent; depth++)
                 parent = parent->parent;
 
         for ( ; depth >= 0; depth--) {
-                buf = string(buf, end, "/", default_str_spec);
+                buf = string_nocheck(buf, end, "/", default_str_spec);
                 buf = string(buf, end, device_node_name_for_depth(np, depth),
                              default_str_spec);
         }
@@ -1770,10 +1912,10 @@ char *device_node_string(char *buf, char *end, struct device_node *dn,
         str_spec.field_width = -1;
 
         if (!IS_ENABLED(CONFIG_OF))
-                return string(buf, end, "(!OF)", spec);
+                return error_string(buf, end, "(%pOF?)", spec);
 
-        if ((unsigned long)dn < PAGE_SIZE)
-                return string(buf, end, "(null)", spec);
+        if (check_pointer(&buf, end, dn, spec))
+                return buf;
 
         /* simple case without anything any more format specifiers */
         fmt++;
@@ -1814,7 +1956,7 @@ char *device_node_string(char *buf, char *end, struct device_node *dn,
                         tbuf[2] = of_node_check_flag(dn, OF_POPULATED) ? 'P' : '-';
                         tbuf[3] = of_node_check_flag(dn, OF_POPULATED_BUS) ? 'B' : '-';
                         tbuf[4] = 0;
-                        buf = string(buf, end, tbuf, str_spec);
+                        buf = string_nocheck(buf, end, tbuf, str_spec);
                         break;
                 case 'c':       /* major compatible string */
                         ret = of_property_read_string(dn, "compatible", &p);
@@ -1825,10 +1967,10 @@ char *device_node_string(char *buf, char *end, struct device_node *dn,
                         has_mult = false;
                         of_property_for_each_string(dn, "compatible", prop, p) {
                                 if (has_mult)
-                                        buf = string(buf, end, ",", str_spec);
-                                buf = string(buf, end, "\"", str_spec);
+                                        buf = string_nocheck(buf, end, ",", str_spec);
+                                buf = string_nocheck(buf, end, "\"", str_spec);
                                 buf = string(buf, end, p, str_spec);
-                                buf = string(buf, end, "\"", str_spec);
+                                buf = string_nocheck(buf, end, "\"", str_spec);
 
                                 has_mult = true;
                         }
@@ -1841,6 +1983,17 @@ char *device_node_string(char *buf, char *end, struct device_node *dn,
         return widen_string(buf, buf - buf_start, end, spec);
 }
 
+static char *kobject_string(char *buf, char *end, void *ptr,
+                            struct printf_spec spec, const char *fmt)
+{
+        switch (fmt[1]) {
+        case 'F':
+                return device_node_string(buf, end, ptr, spec, fmt + 1);
+        }
+
+        return error_string(buf, end, "(%pO?)", spec);
+}
+
 /*
  * Show a '%p' thing.  A kernel extension is that the '%p' is followed
  * by an extra set of alphanumeric characters that are extended format
@@ -1957,18 +2110,6 @@ static noinline_for_stack
 char *pointer(const char *fmt, char *buf, char *end, void *ptr,
               struct printf_spec spec)
 {
-        const int default_width = 2 * sizeof(void *);
-
-        if (!ptr && *fmt != 'K' && *fmt != 'x') {
-                /*
-                 * Print (null) with the same width as a pointer so it makes
-                 * tabular output look nice.
-                 */
-                if (spec.field_width == -1)
-                        spec.field_width = default_width;
-                return string(buf, end, "(null)", spec);
-        }
-
         switch (*fmt) {
         case 'F':
         case 'f':
@@ -2004,50 +2145,19 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
                                          * 4:   001.002.003.004
                                          * 6:   000102...0f
                                          */
-                switch (fmt[1]) {
-                case '6':
-                        return ip6_addr_string(buf, end, ptr, spec, fmt);
-                case '4':
-                        return ip4_addr_string(buf, end, ptr, spec, fmt);
-                case 'S': {
-                        const union {
-                                struct sockaddr         raw;
-                                struct sockaddr_in      v4;
-                                struct sockaddr_in6     v6;
-                        } *sa = ptr;
-
-                        switch (sa->raw.sa_family) {
-                        case AF_INET:
-                                return ip4_addr_string_sa(buf, end, &sa->v4, spec, fmt);
-                        case AF_INET6:
-                                return ip6_addr_string_sa(buf, end, &sa->v6, spec, fmt);
-                        default:
-                                return string(buf, end, "(invalid address)", spec);
-                        }}
-                }
-                break;
+                return ip_addr_string(buf, end, ptr, spec, fmt);
         case 'E':
                 return escaped_string(buf, end, ptr, spec, fmt);
         case 'U':
                 return uuid_string(buf, end, ptr, spec, fmt);
         case 'V':
-                {
-                        va_list va;
-
-                        va_copy(va, *((struct va_format *)ptr)->va);
-                        buf += vsnprintf(buf, end > buf ? end - buf : 0,
-                                         ((struct va_format *)ptr)->fmt, va);
-                        va_end(va);
-                        return buf;
-                }
+                return va_format(buf, end, ptr, spec, fmt);
         case 'K':
-                if (!kptr_restrict)
-                        break;
                 return restricted_pointer(buf, end, ptr, spec);
         case 'N':
                 return netdev_bits(buf, end, ptr, spec, fmt);
         case 'a':
-                return address_val(buf, end, ptr, fmt);
+                return address_val(buf, end, ptr, spec, fmt);
         case 'd':
                 return dentry_name(buf, end, ptr, spec, fmt);
         case 't':
@@ -2064,13 +2174,9 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
 #endif
 
         case 'G':
-                return flags_string(buf, end, ptr, fmt);
+                return flags_string(buf, end, ptr, spec, fmt);
         case 'O':
-                switch (fmt[1]) {
-                case 'F':
-                        return device_node_string(buf, end, ptr, spec, fmt + 1);
-                }
-                break;
+                return kobject_string(buf, end, ptr, spec, fmt);
         case 'x':
                 return pointer_string(buf, end, ptr, spec);
         }
@@ -2685,11 +2791,13 @@ int vbin_printf(u32 *bin_buf, size_t size, const char *fmt, va_list args)
 
                 case FORMAT_TYPE_STR: {
                         const char *save_str = va_arg(args, char *);
+                        const char *err_msg;
                         size_t len;
 
-                        if ((unsigned long)save_str > (unsigned long)-PAGE_SIZE
-                                        || (unsigned long)save_str < PAGE_SIZE)
-                                save_str = "(null)";
+                        err_msg = check_pointer_msg(save_str);
+                        if (err_msg)
+                                save_str = err_msg;
+
                         len = strlen(save_str) + 1;
                         if (str + len < end)
                                 memcpy(str, save_str, len);