在内核Documentation/sysctl/kernel.txt中对其使用有介绍，如下所示：
kptr_restrict:
This toggle indicates whether restrictions are placed on
exposing kernel addresses via /proc and other interfaces.
When kptr_restrict is set to 0 (the default) the address is hashed before
printing. (This is the equivalent to %p.)
When kptr_restrict is set to (1), kernel pointers printed using the %pK
format specifier will be replaced with 0's unless the user has CAP_SYSLOG
and effective user and group ids are equal to the real ids. This is
because %pK checks are done at read() time rather than open() time, so
if permissions are elevated between the open() and the read() (e.g via
a setuid binary) then %pK will not leak kernel pointers to unprivileged
users. Note, this is a temporary solution only. The correct long-term
solution is to do the permission checks at open() time. Consider removing
world read permissions from files that use %pK, and using dmesg_restrict
to protect against uses of %pK in dmesg(8) if leaking kernel pointer
values to unprivileged users is a concern.
When kptr_restrict is set to (2), kernel pointers printed using
%pK will be replaced with 0's regardless of privileges.
简单来讲，变量kptr_restrict是可以用来限制内核地址的打印，当kptr_restrict=0时，会直接打印内核地址（%p和%pK效果一样）；当kptr_restrict=1时，若在中断上下文或软中断时，%pK打印“pK-error”，否则内核地址打印全0；当kptr_restrict=2时，%pK打印内核地址为全0；而内核地址以%p打印时无论在什么情况下都会以HASH地址方式打印，而%pK可以通过 变量kptr_restrict隐藏内核地址，防止内核地址泄漏。
可以通过代码简单看出：
char *restricted_pointer(char *buf, char *end, const void *ptr,
struct printf_spec spec)
{
switch (kptr_restrict) {
case 0:
/* Handle as %p, hash and do _not_ leak addresses. */
return ptr_to_id(buf, end, ptr, spec); //直接打印内核地址HASH值
case 1: {
const struct cred *cred;
/*
* kptr_restrict==1 cannot be used in IRQ context
* because its test for CAP_SYSLOG would be meaningless.
*/
if (in_irq() || in_serving_softirq() || in_nmi()) {
if (spec.field_width == -1)
spec.field_width = 2 * sizeof(ptr);
return error_string(buf, end, "pK-error", spec); //在中断上下文或软中断等处，打印“pK-error”
}
/*
* Only print the real pointer value if the current
* process has CAP_SYSLOG and is running with the
* same credentials it started with. This is because
* access to files is checked at open() time, but %pK
* checks permission at read() time. We don't want to
* leak pointer values if a binary opens a file using
* %pK and then elevates privileges before reading it.
*/
cred = current_cred();
if (!has_capability_noaudit(current, CAP_SYSLOG) ||
!uid_eq(cred->euid, cred->uid) ||
!gid_eq(cred->egid, cred->gid))
ptr = NULL; //直接打印全0
break;
}
case 2:
default:
/* Always print 0's for %pK */
ptr = NULL;
break;
}
以下为以%pK打印内核地址：
在未修改时或kptr_restrict=0时，内核地址打印如下所示：
Euler:/home # ./test.sh
disable begin 0
[ 128.153235] hisi_sas_v3_hw 0000:74:02.0: erroneous completion iptt=4030 task=0000000021ed4560 dev id=1 CQ hdr: 0x1103 0x10fbe 0x0
0x20000 Error info: 0x0 0x4000000 0x0 0x0
[ 128.168481] sas: smp_execute_task_sg: task to dev 500e004aaaaaaa1f response: 0x0 status 0x2
[ 128.177189] sas: broadcast received: 0
[ 128.180938] sas: REVALIDATING DOMAIN on port 0, pid:3519
修改kptr_restrict=1时，内核地址打印如下所示：
Euler:/home # ./test.sh
disable begin 0
[ 226.287150] hisi_sas_v3_hw 0000:74:02.0: erroneous completion iptt=4064 task= pK-error dev id=1 CQ hdr: 0x1103 0x10fe0 0x0
0x20000 Error info: 0x0 0x4000000 0x0 0x0
[ 226.302395] sas: smp_execute_task_sg: task to dev 500e004aaaaaaa1f response: 0x0 status 0x2
[ 226.311106] sas: broadcast received: 0
[ 226.314852] sas: REVALIDATING DOMAIN on port 0, pid:3519
修改kptr_restrict=2时，内核地址打印如下所示：
Euler:/home # ./test.sh
disable begin 0
[ 506.507222] hisi_sas_v3_hw 0000:74:02.0: erroneous completion iptt=4041 task=0000000000000000 dev id=1 CQ hdr: 0x1103 0x10fc9 0x0
0x20000 Error info: 0x0 0x4000000 0x0 0x0
[ 506.522471] sas: smp_execute_task_sg: task to dev 500e004aaaaaaa1f response: 0x0 status 0x2
[ 506.531174] sas: broadcast received: 0
[ 506.534918] sas: REVALIDATING DOMAIN on port 0, pid:3519