Re: [PATCH v2 7/7] objtool/klp: Allow new references to module exports

On Wed, Aug 5, 2026 at 7:30 AM Josh Poimboeuf <[email protected]> wrote:
>
> From: Joe Lawrence <[email protected]>
>
> klp_reloc_needed() returns true for module exports to support
> late-module patching.  However, clone_reloc_klp() unconditionally
> rejects symbols without a twin (i.e., new references added by the
> patch), even when the symbol is a known export from Module.symvers.
>
> Relax the check: allow new references to exported symbols by only
> erroring on !twin when there is no export.  The export metadata from
> Module.symvers provides sufficient context to emit the klp-relocation
> without a twin.
>
> For a module export that isn't sufficient on its own though, as the
> resulting klp relocation will only be resolved at patch-enable time if
> the exporting module is loaded.
>
> If the original (unpatched) module already depends on the exporting
> module, the dependency is safe: the module loader ensures the dependency
> is satisfied before the patched module can be loaded, so the
> klp relocation target will exist.
>
> However, if the patch introduces a reference to a module that the
> original doesn't depend on, there is no such guarantee.  The exporting
> module could be absent or could be unloaded at any time, leading to a
> relocation failure or use-after-free.
>
> So also add a build-time check: when a new symbol reference (no twin)
> targets a module export, verify that the original module already has at
> least one UNDEF symbol resolving to that same exporting module.  If not,
> error out with a diagnostic message.
>
> Signed-off-by: Joe Lawrence <[email protected]>
> Signed-off-by: Josh Poimboeuf <[email protected]>

Acked-by: Song Liu <[email protected]>