[PATCH 3/4] objtool/klp: reject new cross-module references without existing dependency

When a livepatch introduces a new reference to a module-exported symbol,
the resulting klp-relocation will only be resolved at patch-enable time
if the exporting module is loaded.

A future commit will remove livepatch module dependency references to
facilitate late-module patching, that is, the pre-loading of the
livepatch before target modules are loaded.

If the original (unpatched) module already depends on the exporting
module, the dependency is safe: the module loader ensures the dependency
is satisfied before the patched module can be loaded, so the
klp-relocation target will exist.

However, if the patch introduces a reference to a module that the
original doesn't depend on, there is no such guarantee.  The exporting
module could be absent or could be unloaded at any time, leading to a
relocation failure or use-after-free.

Add a build-time check: when a new symbol reference (no twin) targets a
module export, verify that the original module already has at least one
UNDEF symbol resolving to that same exporting module.  If not, error out
with a diagnostic message.

Signed-off-by: Joe Lawrence <[email protected]>
---
 tools/objtool/klp-diff.c | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/tools/objtool/klp-diff.c b/tools/objtool/klp-diff.c
index e14d1f32126d..801f99bbdb0d 100644
--- a/tools/objtool/klp-diff.c
+++ b/tools/objtool/klp-diff.c
@@ -1509,6 +1509,28 @@ static int convert_reloc_sym(struct elf *elf, struct reloc *reloc)
 	return convert_reloc_secsym_to_sym(elf, reloc);
 }
 
+/*
+ * Check if the original module already has a dependency on dep_mod, i.e. it
+ * already references at least one export from that module.
+ */
+static bool has_module_dep(struct elfs *e, const char *dep_mod)
+{
+	struct symbol *sym;
+
+	for_each_sym(e->orig, sym) {
+		struct export *exp;
+
+		if (!is_undef_sym(sym))
+			continue;
+
+		exp = find_export(sym);
+		if (exp && !strcmp(exp->mod, dep_mod))
+			return true;
+	}
+
+	return false;
+}
+
 /*
  * Convert a regular relocation to a klp relocation (sort of).
  */
@@ -1533,6 +1555,14 @@ static int clone_reloc_klp(struct elfs *e, struct reloc *patched_reloc,
 		return -1;
 	}
 
+	if (!patched_sym->twin && export &&
+	    strcmp(export->mod, "vmlinux") &&
+	    !has_module_dep(e, export->mod)) {
+		ERROR("%s: new reference to %s (exported by %s) would create an undeclared module dependency",
+		      patched_sym->name, export->sym, export->mod);
+		return -1;
+	}
+
 	/*
 	 * Keep the original reloc intact for now to avoid breaking objtool run
 	 * which relies on proper relocations for many of its features.  This
-- 
2.54.0