Re: [PATCH 3/4] objtool/klp: reject new cross-module references without existing dependency

On Mon, Jul 20, 2026 at 10:56:57AM -0400, Joe Lawrence wrote:
> When a livepatch introduces a new reference to a module-exported symbol,
> the resulting klp-relocation will only be resolved at patch-enable time
> if the exporting module is loaded.
> 
> A future commit will remove livepatch module dependency references to
> facilitate late-module patching, that is, the pre-loading of the
> livepatch before target modules are loaded.
> 
> If the original (unpatched) module already depends on the exporting
> module, the dependency is safe: the module loader ensures the dependency
> is satisfied before the patched module can be loaded, so the
> klp-relocation target will exist.
> 
> However, if the patch introduces a reference to a module that the
> original doesn't depend on, there is no such guarantee.  The exporting
> module could be absent or could be unloaded at any time, leading to a
> relocation failure or use-after-free.
> 
> Add a build-time check: when a new symbol reference (no twin) targets a
> module export, verify that the original module already has at least one
> UNDEF symbol resolving to that same exporting module.  If not, error out
> with a diagnostic message.
> 
> Signed-off-by: Joe Lawrence <[email protected]>

I think the previous patch exposed this bug, so I combined them into a
single patch and massaged the code a bit.

-- 
Josh