Skip to content

create-diff-object can omit patchable changed child functions #1525

Open

Description

@benjamindonnachie

Description

create-diff-object can silently omit a changed, independently patchable
compiler-generated child function from the livepatch registration metadata.
The replacement code remains in the module, so the module builds and loads
successfully even though the affected execution path is not redirected.

This was observed on EL9 with GCC splitting snd_timer_interrupt() into:

  • unchanged parent wrapper: snd_timer_interrupt
  • changed child: snd_timer_interrupt.part.0

The child has its own __fentry__ call. Therefore
kpatch_changed_child_needs_parent_profiling() deliberately does not promote
the unchanged parent. However, kpatch_create_patches_sections() later skips
all symbols with sym->parent, including this independently patchable child.

Resulting module

The faulty module contained:

  • .text.snd_timer_interrupt.part.0
  • .klp.rela.snd_timer..text.snd_timer_interrupt.part.0

It did not contain a .kpatch.funcs record/string for
snd_timer_interrupt.part.0. After loading, livepatch sysfs listed another
changed function from the same object, but not the changed child. There was no
build or module-load error.

Expected behaviour

A changed child should be registered directly when:

  1. it has its own profiling/patchable function entry; and
  2. no changed ancestor already carries its replacement code.

Children without a profiling entry should continue to be handled through the
promoted parent, and children of an already changed ancestor should not be
registered twice.

Impact

This creates a silent livepatch coverage gap: source-level selection and a
successful module load can both report success while the kernel continues
executing the vulnerable child function.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions