Re: [PATCH v2 37/58] objtool/klp: Add test for sympos in module objects

On Sun, Sep 13, 2026 at 11:49 PM [off-list ref] wrote:

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Objtool's klp_find_sympos() for modules counts symbols in init and non-alloc sections, causing livepatch resolution to fail if applied after the target module is initialized.
--

commit 22d70a31297d85e4712560a5e8b6e9de9ffd35be
Author: Song Liu [off-list ref]
Subject: objtool/klp: Add test for sympos in module objects

This commit introduces test coverage for the klp-sympos logic in objtool.
It adds a new fixture and bash script to verify that duplicate symbols are
correctly numbered by sympos in module objects.

quoted

diff --git a/tools/objtool/tests/generic/test-sympos.sh b/tools/objtool/tests/generic/test-sympos.sh
new file mode 100755
index 0000000000000..b71d4930a22af
--- /dev/null
+++ b/tools/objtool/tests/generic/test-sympos.sh

[ ... ]

quoted

+run_diff
+
+assert_klp_sympos dup_counter 1
+assert_klp_sympos dup_counter 2

[Severity: High]
This is a pre-existing issue, but since this test checks the output of
klp_find_sympos(), I wanted to ask about its symbol counting logic.

Currently, klp_find_sympos() counts all identically-named symbols in the
module's ELF symtab:

tools/objtool/klp-sympos.c:klp_find_sympos() {
...
        for_each_sym(elf, s) {
                if (!strcmp(s->name, sym->name)) {
                        nr_matches++;
                        if (s == sym)
                                sympos = nr_matches;
                        else
                                has_dup = true;
                }
        }
...
}

Does blindly counting symbols in .init or non-alloc sections cause
livepatch resolution to fail?

When a livepatch is loaded after the target module is initialized, the
kernel's module_kallsyms_on_each_symbol() uses mod->core_kallsyms, which
strips init and non-alloc symbols via is_core_symbol().

If a livepatch targets a module symbol that shares its name with another
symbol located in an .init or non-alloc section, it seems klp_find_sympos()
assigns an inflated sympos (e.g., 2). However, the kernel would only find 1
matching symbol, see a mismatch with sympos=2, and reject the patch with
-EINVAL.

Should klp_find_sympos() be skipping init and non-alloc sections?

Let's address this separately.

Song