Re: [PATCH v2] arm64: module: Use text-poke for late PLT/veneer emission

[Catalin Marinas <catalin.marinas@arm.com>]

Thanks Rui for respinning.

On Wed, Nov 11, 2026 at 03:39:06PM +0800, Rui Qi wrote:
> diff --git a/arch/arm64/include/asm/module.h b/arch/arm64/include/asm/module.h
> index fb9b88eebeb1..4a1a47f8ba1a 100644
> --- a/arch/arm64/include/asm/module.h
> +++ b/arch/arm64/include/asm/module.h
> @@ -6,6 +6,7 @@
>  #define __ASM_MODULE_H
>  
>  #include <asm-generic/module.h>
> +#include <asm/text-patching.h>
>  
>  struct mod_plt_sec {
>  	int			plt_shndx;
> @@ -29,6 +30,21 @@ u64 module_emit_plt_entry(struct module *mod, Elf64_Shdr *sechdrs,
>  u64 module_emit_veneer_for_adrp(struct module *mod, Elf64_Shdr *sechdrs,
>  				void *loc, u64 val);
>  
> +/*
> + * Write a relocation value to @place within a module.  While the module
> + * is MODULE_STATE_UNFORMED the destination is writable and a direct store
> + * is used; once the module is fully formed the region is read-only and
> + * executable, so the write is routed through the text-poke API.
> + */
> +#define module_write_place(place, val, mod) do {			\
> +	__typeof__(*place) __val = (val);				\
> +									\
> +	if (mod->state == MODULE_STATE_UNFORMED)			\
> +		*(place) = __val;					\
> +	else								\
> +		aarch64_insn_copy(place, &(__val), sizeof(*place));	\
> +} while (0)

A nit here, I'd move this macro to asm/text-patching.h since
asm/module.h is pulled in by linux/module.h. Even better if you could
make this a function (either static inline or out of line).

> --- a/arch/arm64/kernel/module-plts.c
> +++ b/arch/arm64/kernel/module-plts.c
> @@ -76,11 +76,13 @@ u64 module_emit_plt_entry(struct module *mod, Elf64_Shdr *sechdrs,
>  	int i = pltsec->plt_num_entries;
>  	int j = i - 1;
>  	u64 val = sym->st_value + rela->r_addend;
> +	struct plt_entry entry;
>  
>  	if (is_forbidden_offset_for_adrp(&plt[i].adrp))
>  		i++;
>  
> -	plt[i] = get_plt_entry(val, &plt[i]);
> +	entry = get_plt_entry(val, &plt[i]);
> +	module_write_place(&plt[i], entry, mod);

Sashiko reported PLT exhaustion/overrun and ADRP corruption when
relocations are reapplied after unloading and reloading a target module:

https://sashiko.dev/#/patchset/20261111073906.652400-1-qirui.001@bytedance.com

These look like existing problems, only exposed now because we no longer
get the ROX fault. I think they can be addressed in separate follow-up
patches. This patch still fixes the fault on the first application.

However, could we include a bounds check before writing the PLT entry,
maybe with a WARN_ON_ONCE? Once late writes use text-poke, retrying
after slot exhaustion can overwrite memory beyond .plt.

Thanks.

-- 
Catalin