Live Patching

Coverage: kernel livepatch (KLP) → ftrace-based → atomic replace → state consistency model → real-time kernel Kernel versions: 4.0 ~ 6.x (mainline), Enterprise (RHEL 7+)

Overview

Live patching allows fixing kernel functions without rebooting the kernel—suitable for critical security fixes (CVEs) and minor logic bugs. The core principle: place an ftrace trampoline at the entry of the currently executing function to jump to the new function; then check the kernel stacks of all processes one by one to ensure they are not in the old function; once all have safely evacuated, the old function is no longer called.

Implementation Principles

// kernel/livepatch/core.c + kernel/livepatch/patch.c
// Based on ftrace:

// 1. Register livepatch:
klp_enable_patch(patch)
  → klp_patch_object(patch->objs)
    → klp_patch_func(func)  // For each function to be replaced
      → ftrace_set_filter_ip(func->old_func, ...)  // Set ftrace hook
        → Function entry replaced with ftrace trampoline → livepatch handler → new function

// 2. Consistency check (safe migration):
klp_try_complete_transition()
  → Iterate over all processes (for_each_process_thread)
    → klp_check_stack(task, func)  // Check kernel stack
      → If task is in old_func → cannot migrate → wait or force
  → All leave → old_func is no longer the "current execution point" for any process

// 3. Complete: patch->state = KLP_PATCHED

Consistency Model

// Three models:
//   KLP_TRANSITION_IDLE:   Wait for all processes to voluntarily leave (wait point: syscall boundary)
//   KLP_TRANSITION_FORCE:  Send signals to force leaving (if possible)
//   KLP_TRANSITION_IMMEDIATE: Apply patch immediately (no wait, but if process is in old function → may crash)

// In practice, mostly IDLE (safe) or signal-assisted (klp_send_signals) is used

Limitations

- Cannot modify function signatures (parameter types/counts must remain unchanged)
- Cannot modify data structure layouts (struct sizes cannot change before/after patch)
- Cannot apply stateful patches (if old code holds locks → may deadlock after patch)
- Livepatch modules cannot be unloaded (permanent effect)

Suitable for: CVE fixes, defensive checks for single functions
Not suitable for: Large-scale refactoring, cross-version migrations

Real-Time Kernel (PREEMPT_RT)

Merge status (6.x): PREEMPT_RT is being merged into the mainline
  Past: out-of-tree patchset (rt.wiki.kernel.org)
  Present: merged into mainline via individual PRs (6.12 nearing completion)

Relationship with livepatch:
  In RT, preemption disabling changed to rt_mutex → livepatch's stack check logic needs adaptation
  → Handled (6.5+)

References

Source code: kernel/livepatch/, samples/livepatch/, arch/x86/kernel/livepatch.c
Kernel documentation: Documentation/livepatch/
LWN: "Live patching in the Linux kernel"

Keywords: livepatch, klp, ftrace, stack check, atomic replace, PREEMPT_RT, CVE fix