[PATCH v2 2/2] perf symbols: skip livepatch symbols in kcore_copy kallsyms processing

From: Joe Lawrence

Date: Fri Jun 26 2026 - 17:22:13 EST


Livepatch symbols (.klp.sym.*) carry a [module] tag but resolve to core
kernel text addresses. When kcore_copy__process_kallsyms() encounters
these symbols, they are treated as module symbols, pulling the
first_module_symbol down to a kernel text address.

This corrupts the module memory range used to build the kcore PT_LOAD
segments. For example, with a kpatch module containing a
".klp.sym.vmlinux.arch_release_task_struct,0" livepatch symbol loaded:

kernel symbols
...
ffffffffb4a41120 arch_release_task_struct
... ^
... | aliased by .klp.sym
... | drags first_module_symbol here
|
(43M gap) | bloated kcore segment
|
module symbols |
ffffffffc047b000 <-- correct first_module_symbol
...
...

This causes the module PT_LOAD segment to start at the .klp.sym address
and not the real first module address, bloating the kcore copy:

Baseline (no livepatch): VirtAddr ffffffffc047b000, 8.5M
Bloated (with livepatch): VirtAddr ffffffffb4a41000, 54M
Post-fix (with livepatch): VirtAddr ffffffffc047b000, 8.9M

Filter livepatch symbols early in kcore_copy__process_kallsyms() before
they can affect module boundary tracking.

Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
Link: https://sashiko.dev/#/patchset/20260624201254.472576-1-joe.lawrence@xxxxxxxxxx?part=1
Signed-off-by: Joe Lawrence <joe.lawrence@xxxxxxxxxx>
---
tools/perf/util/symbol-elf.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index 39562bdec8b9..f6f6b54da131 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -2216,6 +2216,10 @@ static int kcore_copy__process_kallsyms(void *arg, const char *name, char type,
if (!kallsyms__is_function(type))
return 0;

+ /* Ignore livepatch symbols */
+ if (is_livepatch_symbol(name))
+ return 0;
+
if (strchr(name, '[')) {
if (!kci->first_module_symbol || start < kci->first_module_symbol)
kci->first_module_symbol = start;
--
2.54.0