# US 11,907,101 B2 · Systems and methods for selective patching based on kernel and user space interaction > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,907,101 B2 - Document ID: US11907101B2 - Status: Granted - Kind: B2 - Application number: 17/677,644 - Filed: 2022-02-22 - Published: 2023-08-24 - Granted: 2024-02-20 - Earliest claimed: 2022-02-22 - Assignees: Cloud Linux Software Inc. - Applicants: Cloud Linux Software, Inc. - Inventors: Igor Seletskiy; Pavel Boldin - Web page: https://patentgrep.com/patent/US11907101B2 ## CPC - G06F 11/3636: {by tracing the execution of the program} - G06F 8/658: Incremental updates; Differential updates - G06F 11/073: {in a memory management context, e.g. virtual memory or cache management (memory management G06F12/00; testing of static memory units G11C29/00)} - G06F 11/0751: {Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06)} - G06F 11/0793: {Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40)} - G06F 11/3624: {by performing operations on the source code, e.g. via a compiler} - G06F 12/08: in hierarchically structured memory systems, e.g. virtual memory systems - G06F 12/1009: using page tables, e.g. page table structures - G06F 12/145: {the protection being virtual, e.g. for virtual blocks or segments before a translation mechanism} - G06F 2201/815: Virtual - G06F 2212/1016: Performance improvement - G06F 2212/1056: Simplification - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Disclosed herein are systems and methods for selective patching processes. In one exemplary aspect, the method includes: identifying, via a user space patching service, a patch that modifies at least one function included in a process, wherein the process is executed on a computing device; generating a list of target pages in virtual memory of the computing device, wherein the list of target pages includes code associated with the at least one function; marking the target pages as non-executable based on file identification; intercepting, using an amended page-fault event handler, an attempt to execute the code associated with the at least one function by the process; and applying the patch to modify the at least one function. ## Claims ### Claim 1 A method for selective patching processes, the method comprising: identifying, via a user space patching service, a patch that modifies at least one function comprised in a process, wherein the process is executed on a computing device; generating a list of target pages in virtual memory of the computing device, wherein the list of target pages comprises code associated with the at least one function; marking the target pages as non-executable based on file identification; and in response to intercepting, using an amended page-fault event handler, an attempt to execute the code associated with the at least one function by the process; applying the patch to modify the at least one function. ### Claim 2 (depends on 1) The method of claim 1, wherein intercepting the attempt to execute the code comprises detecting a page fault in at least one of the target pages marked as non-executable. ### Claim 3 (depends on 1) The method of claim 1, further comprising stopping the process prior to execution of the code. ### Claim 4 (depends on 1) The method of claim 1, wherein marking the target pages as non-executable is performed by a kernel of the computing device, wherein the user space patching service configures the kernel to mark pages in the virtual memory mapped to an executable object comprising the at least one function. ### Claim 5 (depends on 4) The method of claim 4, wherein mappings between the pages in the virtual memory and the executable object comprising the at least one function is generated based on a dev/inode pair. ### Claim 6 (depends on 4) The method of claim 4, wherein mappings between the pages in the virtual memory and the executable object comprising the at least one function is generated using a unique build identifier of the at least one function. ### Claim 7 (depends on 1) The method of claim 1, further comprising: identifying another patch that modifies at least one other function comprised in the process; marking another set of target pages associated with the at least one other function as non-executable based on file identification; and not applying the another patch to modify the at least one other function until a page fault is detected in the another set of target pages. ### Claim 8 (depends on 1) The method of claim 1, further comprising executing the code subsequent to applying the patch. ### Claim 9 A system for selective patching processes, the system comprising: a hardware processor configured to: identify, via a user space patching service, a patch that modifies at least one function comprised in a process, wherein the process is executed on a computing device; generate a list of target pages in virtual memory of the computing device, wherein the list of target pages comprises code associated with the at least one function; mark the target pages as non-executable based on file identification; and in response to intercepting, using an amended page-fault event handler, an attempt to execute the code associated with the at least one function by the process, apply the patch to modify the at least one function. ### Claim 10 (depends on 9) The system of claim 9, wherein the hardware processor is further configured to intercept the attempt to execute the code by detecting a page fault in at least one of the target pages marked as non-executable. ### Claim 11 (depends on 9) The system of claim 9, wherein the hardware processor is further configured to stop the process prior to execution of the code. ### Claim 12 (depends on 9) The system of claim 9, wherein marking the target pages as non-executable is performed by a kernel of the computing device, wherein the user space patching service configures the kernel to mark pages in the virtual memory mapped to an executable object comprising the at least one function. ### Claim 13 (depends on 12) The system of claim 12, wherein mappings between the pages in the virtual memory and the executable object comprising the at least one function is generated based on a dev/inode pair. ### Claim 14 (depends on 12) The system of claim 12, wherein mappings between the pages in the virtual memory and the executable object comprising the at least one function is generated using a unique build identifier of the at least one function. ### Claim 15 (depends on 9) The system of claim 9, wherein the hardware processor is further configured to: identify another patch that modifies at least one other function comprised in the process; marking another set of target pages associated with the at least one other function as non-executable based on file identification; and not applying the another patch to modify the at least one other function until a page fault is detected in the another set of target pages. ### Claim 16 (depends on 9) The system of claim 9, wherein the hardware processor is further configured to execute the code subsequent to applying the patch. ### Claim 17 A non-transitory computer readable medium storing thereon computer executable instructions for selective patching processes, including instructions for: identifying, via a user space patching service, a patch that modifies at least one function comprised in a process, wherein the process is executed on a computing device; generating a list of target pages in virtual memory of the computing device, wherein the list of target pages comprises code associated with the at least one function; marking the target pages as non-executable based on file identification; and in response to intercepting, using an amended page-fault event handler, an attempt to execute the code associated with the at least one function by the process, applying the patch to modify the at least one function.