NVIDIA / NVIDIA/open-gpu-kernel-modules
CFI violation in rm_kernel_rmapi_op
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 17.4k
- Forks
- 1.9k
- PR merge metrics
- No merged PRs in 30d
Description
NVIDIA Open GPU Kernel Modules Version
525.60.13
Does this happen with the proprietary driver (of the same version) as well?
I cannot test this
Operating System and Version
Arch Linux Current
Kernel Release
6.0.16
Hardware: GPU
A5000
Describe the bug
When building the kernel (and therefore all modules) using RAP CFI, the open GPU modules code actually compiles but the nvidia module cannot be loaded into the kernel because it has a CFI violation in rm_kernel_rmapi_op: RAP hash rm_kernel_rmapi_op/3262ced1 for rm_kernel_rmapi_op+0x0/0x14d [nvidia] does not match existing hash 1f0fc3eb00017f.
The function is defined as void NV_API_CALL rm_kernel_rmapi_op(nvidia_stack_t *sp, void *ops_cmd) with consistent calling conventions (to my naked eye) throughout the code, so this doesnt look to be a case of overridden/colliding names. The NV_API_CALL definition also looks like it shouldn't change during compilation.
Do any of the developers know whether something its doing, or its compiled, or the way that its called could break call or return hash checks?
On a related note - the stackprotector appears to be used when its detected as available, not when its detected as having been used to build the rest of the kernel (RAP obviates the need for SSP when built with return checks, so while its available to the compiler, its not enabled during full-RAP builds).
To Reproduce
Build module against a RAP-instrumented kernel, then try to insmod
Bug Incidence
Always
nvidia-bug-report.log.gz
N/A
More Info
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the RAP-instrumented kernel build and insmod failure described for rm_kernel_rmapi_op. Trace the function's declaration, calling convention, and module build settings, including the stackprotector behavior mentioned in the report. Done means the CFI violation is resolved or its incompatibility is clearly documented and verified against the reproduction.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100