NVIDIA / NVIDIA/open-gpu-kernel-modules

CFI violation in rm_kernel_rmapi_op

Open
#439 42 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
C
Stars
17.4k
Forks
1.9k
PR merge metrics
No merged PRs in 30d

Description

NVIDIA Open GPU Kernel Modules Version

525.60.13

Does this happen with the proprietary driver (of the same version) as well?

I cannot test this

Operating System and Version

Arch Linux Current

Kernel Release

6.0.16

Hardware: GPU

A5000

Describe the bug

When building the kernel (and therefore all modules) using RAP CFI, the open GPU modules code actually compiles but the nvidia module cannot be loaded into the kernel because it has a CFI violation in rm_kernel_rmapi_op: RAP hash rm_kernel_rmapi_op/3262ced1 for rm_kernel_rmapi_op+0x0/0x14d [nvidia] does not match existing hash 1f0fc3eb00017f.
The function is defined as void NV_API_CALL rm_kernel_rmapi_op(nvidia_stack_t *sp, void *ops_cmd) with consistent calling conventions (to my naked eye) throughout the code, so this doesnt look to be a case of overridden/colliding names. The NV_API_CALL definition also looks like it shouldn't change during compilation.
Do any of the developers know whether something its doing, or its compiled, or the way that its called could break call or return hash checks?

On a related note - the stackprotector appears to be used when its detected as available, not when its detected as having been used to build the rest of the kernel (RAP obviates the need for SSP when built with return checks, so while its available to the compiler, its not enabled during full-RAP builds).

To Reproduce

Build module against a RAP-instrumented kernel, then try to insmod

Bug Incidence

Always

nvidia-bug-report.log.gz

N/A

More Info

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the RAP-instrumented kernel build and insmod failure described for rm_kernel_rmapi_op. Trace the function's declaration, calling convention, and module build settings, including the stackprotector behavior mentioned in the report. Done means the CFI violation is resolved or its incompatibility is clearly documented and verified against the reproduction.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.