grsecurity forums

Hi

Nvidia drivers 31x.xx i 325.xx, arch x86-64 are currently not compatible with linux-3.10.

The problem and the patch with the solution is here:
https://devtalk.nvidia.com/default/topi ... o/#3847582
The patch is here: http://pastie.org/8123499

For Linux 3.10 without grsec & pax Nvidia driver is operating normally.
But the mistake is repaired patch conflicts with patch nvidia-drivers-285.05.09-pax-const.patch.

The result of applying the patch pax-const.patch after nvidia-linux-3.10.patch:

Code: Select all

patching file kernel / nv-procfs.c
Hunk # 1 FAILED at 707
1 out of 1 hunk FAILED - saving rejects to file kernel / nv-procfs.c.rej


Code: Select all

cat kernel / nv-procfs.c.rej

--- Kernel.orig / nv-procfs.c 2011-07-13 03:29:30.000000000 +0200
+ + + Kernel / nv-procfs.c 2011-07-19 15:45:27.982993911 +0200
@ @ @ @ 707.10 -707.8
      * However, in preparation for this, we need to preserve
      * The procfs read () and write () operations.
      * /
- Nv_procfs_registry_fops.read = entry-> proc_fops-> read;
- Nv_p
rocfs_registry_fops.write = entry-> proc_fops-> write;
+ Pax_open_kernel ();
+ * (Void **) & nv_procfs_registry_fops.read = entry-> proc_fops-> read;
+ * (Void **) & nv_procfs_registry_fops.write = entry-> proc_fops-> write;
+ Pax_close_kernel ();
 
     entry = NV_CREATE_PROC_FILE ("registry", proc_nvidia,
         nv_procfs_read_registry,

Is it possible to somehow reconcile the use of patches for compliance with the Linux driver 3.10,
with patches pax-const and pax-usercopy, (how to do), whether it is better to wait until Nvidia will release a revised driver?


Addresses patches:
Imposed by me - improving mistake on Linux 3.10 - nvidia-linux-3.10.patch:
http://jacekalex.sh.dug.net.pl/nvidia-l ... .patch.txt
Pax patch to nvidia-drivers in Gentoo portage:
http://data.gpo.zugaina.org/gentoo/x11- ... onst.patch
http://data.gpo.zugaina.org/gentoo/x11- ... copy.patch

My system:
Gentoo-hardened x86-64.
gcc version 4.6.3 (Gentoo Hardened 4.6.3 P1.5, pie-0.5.2)

Sorry for bad English.

Cheers

i think you're better off by waiting for nvidia to release official support for 3.10 then we'll see what needs still patching for PaX.

Hi

New Nvidia 325.15 driver properly compiled on kernel 3.10.5 without any additional patches, while the 3.10.5-grsec found that patch pax-const is incompatible with this driver.

Code: Select all

 ~> patch -p1  < /var/portage/local/x11-drivers/nvidia-drivers/files/nvidia-drivers-pax-const.patch
patching file nv-procfs.c
Hunk #1 FAILED at 707.
1 out of 1 hunk FAILED -- saving rejects to file nv-procfs.c.rej

Code: Select all

cat nv-procfs.c.rej

Code: Select all

--- nv-procfs.c   2011-07-13 03:29:30.000000000 +0200
+++ nv-procfs.c   2011-07-19 15:45:27.982993911 +0200
@@ -707,8 +707,10 @@
      * However, in preparation for this, we need to preserve
      * the procfs read() and write() operations.
      */
-    nv_procfs_registry_fops.read = entry->proc_fops->read;
-    nv_procfs_registry_fops.write = entry->proc_fops->write;
+    pax_open_kernel();
+    *(void **)&nv_procfs_registry_fops.read = entry->proc_fops->read;
+    *(void **)&nv_procfs_registry_fops.write = entry->proc_fops->write;
+    pax_close_kernel();
 
     entry = NV_CREATE_PROC_FILE("registry", proc_nvidia,
         nv_procfs_read_registry,

Is there a chance to nvidia-pax-const to new driver and Linux 3.10.x and newer kernel?

Pax-usercopy patch is applied correctly

Code: Select all

~> patch -p1 --dry-run < /var/portage/local/x11-drivers/nvidia-drivers/files/nvidia-drivers-pax-usercopy.patch
patching file nv.c
Hunk #1 succeeded at 754 (offset -351 lines).
Hunk #2 succeeded at 870 with fuzz 2 (offset -350 lines).
Hunk #3 succeeded at 879 (offset -350 lines).
patching file nv-linux.h
Hunk #1 succeeded at 759 (offset 64 lines).

Both patches checked on
Linux 3.10.5 (vanilla-sources)
grsecurity-2.9.1-3.10.5-201308052154.patch
4200_fbcondecor-0.9.6.patch

Cheers


Sorry for bad English, my native language is Polish.

the const patch is no longer needed.

PaX Team wrote:the const patch is no longer needed.

That's wonderful news

Thanks