Skip to content

skip directories when resolving the nvml library path - #2025

Open
rootkiller6788 wants to merge 1 commit into
NVIDIA:mainfrom
rootkiller6788:fix-tryresolve-library-non-regular
Open

rootkiller6788 wants to merge 1 commit into
NVIDIA:mainfrom
rootkiller6788:fix-tryresolve-library-non-regular

Conversation

@rootkiller6788

Copy link
Copy Markdown

root.tryResolveLibrary in this package carries its own copy of the library-discovery code that go-nvlib has in pkg/nvlib/info/root.go, so it has the same bug that go-nvlib#107 reported there: it returns the first candidate that filepath.EvalSymlinks resolves, and EvalSymlinks resolves directories just as happily as it resolves files.

So a directory named libnvidia-ml.so.1 under /usr/lib64 (searched first) wins over the real library in /usr/lib/x86_64-linux-gnu, and the dlopen that follows fails with a not-found error. Not hypothetical — that is what was reported in kubernetes-sigs/dra-driver-nvidia-gpu#1272, which ships the same copy of this code.

The path matters here: the default --container-driver-root is /driver-root, not /, so this search loop is live, and main.go:362 hands its result straight to nvml.WithLibraryPath. Get that wrong and the plugin cannot load NVML at all. The same function also feeds nvinfo's assertHasLibrary when the platform is being resolved.

The change stats the resolved path and skips candidates that are not regular files, keeping the search going, mirroring NVIDIA/go-nvlib#108 upstream.

The test covers the shadowing case plus the ordinary lookup, a symlinked library (driver roots are mostly symlinks) and the fallback to the bare library name. I checked it fails without the change: the shadowing case returns the directory.

One thing worth flagging: this does not close #1945. That one is about the vendored go-nvlib copy, which still needs a bump once it is settled how (a release or a pseudo-version pin). I deliberately left go.mod and vendor/ alone.

@copy-pr-bot

copy-pr-bot Bot commented Sep 14, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@tariq1890

Copy link
Copy Markdown
Contributor

Thanks for your PR, please ensure the following preconditions are met:

  • DCO checks pass. The commit needs to be signed off
  • The commit needs to be signed with a GPG key or similar. See here.
  • Commits are squashed

Comment thread cmd/nvidia-device-plugin/root_test.go Outdated
@@ -0,0 +1,96 @@
/**
# Copyright 2024 NVIDIA CORPORATION

@tariq1890 tariq1890 Sep 14, 2026 •

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
# Copyright 2024 NVIDIA CORPORATION
# Copyright (c) NVIDIA CORPORATION. All rights reserved.

@rootkiller6788

Copy link
Copy Markdown
Author

Thanks for the review.

The copyright header on the new test file is fixed as suggested — it now reads # Copyright (c) NVIDIA CORPORATION. All rights reserved.. The test still passes: go test -run TestTryResolveLibrary ./cmd/nvidia-device-plugin/ is 5/5.

On the three preconditions: the newest commit carries a Signed-off-by, but the two earlier commits on this branch still don't, and the branch is still three commits rather than one. Squashing them into a single signed-off and GPG-signed commit rewrites the branch, so I'll force-push that once the code side is settled rather than leave it half done.

Could you please take another look?

@tariq1890

Copy link
Copy Markdown
Contributor

DCO check is still failing. Please squash the commit history as well

tryResolveLibrary returned the first candidate path that EvalSymlinks
could resolve, and EvalSymlinks resolves directories just as happily as
it resolves files. A directory named libnvidia-ml.so.1 sitting in an
earlier search path therefore won over the real library further down
the list, and the dlopen that follows failed with a not-found error.

Only take a candidate if it actually resolves to a regular file. Same
fix as go-nvlib#108, since this file carries its own copy of that code.

Adds a test for the resolution helper covering the plain lookup, the
shadowing case, a symlinked library (driver roots are full of those)
and the fallback to the bare library name. The copyright header on the
test file follows the form the rest of the repo uses.

Signed-off-by: rootkiller6788 <c8688rickowens@outlook.com>
@rootkiller6788
rootkiller6788 force-pushed the fix-tryresolve-library-non-regular branch 2 times, most recently from 671ba4c to 9a9ebdd Compare September 21, 2026 13:55
@tariq1890

Copy link
Copy Markdown
Contributor

@rootkiller6788 Your commit signature is unverified.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

vendored go-nvlib is affected by tryResolveLibrary directory-shadowing bug (NVIDIA/go-nvlib#107)

2 participants