From: Junrui Luo <[email protected]>
drm_getunique() and drm_getmagic() dereference file_priv->master without
checking it, and both ioctls are registered with flags of 0.
drm_open_helper() only calls drm_master_open() for primary clients, so a
drm_file opened on a non-primary minor keeps master == NULL. Render
clients are already rejected by the DRM_RENDER_ALLOW test in
drm_ioctl_permit(), so before commit 2c204f3d5321 ("accel: add dedicated
minor for accelerator devices") every drm_file reaching these ioctls had
a master.
DRM_MINOR_ACCEL is neither primary nor render: it gets no master in
drm_open_helper() and is not covered by drm_is_render_client(). Issuing
DRM_IOCTL_GET_UNIQUE or DRM_IOCTL_GET_MAGIC on /dev/accel/accel* leads
to a NULL pointer dereference, in drm_getunique() with dev->master_mutex
held. The compat entry point reaches drm_getunique() through
drm_ioctl_kernel() with flags of 0 as well.
Return -EINVAL when master is NULL, matching drm_setmaster_ioctl().
Fixes: 2c204f3d5321 ("accel: add dedicated minor for accelerator devices")
Reported-by: Yuhao Jiang <[email protected]>
Assisted-by: Claude:claude-opus-5
Cc: [email protected]
Signed-off-by: Junrui Luo <[email protected]>
---
drivers/gpu/drm/drm_auth.c | 3 +++
drivers/gpu/drm/drm_ioctl.c | 5 +++++
2 files changed, 8 insertions(+)
diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
index e5013b870ba0..cb9e02c486f0 100644
--- a/drivers/gpu/drm/drm_auth.c
+++ b/drivers/gpu/drm/drm_auth.c
@@ -97,6 +97,9 @@ int drm_getmagic(struct drm_device *dev, void *data, struct
drm_file *file_priv)
int ret = 0;
guard(mutex)(&dev->master_mutex);
+ if (!file_priv->master)
+ return -EINVAL;
+
if (!file_priv->magic) {
ret = idr_alloc(&file_priv->master->magic_map, file_priv,
1, 0, GFP_KERNEL);
diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
index 9039a39c4324..083722d8dd44 100644
--- a/drivers/gpu/drm/drm_ioctl.c
+++ b/drivers/gpu/drm/drm_ioctl.c
@@ -120,6 +120,11 @@ int drm_getunique(struct drm_device *dev, void *data,
mutex_lock(&dev->master_mutex);
master = file_priv->master;
+ if (!master) {
+ mutex_unlock(&dev->master_mutex);
+ return -EINVAL;
+ }
+
if (u->unique_len >= master->unique_len) {
if (copy_to_user(u->unique, master->unique,
master->unique_len)) {
mutex_unlock(&dev->master_mutex);
---
base-commit: f5bbbfec59b4e2fb7520a91de3df8a6174325d6a
change-id: 20260815-drm-accel-null-master-0d25e61240ab
Best regards,
--
Junrui Luo <[email protected]>
