On 8/15/2026 12:37 AM, Junrui Luo via B4 Relay wrote:
From: Junrui Luo <[email protected]>drm_getunique() and drm_getmagic() dereference file_priv->master without checking it, and both ioctls are registered with flags of 0. drm_open_helper() only calls drm_master_open() for primary clients, so a drm_file opened on a non-primary minor keeps master == NULL. Render clients are already rejected by the DRM_RENDER_ALLOW test in drm_ioctl_permit(), so before commit 2c204f3d5321 ("accel: add dedicated minor for accelerator devices") every drm_file reaching these ioctls had a master. DRM_MINOR_ACCEL is neither primary nor render: it gets no master in drm_open_helper() and is not covered by drm_is_render_client(). Issuing DRM_IOCTL_GET_UNIQUE or DRM_IOCTL_GET_MAGIC on /dev/accel/accel* leads to a NULL pointer dereference, in drm_getunique() with dev->master_mutex held. The compat entry point reaches drm_getunique() through drm_ioctl_kernel() with flags of 0 as well. Return -EINVAL when master is NULL, matching drm_setmaster_ioctl(). Fixes: 2c204f3d5321 ("accel: add dedicated minor for accelerator devices") Reported-by: Yuhao Jiang <[email protected]> Assisted-by: Claude:claude-opus-5 Cc: [email protected] Signed-off-by: Junrui Luo <[email protected]>
Reviewed-by: Jeff Hugo <[email protected]>
