Re: [PATCH] drm: check for NULL master in drm_getunique() and drm_getmagic()

[Jeff Hugo <jeff.hugo@oss.qualcomm.com>]

On 8/15/2026 12:37 AM, Junrui Luo via B4 Relay wrote:
> From: Junrui Luo <moonafterrain@outlook.com>
> 
> drm_getunique() and drm_getmagic() dereference file_priv->master without
> checking it, and both ioctls are registered with flags of 0.
> drm_open_helper() only calls drm_master_open() for primary clients, so a
> drm_file opened on a non-primary minor keeps master == NULL. Render
> clients are already rejected by the DRM_RENDER_ALLOW test in
> drm_ioctl_permit(), so before commit 2c204f3d5321 ("accel: add dedicated
> minor for accelerator devices") every drm_file reaching these ioctls had
> a master.
> 
> DRM_MINOR_ACCEL is neither primary nor render: it gets no master in
> drm_open_helper() and is not covered by drm_is_render_client(). Issuing
> DRM_IOCTL_GET_UNIQUE or DRM_IOCTL_GET_MAGIC on /dev/accel/accel* leads
> to a NULL pointer dereference, in drm_getunique() with dev->master_mutex
> held. The compat entry point reaches drm_getunique() through
> drm_ioctl_kernel() with flags of 0 as well.
> 
> Return -EINVAL when master is NULL, matching drm_setmaster_ioctl().
> 
> Fixes: 2c204f3d5321 ("accel: add dedicated minor for accelerator devices")
> Reported-by: Yuhao Jiang <danisjiang@gmail.com>
> Assisted-by: Claude:claude-opus-5
> Cc: stable@vger.kernel.org
> Signed-off-by: Junrui Luo <moonafterrain@outlook.com>

Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>