[PATCH] drm: check for NULL master in drm_getunique() and drm_getmagic()

[PATCH] drm: check for NULL master in drm_getunique() and drm_getmagic()

[Junrui Luo via B4 Relay]

From: Junrui Luo <moonafterrain@outlook.com>

drm_getunique() and drm_getmagic() dereference file_priv->master without
checking it, and both ioctls are registered with flags of 0.
drm_open_helper() only calls drm_master_open() for primary clients, so a
drm_file opened on a non-primary minor keeps master == NULL. Render
clients are already rejected by the DRM_RENDER_ALLOW test in
drm_ioctl_permit(), so before commit 2c204f3d5321 ("accel: add dedicated
minor for accelerator devices") every drm_file reaching these ioctls had
a master.

DRM_MINOR_ACCEL is neither primary nor render: it gets no master in
drm_open_helper() and is not covered by drm_is_render_client(). Issuing
DRM_IOCTL_GET_UNIQUE or DRM_IOCTL_GET_MAGIC on /dev/accel/accel* leads
to a NULL pointer dereference, in drm_getunique() with dev->master_mutex
held. The compat entry point reaches drm_getunique() through
drm_ioctl_kernel() with flags of 0 as well.

Return -EINVAL when master is NULL, matching drm_setmaster_ioctl().

Fixes: 2c204f3d5321 ("accel: add dedicated minor for accelerator devices")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
---
 drivers/gpu/drm/drm_auth.c  | 3 +++
 drivers/gpu/drm/drm_ioctl.c | 5 +++++
 2 files changed, 8 insertions(+)

diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
index e5013b870ba0..cb9e02c486f0 100644
--- a/drivers/gpu/drm/drm_auth.c
+++ b/drivers/gpu/drm/drm_auth.c
@@ -97,6 +97,9 @@ int drm_getmagic(struct drm_device *dev, void *data, struct drm_file *file_priv)
 	int ret = 0;
 
 	guard(mutex)(&dev->master_mutex);
+	if (!file_priv->master)
+		return -EINVAL;
+
 	if (!file_priv->magic) {
 		ret = idr_alloc(&file_priv->master->magic_map, file_priv,
 				1, 0, GFP_KERNEL);
diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
index 9039a39c4324..083722d8dd44 100644
--- a/drivers/gpu/drm/drm_ioctl.c
+++ b/drivers/gpu/drm/drm_ioctl.c
@@ -120,6 +120,11 @@ int drm_getunique(struct drm_device *dev, void *data,
 
 	mutex_lock(&dev->master_mutex);
 	master = file_priv->master;
+	if (!master) {
+		mutex_unlock(&dev->master_mutex);
+		return -EINVAL;
+	}
+
 	if (u->unique_len >= master->unique_len) {
 		if (copy_to_user(u->unique, master->unique, master->unique_len)) {
 			mutex_unlock(&dev->master_mutex);

---
base-commit: f5bbbfec59b4e2fb7520a91de3df8a6174325d6a
change-id: 20260815-drm-accel-null-master-0d25e61240ab

Best regards,
-- 
Junrui Luo <moonafterrain@outlook.com>

Re: [PATCH] drm: check for NULL master in drm_getunique() and drm_getmagic()

[Jeff Hugo]

On 8/15/2026 12:37 AM, Junrui Luo via B4 Relay wrote:
> From: Junrui Luo <moonafterrain@outlook.com>
> 
> drm_getunique() and drm_getmagic() dereference file_priv->master without
> checking it, and both ioctls are registered with flags of 0.
> drm_open_helper() only calls drm_master_open() for primary clients, so a
> drm_file opened on a non-primary minor keeps master == NULL. Render
> clients are already rejected by the DRM_RENDER_ALLOW test in
> drm_ioctl_permit(), so before commit 2c204f3d5321 ("accel: add dedicated
> minor for accelerator devices") every drm_file reaching these ioctls had
> a master.
> 
> DRM_MINOR_ACCEL is neither primary nor render: it gets no master in
> drm_open_helper() and is not covered by drm_is_render_client(). Issuing
> DRM_IOCTL_GET_UNIQUE or DRM_IOCTL_GET_MAGIC on /dev/accel/accel* leads
> to a NULL pointer dereference, in drm_getunique() with dev->master_mutex
> held. The compat entry point reaches drm_getunique() through
> drm_ioctl_kernel() with flags of 0 as well.
> 
> Return -EINVAL when master is NULL, matching drm_setmaster_ioctl().
> 
> Fixes: 2c204f3d5321 ("accel: add dedicated minor for accelerator devices")
> Reported-by: Yuhao Jiang <danisjiang@gmail.com>
> Assisted-by: Claude:claude-opus-5
> Cc: stable@vger.kernel.org
> Signed-off-by: Junrui Luo <moonafterrain@outlook.com>

Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>