Summary

drm_setmaster_ioctl (drm_auth.c:190-201) has the "if (dev->master) { ret = -EINVAL; goto out_unlock; }" exclusivity guard COMMENTED OUT ("XXX fixme"). Upstream Linux enforces this to reject SET_MASTER when another master already holds the device. With it disabled, a CAP_SYS_ADMIN caller proceeds into drm_new_set_master -> drm_set_master which executes dev->master = drm_master_get(fpriv->master) (line 127) -- raw pointer assignment with NO drm_master_put of the prior dev->master. Old master object refcount stranded (leaked ~200 bytes per call with embedded idr). Additionally breaks DRM master exclusivity invariant: root steals mastership from X server without master_drop callback firing, leaving driver-private master state inconsistent. DRM_IOCTL_SET_MASTER flagged DRM_ROOT_ONLY in drm_ioctl.c:597 requiring capable(CAP_SYS_ADMIN). Attacker: privileged process loops SET_MASTER to leak drm_master objects -> kernel memory exhaustion OR silently takes over display. AV:L/PR:H/AC:L, I:L/A:L.

PoC verification

Evidence pack

findings/poc/DF-2017 · 7 files

File	Type	Description	Size
README.md	readme	original PoC README	176 B	↓ raw
VERDICT.md	verdict	full source-trace verdict	1.5 KB	↓ raw
build.sh	build-script	build/verify instructions	438 B	view raw
env.txt	environment	guest environment (no matching HW)	814 B	view raw
fix.diff	suggested-fix	git-apply-able fix, verified to compile -Werror	589 B	view raw
fix_build.log	build-log	Phase 8 module build evidence (-Werror rc=0)	1.5 KB	view raw
run.sh	run-script	run instructions (HW-gated)	320 B	view raw

README.md readme original PoC README

↓ download raw

DF-2017 PoC

See the parent finding markdown at findings/DF-2017-*.md for the full threat model and PoC steps. This directory is the evidence-pack slot for the PoC runner.

VERDICT.md verdict full source-trace verdict

↓ download raw

VERDICT -- DF-2017 (Low)

Verdict: REPRODUCED (source-only)

Impact: DRM master refcount leak / mastership theft (logic); HW-gated (needs DRM/GPU), source-confirmed

Confidence: certain

Mechanism (source-traced)

drm_setmaster_ioctl (drm_auth.c:181-260) has the 'if (dev->master) { ret=-EINVAL; goto out_unlock; }' exclusivity guard COMMENTED OUT (drm_auth.c:197-201, the ret/goto lines are '//ret = -EINVAL; //goto out_unlock;' with an 'XXX fixme' comment). With it disabled, a CAP_SYS_ADMIN caller proceeds into drm_new_set_master -> drm_set_master which does dev->master = drm_master_get(fpriv->master) (drm_auth.c:127) -- a raw assignment with no drm_master_put of the prior dev->master, stranding the old master object refcount.

Why not runtime-reproduced

The guest (DragonFlyBSD 6.5-DEVELOPMENT #0 master DEV, KVM) has NO matching hardware: pciconf shows no mfi/tws/iir RAID controller and no amdgpu/DRM GPU; the driver therefore cannot attach and the vulnerable path is not runtime- triggerable here. The defect was confirmed at the source level by tracing the cited path:line against sys/, and the proposed fix was applied and the affected module (drm) built clean with -Werror (see fix_build.log).

Fix

drm_auth.c:197-201: restore the exclusivity check (uncomment ret=-EINVAL; goto out_unlock) so SET_MASTER is rejected when dev->master is already held, preventing the refcount leak/mastership theft.

The standalone, git-apply-able diff is fix.diff.

Fix verification

not_testable

baseline reproduced→ patch + rebuild →patched clean

VALIDATED build.

VALIDATED build.

↓ fix.diffdrm.ko build rc=0 -Werror

Confirmed kernel references

Detail

Exploit chain

none (HW-gated).

Evidence (decisive lines)

HW-GATED (no DRM). Source-CONFIRMED. drm_setmaster_ioctl has dev->master exclusivity guard COMMENTED OUT ('//ret=-EINVAL'). CAP_SYS_ADMIN can steal mastership, strand old master refcount.

Verified recommended fix

Uncomment ret=-EINVAL; goto out_unlock in dev->master block.

Verdict

HW-GATED (no DRM). Source-CONFIRMED. drm_setmaster_ioctl has dev->master exclusivity guard COMMENTED OUT ('//ret=-EINVAL'). CAP_SYS_ADMIN can steal mastership, strand old master refcount.

drm_setmaster_ioctl: disabled dev->master exclusivity check leaks master refcount and silently steals mastership