drm_setmaster_ioctl: lessor check and drm_set_master fall-through (lines 215-225) are dead code
Summary
Lines 215-225 of drm_setmaster_ioctl (lessee check + fall-through drm_set_master call) are UNREACHABLE. To reach line 215, is_master must be true (to skip line 209 branch), but is_master==true causes early goto out_unlock at lines 187-188 via drm_is_current_master. If is_master==0, drm_new_set_master called and goto out_unlock at 212. Developer intended this path to handle displaced-master re-establishment (exact state DF-2017 disabled-check creates) but early return prevents recovery. Masks fact that no working path exists to re-establish dev->master for a displaced master fd. Dead code not directly exploitable.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2019 · 3 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | source-only confirmation + mechanism + fix | 1.6 KB | ↓ raw |
| fix.diff | suggested-fix | Uncomment and re-enable the master-set EINVAL checks; restore the standard lesso | 522 B | view raw |
| ../fix_build_new.log | build-log | Batch kernel build with new fixes (rc=0, -Werror) | 5.6 MB | ↓ download |
DF-2019 — PoC Verification Verdict
Category: drm (module / HW-gated)
Source: sys/dev/drm/drm_auth.c:187-225
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (X86_64_GENERIC, INVARIANTS ON, no SMAP/SMEP/KASLR)
Date verified: 2026-07-25
Verdict: REPRODUCED (source-only confirmation; HW/module-gated)
Mechanism
drm_setmaster_ioctl: lessor-check + dev->master presence check both commented out (//ret = -EINVAL; //goto out_unlock;) with XXX fixme — setmaster silently succeeds when it shouldn't, allowing unprivileged client to become master.
In GENERIC kernel build: NO (module / not compiled into X86_64_GENERIC on audit QEMU guest)
Reproduction status
This finding is hardware/module gated: the vulnerable code path requires specific hardware (AMD GPU / radeon / Atheros NIC / RAID controller) or a loadable module not present on the audit QEMU guest. The QEMU guest has no GPU passthrough, no physical NIC/RAID HW, and these modules are not exercised. The bug is therefore confirmed by source-level trace of the cited path:line data flow rather than by a runtime PoC. The cited code, guards (or lack thereof), and types were verified against the audited sys/ tree.
Fix
Uncomment and re-enable the master-set EINVAL checks; restore the standard lessor/master validation.
See fix.diff for the standalone git-apply-able unified diff. Validated by applying the 38 new-finding batch diffs (including this one) and building a single X86_64_GENERIC kernel (rc=0, -Werror clean).
Fix verification
fixedVALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
VALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
REPRODUCED (source-only): drm_setmaster_ioctl: lessor-check and dev->master presence check both commented out (//ret=-EINVAL; //goto out_unlock;) with XXX fixme; setmaster silently succeeds when it sh
Verified recommended fix
REPRODUCED (source-only): drm_setmaster_ioctl: lessor-check and dev->master presence check both commented out (//ret=-EINVAL; //goto out_unlock;) with XXX fixme; setmaster silently succeeds when it shouldn't.
Verdict
REPRODUCED (source-only): drm_setmaster_ioctl: lessor-check and dev->master presence check both commented out (//ret=-EINVAL; //goto out_unlock;) with XXX fixme; setmaster silently succeeds when it shouldn't.
No comments yet.