3 files changed, 34 insertions, 12 deletions

diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c
index b1838a41ad43..83a5bbca6e7e 100644
--- a/drivers/gpu/drm/drm_file.c
+++ b/drivers/gpu/drm/drm_file.c
@@ -262,6 +262,18 @@ void drm_file_free(struct drm_file *file)
         kfree(file);
 }
 
+static void drm_close_helper(struct file *filp)
+{
+        struct drm_file *file_priv = filp->private_data;
+        struct drm_device *dev = file_priv->minor->dev;
+
+        mutex_lock(&dev->filelist_mutex);
+        list_del(&file_priv->lhead);
+        mutex_unlock(&dev->filelist_mutex);
+
+        drm_file_free(file_priv);
+}
+
 static int drm_setup(struct drm_device * dev)
 {
         int ret;
@@ -318,8 +330,10 @@ int drm_open(struct inode *inode, struct file *filp)
                 goto err_undo;
         if (need_setup) {
                 retcode = drm_setup(dev);
-                if (retcode)
+                if (retcode) {
+                        drm_close_helper(filp);
                         goto err_undo;
+                }
         }
         return 0;
 
@@ -473,11 +487,7 @@ int drm_release(struct inode *inode, struct file *filp)
 
         DRM_DEBUG("open_count = %d\n", dev->open_count);
 
-        mutex_lock(&dev->filelist_mutex);
-        list_del(&file_priv->lhead);
-        mutex_unlock(&dev->filelist_mutex);
-
-        drm_file_free(file_priv);
+        drm_close_helper(filp);
 
         if (!--dev->open_count) {
                 drm_lastclose(dev);
diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
index 7e6746b2d704..687943df58e1 100644
--- a/drivers/gpu/drm/drm_ioctl.c
+++ b/drivers/gpu/drm/drm_ioctl.c
@@ -508,6 +508,13 @@ int drm_version(struct drm_device *dev, void *data,
         return err;
 }
 
+static inline bool
+drm_render_driver_and_ioctl(const struct drm_device *dev, u32 flags)
+{
+        return drm_core_check_feature(dev, DRIVER_RENDER) &&
+                (flags & DRM_RENDER_ALLOW);
+}
+
 /**
  * drm_ioctl_permit - Check ioctl permissions against caller
  *
@@ -522,14 +529,19 @@ int drm_version(struct drm_device *dev, void *data,
  */
 int drm_ioctl_permit(u32 flags, struct drm_file *file_priv)
 {
+        const struct drm_device *dev = file_priv->minor->dev;
+
         /* ROOT_ONLY is only for CAP_SYS_ADMIN */
         if (unlikely((flags & DRM_ROOT_ONLY) && !capable(CAP_SYS_ADMIN)))
                 return -EACCES;
 
-        /* AUTH is only for authenticated or render client */
-        if (unlikely((flags & DRM_AUTH) && !drm_is_render_client(file_priv) &&
-                     !file_priv->authenticated))
-                return -EACCES;
+        /* AUTH is only for master ... */
+        if (unlikely((flags & DRM_AUTH) && drm_is_primary_client(file_priv))) {
+                /* authenticated ones, or render capable on DRM_RENDER_ALLOW. */
+                if (!file_priv->authenticated &&
+                    !drm_render_driver_and_ioctl(dev, flags))
+                        return -EACCES;
+        }
 
         /* MASTER is only for master or control clients */
         if (unlikely((flags & DRM_MASTER) &&
@@ -570,7 +582,7 @@ static const struct drm_ioctl_desc drm_ioctls[] = {
         DRM_IOCTL_DEF(DRM_IOCTL_SET_UNIQUE, drm_invalid_op, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY),
         DRM_IOCTL_DEF(DRM_IOCTL_BLOCK, drm_noop, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY),
         DRM_IOCTL_DEF(DRM_IOCTL_UNBLOCK, drm_noop, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY),
-        DRM_IOCTL_DEF(DRM_IOCTL_AUTH_MAGIC, drm_authmagic, DRM_AUTH|DRM_UNLOCKED|DRM_MASTER),
+        DRM_IOCTL_DEF(DRM_IOCTL_AUTH_MAGIC, drm_authmagic, DRM_UNLOCKED|DRM_MASTER),
 
         DRM_IOCTL_DEF(DRM_IOCTL_ADD_MAP, drm_legacy_addmap_ioctl, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY),
         DRM_IOCTL_DEF(DRM_IOCTL_RM_MAP, drm_legacy_rmmap_ioctl, DRM_AUTH),
diff --git a/include/drm/drm_drv.h b/include/drm/drm_drv.h
index ca46a45a9cce..570f9d03b2eb 100644
--- a/include/drm/drm_drv.h
+++ b/include/drm/drm_drv.h
@@ -767,7 +767,7 @@ static inline bool drm_dev_is_unplugged(struct drm_device *dev)
  *
  * Returns true if the @feature is supported, false otherwise.
  */
-static inline bool drm_core_check_feature(struct drm_device *dev, u32 feature)
+static inline bool drm_core_check_feature(const struct drm_device *dev, u32 feature)
 {
         return dev->driver->driver_features & dev->driver_features & feature;
 }