[PATCH v3] drm/sched: Create a fake device for KUnit tests

[PATCH v3] drm/sched: Create a fake device for KUnit tests

[oushixiong1025]

From: Shixiong Ou <oushixiong@kylinos.cn>

The DRM scheduler KUnit tests pass NULL for the dev field in
drm_sched_init_args, which NULL-pointer dereferences in the drm_sched_job
trace event via dev_name() on sched->dev.

Give the mock scheduler a device with kunit_device_register(), which is
also cleaned up at test exit. A per-function counter keeps the device
names unique, since some tests create several mock schedulers.

Fixes: 5a99350794fe ("drm/sched: Add scheduler unit testing infrastructure and some basic tests")
Cc: stable@vger.kernel.org
Signed-off-by: Shixiong Ou <oushixiong@kylinos.cn>
Acked-by: Maxime Ripard <mripard@kernel.org>

---
v2->v3:
  - Start the mock scheduler device numbering at 0, using
    instance++ instead of ++instance

v1->v2:
  - Switch from faux_device_create() to kunit_device_register(), which also
    cleans the device up automatically at test exit (Maxime Ripard)
  - Build the device name on top of args.name (Philipp Stanner)
  - Make the instance counter a static unsigned int local to
    drm_mock_sched_new() (Philipp Stanner)
  - Add a Fixes: tag and Cc: stable for the NULL dev dereference

 drivers/gpu/drm/scheduler/tests/mock_scheduler.c | 11 ++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/gpu/drm/scheduler/tests/mock_scheduler.c b/drivers/gpu/drm/scheduler/tests/mock_scheduler.c
index 8e9ae7d980eb..12dc61f56192 100644
--- a/drivers/gpu/drm/scheduler/tests/mock_scheduler.c
+++ b/drivers/gpu/drm/scheduler/tests/mock_scheduler.c
@@ -1,6 +1,8 @@
 // SPDX-License-Identifier: GPL-2.0
 /* Copyright (c) 2025 Valve Corporation */
 
+#include <kunit/device.h>
+
 #include "sched_tests.h"
 
 /*
@@ -288,6 +290,7 @@ static const struct drm_sched_backend_ops drm_mock_scheduler_ops = {
  */
 struct drm_mock_scheduler *drm_mock_sched_new(struct kunit *test, long timeout)
 {
+	static unsigned int instance;
 	struct drm_sched_init_args args = {
 		.ops		= &drm_mock_scheduler_ops,
 		.num_rqs	= DRM_SCHED_PRIORITY_COUNT,
@@ -297,11 +300,19 @@ struct drm_mock_scheduler *drm_mock_sched_new(struct kunit *test, long timeout)
 		.name		= "drm-mock-scheduler",
 	};
 	struct drm_mock_scheduler *sched;
+	struct device *dev;
+	char name[64];
 	int ret;
 
 	sched = kunit_kzalloc(test, sizeof(*sched), GFP_KERNEL);
 	KUNIT_ASSERT_NOT_NULL(test, sched);
 
+	snprintf(name, sizeof(name), "%s-%u", args.name, instance++);
+	dev = kunit_device_register(test, name);
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, dev);
+
+	args.dev = dev;
+
 	ret = drm_sched_init(&sched->base, &args);
 	KUNIT_ASSERT_EQ(test, ret, 0);
 
-- 
2.43.0

No virus found
		Checked by Hillstone Network AntiVirus

Re: [PATCH v3] drm/sched: Create a fake device for KUnit tests

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [High] Newly added mock device is freed on test abort while scheduler workqueues are still running.

Pre-existing issues:
- [High] NULL pointer dereference in test suite exit functions if drm_mock_sched_new() aborts during initialization.
--

commit 87ec4ea74ea7485f78bc8e603289f73cd4461eb5
Author: Shixiong Ou <oushixiong@kylinos.cn>

drm/sched: Create a fake device for KUnit tests

This commit creates a dummy device using kunit_device_register() for the
mock scheduler in KUnit tests. This prevents a NULL pointer dereference
in the drm_sched_job trace event which relies on sched->dev.

> diff --git a/drivers/gpu/drm/scheduler/tests/mock_scheduler.c b/drivers/gpu/drm/scheduler/tests/mock_scheduler.c
> index 8e9ae7d980eb2..2dfa3efef2100 100644
> --- a/drivers/gpu/drm/scheduler/tests/mock_scheduler.c
> +++ b/drivers/gpu/drm/scheduler/tests/mock_scheduler.c
[ ... ]
> @@ -297,11 +300,19 @@ struct drm_mock_scheduler *drm_mock_sched_new(struct kunit *test, long timeout)
>  		.name		= "drm-mock-scheduler",
>  	};
>  	struct drm_mock_scheduler *sched;
> +	struct device *dev;
> +	char name[64];
>  	int ret;
>  
>  	sched = kunit_kzalloc(test, sizeof(*sched), GFP_KERNEL);
>  	KUNIT_ASSERT_NOT_NULL(test, sched);
>  
> +	snprintf(name, sizeof(name), "%s-%u", args.name, instance++);
> +	dev = kunit_device_register(test, name);
> +	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, dev);

[Severity: High]
This is a pre-existing issue, but does this assertion expose a crash in
the test suite's exit functions?

If kunit_device_register() fails in drm_mock_sched_new(), the
KUNIT_ASSERT_NOT_ERR_OR_NULL macro aborts the initialization sequence.
Control returns to the KUnit framework without test->priv being initialized.

When the framework subsequently runs the suite's exit function
(drm_sched_basic_exit()), it extracts test->priv and passes it to
drm_mock_sched_fini(), which unconditionally dereferences the NULL pointer.

Could this lead to a kernel panic during test failure rather than cleanly
reporting the error?

> +
> +	args.dev = dev;
> +
>  	ret = drm_sched_init(&sched->base, &args);
>  	KUNIT_ASSERT_EQ(test, ret, 0);

[Severity: High]
Could tying the mock device to the KUnit test lifecycle cause a
use-after-free if the test aborts?

The device allocated with kunit_device_register() is automatically freed
when the KUnit test thread exits. However, drm_sched_init() spawns
background tasks (scheduler workqueues) that hold references to this
device.

If a subsequent test assertion fails (e.g., KUNIT_ASSERT_FALSE in
drm_sched_test_credits()), the test aborts, skipping the manual
drm_mock_sched_fini() cleanup. KUnit will automatically free the mock
device, but the background tasks remain active and may attempt to access
the freed device memory.

Should the scheduler cleanup be registered as a deferred KUnit action to
ensure the workqueues are stopped before the device is freed?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260904072149.436181-1-oushixiong1025@163.com?part=1