Re: [PATCH v3 2/2] drm/sched/tests: add a UAF regression test for the timeline name

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Test abortion on `KUNIT_ASSERT_TRUE` failure skips manual cleanup, causing Use-After-Free crashes from background tasks.
--

commit a2c80bbffa3f457ad719c5864b695730ec7e1976
Author: Jonghyuk Kim(MalHyuk) <malhyuk97@gmail.com>

drm/sched/tests: add a UAF regression test for the timeline name

This commit adds an integration KUnit test to reproduce a use-after-free
in the drm_sched_fence timeline-name. It exercises the interaction between
the DRM scheduler and the dma-fence API by submitting a job, freeing the
scheduler, and querying the timeline name.

> diff --git a/drivers/gpu/drm/scheduler/tests/tests_integration.c b/drivers/gpu/drm/scheduler/tests/tests_integration.c
> new file mode 100644
> index 0000000000000..5e1ca6c6fa5a2
> --- /dev/null
> +++ b/drivers/gpu/drm/scheduler/tests/tests_integration.c
[ ... ]
> +static void drm_sched_dma_fence_uaf(struct kunit *test)
> +{
[ ... ]
> +	/* Let the job get scheduled (hw fence created), then signal + finish. */
> +	done = drm_mock_sched_job_wait_scheduled(job, HZ);
> +	KUNIT_ASSERT_TRUE(test, done);

[Severity: Medium]
If this assertion fails, the test aborts and skips manual cleanup like
drm_mock_sched_fini(). Because KUnit automatically frees memory allocated with
kunit_kzalloc() upon test abortion, active background tasks such as DRM
scheduler workqueues and job hrtimers will access freed memory.

Does this cause a use-after-free crash if the wait times out and returns false?

> +	drm_mock_sched_advance(sched, 1);
> +	done = drm_mock_sched_job_wait_finished(job, HZ);
> +	KUNIT_ASSERT_TRUE(test, done);

[Severity: Medium]
Similarly, can a failure on this assertion cause a use-after-free by aborting
the test before the cleanup code runs?

> +
> +	/*
> +	 * Free the per-context scheduler while the finished fence is held.
> +	 * kunit_kfree() releases the backing memory immediately (rather than at
> +	 * test teardown) so that fence->sched becomes a dangling pointer now.
> +	 */
> +	drm_mock_sched_entity_free(entity);
> +	drm_mock_sched_fini(sched);
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902144204.1843670-1-malhyuk97@gmail.com?part=2