Re: [PATCH v2 13/13] drm/panic: Compile KUnit tests as module

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Dangling pointer in panic_msg array causes use-after-free during kernel panic after the test module is unloaded.
--

--- Patch [13]: [PATCH v2 13/13] drm/panic: Compile KUnit tests as module ---
commit 9a00d4c3f17fad5dbc6e3335649c2316482a4fad
Author: Thomas Zimmermann <tzimmermann@suse.de>
Subject: drm/panic: Compile KUnit tests as module
    
Fix dependency of the panic-helper KUnit tests on CONFIG_DRM_KUNIT_TEST=y
and make them build as a module. Export the necessary interfaces from the
panic helpers iff the KUnit framework has been enabled.

> diff --git a/drivers/gpu/drm/drm_panic_helper.c b/drivers/gpu/drm/drm_panic_helper.c
> index 669f09225f8ed..253262b7e0d4c 100644
> --- a/drivers/gpu/drm/drm_panic_helper.c
> +++ b/drivers/gpu/drm/drm_panic_helper.c

[ ... ]

> -static void drm_panic_helper_set_description(const char *description)
> +VISIBLE_IF_KUNIT void drm_panic_helper_set_description(const char *description)
>  {
>  	u32 len;
>  
>  	if (description) {
>  		struct drm_panic_line *desc_line = &panic_msg[panic_msg_lines - 1];
>  
>  		desc_line->txt = description;
>  		len = strlen(description);
>  		/* ignore the last newline character */
>  		if (len && description[len - 1] == '\n')
>  			len -= 1;
>  		desc_line->len = len;
>  	}
>  }
> +EXPORT_SYMBOL_IF_KUNIT(drm_panic_helper_set_description);

[Severity: High]
This is a pre-existing issue, but since the test can now be built as a module,
does unloading it leave a dangling pointer in the global panic_msg array?

In drivers/gpu/drm/tests/drm_panic_helper_test.c, drm_test_panic_init()
calls drm_panic_helper_set_description("Kunit testing"), which stores a
pointer to the test module's .rodata.

When the drm_panic_helper_test module is unloaded, this memory is freed. Since
the test suite lacks an .exit callback to call
drm_panic_helper_clear_description(), the dangling pointer remains in the
global array.

If a real kernel panic occurs later where detail->description is NULL (such as
via kmsg_dump(KMSG_DUMP_PANIC) on some architectures), this function silently
ignores the NULL input and leaves the dangling pointer intact.

Will this cause a use-after-free read when the panic screen rendering
dereferences desc_line->txt, potentially preventing the panic screen from
displaying during an actual crash?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260824125201.218863-1-tzimmermann@suse.de?part=13