Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Medium] Test aborts skip scheduler cleanup leading to use-after-free crash in workqueue. --
commit a5abd99d79c0acda1fdefe1fe2690846be11bd71 Author: Jonghyuk Kim(MalHyuk) <[email protected]> drm/sched/tests: add a UAF regression test for the timeline name This commit adds a KUnit integration test to reproduce a use-after-free bug in drm_sched_fence_get_timeline_name(). It tests the scenario where a scheduler is freed while userspace still holds a reference to a finished fence, querying the timeline name via the dma-fence API. > diff --git a/drivers/gpu/drm/scheduler/tests/tests_integration.c > b/drivers/gpu/drm/scheduler/tests/tests_integration.c > new file mode 100644 > index 0000000000000..0572f1e3a80b2 > --- /dev/null > +++ b/drivers/gpu/drm/scheduler/tests/tests_integration.c [ ... ] > + /* Independent reference on the finished fence, as a sync_file would. */ > + finished = dma_fence_get(&job->base.s_fence->finished); > + > + done = drm_mock_sched_job_wait_scheduled(job, HZ); > + KUNIT_ASSERT_TRUE(test, done); [Severity: Medium] If this assertion fails, the test aborts immediately, skipping the explicit drm_mock_sched_fini() and drm_mock_sched_entity_free() cleanup calls at the end of the function. Since the sched object is allocated with kunit_kzalloc(), the KUnit framework will automatically free its memory on test abort. However, without calling drm_mock_sched_fini(), the sched->submit_wq workqueue and sched->work_tdr delayed work will remain active. Could this cause a kernel panic due to a use-after-free when the active workqueue tries to execute a work struct from the freed scheduler memory? > + drm_mock_sched_advance(sched, 1); > + done = drm_mock_sched_job_wait_finished(job, HZ); > + KUNIT_ASSERT_TRUE(test, done); [Severity: Medium] Similarly, failing here aborts the test while leaving active workqueues referencing the soon-to-be-freed scheduler. Would it be safer to use KUNIT_EXPECT_TRUE() instead to allow the test to continue to the cleanup phase, or use kunit_add_action() to ensure the scheduler is always properly torn down? > + > + /* Free the per-context scheduler while the finished fence is held. */ > + drm_mock_sched_entity_free(entity); -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=2
