Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Medium] Test abortion on `KUNIT_ASSERT_TRUE` failure skips manual cleanup, causing Use-After-Free crashes from background tasks. --
commit a2c80bbffa3f457ad719c5864b695730ec7e1976 Author: Jonghyuk Kim(MalHyuk) <[email protected]> drm/sched/tests: add a UAF regression test for the timeline name This commit adds an integration KUnit test to reproduce a use-after-free in the drm_sched_fence timeline-name. It exercises the interaction between the DRM scheduler and the dma-fence API by submitting a job, freeing the scheduler, and querying the timeline name. > diff --git a/drivers/gpu/drm/scheduler/tests/tests_integration.c > b/drivers/gpu/drm/scheduler/tests/tests_integration.c > new file mode 100644 > index 0000000000000..5e1ca6c6fa5a2 > --- /dev/null > +++ b/drivers/gpu/drm/scheduler/tests/tests_integration.c [ ... ] > +static void drm_sched_dma_fence_uaf(struct kunit *test) > +{ [ ... ] > + /* Let the job get scheduled (hw fence created), then signal + finish. > */ > + done = drm_mock_sched_job_wait_scheduled(job, HZ); > + KUNIT_ASSERT_TRUE(test, done); [Severity: Medium] If this assertion fails, the test aborts and skips manual cleanup like drm_mock_sched_fini(). Because KUnit automatically frees memory allocated with kunit_kzalloc() upon test abortion, active background tasks such as DRM scheduler workqueues and job hrtimers will access freed memory. Does this cause a use-after-free crash if the wait times out and returns false? > + drm_mock_sched_advance(sched, 1); > + done = drm_mock_sched_job_wait_finished(job, HZ); > + KUNIT_ASSERT_TRUE(test, done); [Severity: Medium] Similarly, can a failure on this assertion cause a use-after-free by aborting the test before the cleanup code runs? > + > + /* > + * Free the per-context scheduler while the finished fence is held. > + * kunit_kfree() releases the backing memory immediately (rather than at > + * test teardown) so that fence->sched becomes a dangling pointer now. > + */ > + drm_mock_sched_entity_free(entity); > + drm_mock_sched_fini(sched); [ ... ] -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=2
