[PATCH v2 0/2] drm/sched: fix use-after-free of the fence timeline name

[Jonghyuk Kim(MalHyuk)]

drm_sched_fence_get_timeline_name() dereferences fence->sched, but a
per-context/per-queue/per-VM scheduler can be freed on an unprivileged
context/fd close while userspace still holds the exported ->finished fence
(sync_file / drm_syncobj). A later SYNC_IOC_FILE_INFO then reads the freed
scheduler:

  BUG: KASAN: slab-use-after-free in drm_sched_fence_get_timeline_name

This is the same class as CVE-2025-38703 (drm/xe) and CVE-2025-71302
(drm/panthor), which were fixed per-driver. amdxdna, nouveau and msm
(VM_BIND) are still affected in mainline, so patch 1 fixes it in the core for
any per-context-scheduler driver at once.

Patch 1 caches the scheduler name pointer in the fence at init time and
returns it from get_timeline_name() without touching fence->sched, plus
documents in struct drm_sched_init_args that the name must outlive any
exported fence. Patch 2 is a KUnit reproducer exercising the mock scheduler
under KASAN (no hardware needed).

v1 -> v2:
 - Keep caching the name pointer and document the lifetime rule, rather than
   kstrdup()-ing per fence, to avoid an allocation on the submit path for a
   debug-only value (Tvrtko).
 - Reworked the test to query through the public dma_fence_timeline_name()
   API and moved it to a new tests_integration.c so tests_basic.c stays
   focused on core scheduler behaviour (Tvrtko).

Tested with the patch 2 KUnit test under KASAN (kunit.py --arch=x86_64):
  - with patch 1:    [PASSED] drm-sched-dma-fence-uaf
  - without patch 1: [FAILED] - BUG: KASAN: slab-use-after-free in
    drm_sched_fence_get_timeline_name+0x9c/0xb0 (read of the freed scheduler)

As discussed, the cleaner long-term fix is to drop drm_sched_fence's
ops->release so dma_fence detaches ->ops on signal and decouples the name
itself (Philipp); that is a larger sched_fence rework and is left as a
follow-up, with this cached-name fix as the immediate, backportable one.

Jonghyuk Kim(MalHyuk) (2):
  drm/sched: cache the timeline name to fix a use-after-free
  drm/sched/tests: add a UAF regression test for the timeline name

 drivers/gpu/drm/scheduler/sched_fence.c       | 16 +++-
 drivers/gpu/drm/scheduler/tests/Makefile      |  1 +
 .../drm/scheduler/tests/tests_integration.c   | 83 +++++++++++++++++++
 include/drm/gpu_scheduler.h                   | 18 +++-
 4 files changed, 116 insertions(+), 2 deletions(-)
 create mode 100644 drivers/gpu/drm/scheduler/tests/tests_integration.c

--
2.43.0