[PATCH v1 0/2] drm/sched: fix a use-after-free in get_timeline_name()

["Jonghyuk Kim(MalHyuk)" <malhyuk97@gmail.com>]

This fixes an unprivileged use-after-free (read) in the DRM GPU scheduler
core, present in current mainline (v7.2-rc5) and reachable through at least
three in-tree drivers: amdxdna, nouveau and msm (VM_BIND).

drm_sched_fence_get_timeline_name() dereferences fence->sched->name, and
the fence is not ops-detached on signalling (the ops carry a .release
callback), so a userspace-held finished fence can outlive a per-context
drm_gpu_scheduler that a driver frees on context/fd teardown.
get_timeline_name() is reachable unprivileged via SYNC_IOC_FILE_INFO on an
exported sync_file, so this is a deterministic UAF read of the freed
scheduler - a bounded arbitrary kernel read once the slab is reclaimed
(there is no write primitive on this path).

It's the same bug class as CVE-2025-38703 (drm/xe) and CVE-2025-71302
(drm/panthor), which were fixed per-driver; the drivers above never got
the equivalent fix. Patch 1 fixes it in the core (cache the persistent
timeline-name pointer at fence init) so any per-context-scheduler driver is
covered. Patch 2 adds a KUnit regression test on the existing drm_sched
mock harness that catches the UAF under KASAN with no hardware.

Since the bug class is already public (the xe/panthor CVEs), I'm sending
this to the list directly rather than through the security process. It
looks like a candidate for stable backport.

The KUnit test was run with:

    ./tools/testing/kunit/kunit.py run --arch=x86_64 \
        --kunitconfig=<KUNIT + KASAN + DRM_SCHED_KUNIT_TEST> \
        'drm_sched_fence_uaf_tests*'

- without patch 1: KASAN slab-use-after-free in
  drm_sched_fence_get_timeline_name
- with patch 1: test passes, no KASAN report

Jonghyuk Kim(MalHyuk) (2):
  drm/sched: cache the timeline name to fix a use-after-free
  drm/sched/tests: add a UAF regression test for get_timeline_name()

 drivers/gpu/drm/scheduler/sched_fence.c       | 16 ++++-
 drivers/gpu/drm/scheduler/tests/tests_basic.c | 65 ++++++++++++++++++-
 include/drm/gpu_scheduler.h                   | 11 ++++
 3 files changed, 90 insertions(+), 2 deletions(-)

-- 
2.43.0