Re: [PATCH v2 13/13] drm/panic: Compile KUnit tests as module

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Dangling pointer in panic_msg array causes use-after-free during kernel panic after the test module is unloaded.
--

--- Patch [13]: [PATCH v2 13/13] drm/panic: Compile KUnit tests as module ---

commit 9a00d4c3f17fad5dbc6e3335649c2316482a4fad
Author: Thomas Zimmermann [off-list ref]
Subject: drm/panic: Compile KUnit tests as module
    
Fix dependency of the panic-helper KUnit tests on CONFIG_DRM_KUNIT_TEST=y
and make them build as a module. Export the necessary interfaces from the
panic helpers iff the KUnit framework has been enabled.

[ ... ]

-static void drm_panic_helper_set_description(const char *description)
+VISIBLE_IF_KUNIT void drm_panic_helper_set_description(const char *description)
 {
 	u32 len;
 
 	if (description) {
 		struct drm_panic_line *desc_line = &panic_msg[panic_msg_lines - 1];
 
 		desc_line->txt = description;
 		len = strlen(description);
 		/* ignore the last newline character */
 		if (len && description[len - 1] == '\n')
 			len -= 1;
 		desc_line->len = len;
 	}
 }
+EXPORT_SYMBOL_IF_KUNIT(drm_panic_helper_set_description);

[Severity: High]
This is a pre-existing issue, but since the test can now be built as a module,
does unloading it leave a dangling pointer in the global panic_msg array?

In drivers/gpu/drm/tests/drm_panic_helper_test.c, drm_test_panic_init()
calls drm_panic_helper_set_description("Kunit testing"), which stores a
pointer to the test module's .rodata.

When the drm_panic_helper_test module is unloaded, this memory is freed. Since
the test suite lacks an .exit callback to call
drm_panic_helper_clear_description(), the dangling pointer remains in the
global array.

If a real kernel panic occurs later where detail->description is NULL (such as
via kmsg_dump(KMSG_DUMP_PANIC) on some architectures), this function silently
ignores the NULL input and leaves the dangling pointer intact.

Will this cause a use-after-free read when the panic screen rendering
dereferences desc_line->txt, potentially preventing the panic screen from
displaying during an actual crash?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260824125201.218863-1-tzimmermann@suse.de?part=13