From: Shixiong Ou <oushixiong@kylinos.cn>

The DRM scheduler KUnit tests pass NULL for the dev field in
drm_sched_init_args, which NULL-pointer dereferences in the drm_sched_job
trace event via dev_name() on sched->dev.

Give the mock scheduler a device with kunit_device_register(), which is
also cleaned up at test exit. A per-function counter keeps the device
names unique, since some tests create several mock schedulers.

Fixes: 5a99350794fe ("drm/sched: Add scheduler unit testing infrastructure and some basic tests")
Cc: stable@vger.kernel.org
Signed-off-by: Shixiong Ou <oushixiong@kylinos.cn>

---
v1->v2:
  - Switch from faux_device_create() to kunit_device_register(), which also
    cleans the device up automatically at test exit (Maxime Ripard)
  - Build the device name on top of args.name (Philipp Stanner)
  - Make the instance counter a static unsigned int local to
    drm_mock_sched_new() (Philipp Stanner)
  - Add a Fixes: tag and Cc: stable for the NULL dev dereference

 drivers/gpu/drm/scheduler/tests/mock_scheduler.c | 11 ++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/gpu/drm/scheduler/tests/mock_scheduler.c b/drivers/gpu/drm/scheduler/tests/mock_scheduler.c
index 8e9ae7d980eb..12dc61f56192 100644
--- a/drivers/gpu/drm/scheduler/tests/mock_scheduler.c
+++ b/drivers/gpu/drm/scheduler/tests/mock_scheduler.c
@@ -1,6 +1,8 @@
 // SPDX-License-Identifier: GPL-2.0
 /* Copyright (c) 2025 Valve Corporation */
 
+#include <kunit/device.h>
+
 #include "sched_tests.h"
 
 /*
@@ -288,6 +290,7 @@ static const struct drm_sched_backend_ops drm_mock_scheduler_ops = {
  */
 struct drm_mock_scheduler *drm_mock_sched_new(struct kunit *test, long timeout)
 {
+	static unsigned int instance;
 	struct drm_sched_init_args args = {
 		.ops		= &drm_mock_scheduler_ops,
 		.num_rqs	= DRM_SCHED_PRIORITY_COUNT,
@@ -297,11 +300,19 @@ struct drm_mock_scheduler *drm_mock_sched_new(struct kunit *test, long timeout)
 		.name		= "drm-mock-scheduler",
 	};
 	struct drm_mock_scheduler *sched;
+	struct device *dev;
+	char name[64];
 	int ret;
 
 	sched = kunit_kzalloc(test, sizeof(*sched), GFP_KERNEL);
 	KUNIT_ASSERT_NOT_NULL(test, sched);
 
+	snprintf(name, sizeof(name), "%s-%u", args.name, ++instance);
+	dev = kunit_device_register(test, name);
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, dev);
+
+	args.dev = dev;
+
 	ret = drm_sched_init(&sched->base, &args);
 	KUNIT_ASSERT_EQ(test, ret, 0);
 
-- 
2.43.0

No virus found
		Checked by Hillstone Network AntiVirus

On Thu, 2026-09-03 at 20:15 +0800, oushixiong1025@163.com wrote:
> 

[…]

> +
>  #include "sched_tests.h"
>  
>  /*
> @@ -288,6 +290,7 @@ static const struct drm_sched_backend_ops drm_mock_scheduler_ops = {
>   */
>  struct drm_mock_scheduler *drm_mock_sched_new(struct kunit *test, long timeout)
>  {
> +	static unsigned int instance;

I know statics are initialized to 0 automatically, but writing it out
explicitly is probably advantageous for readability, especially since
we're incrementing.

>  	struct drm_sched_init_args args = {
>  		.ops		= &drm_mock_scheduler_ops,
>  		.num_rqs	= DRM_SCHED_PRIORITY_COUNT,
> @@ -297,11 +300,19 @@ struct drm_mock_scheduler *drm_mock_sched_new(struct kunit *test, long timeout)
>  		.name		= "drm-mock-scheduler",
>  	};
>  	struct drm_mock_scheduler *sched;
> +	struct device *dev;
> +	char name[64];
>  	int ret;
>  
>  	sched = kunit_kzalloc(test, sizeof(*sched), GFP_KERNEL);
>  	KUNIT_ASSERT_NOT_NULL(test, sched);
>  
> +	snprintf(name, sizeof(name), "%s-%u", args.name, ++instance);

Any particular reason why you begin with index 1?

Hi,

First of all, thanks for the review and the suggestions.
I had already sent v3 by the time your full comments came in -- here is
the v3 patch for reference:  https://lkml.org/lkml/2026/9/4/547

Both points will be addressed in v4 later.


On 2026/9/4 15:02, Philipp Stanner wrote:
> On Thu, 2026-09-03 at 20:15 +0800, oushixiong1025@163.com wrote:
> […]
>
>> +
>>   #include "sched_tests.h"
>>   
>>   /*
>> @@ -288,6 +290,7 @@ static const struct drm_sched_backend_ops drm_mock_scheduler_ops = {
>>    */
>>   struct drm_mock_scheduler *drm_mock_sched_new(struct kunit *test, long timeout)
>>   {
>> +	static unsigned int instance;
> I know statics are initialized to 0 automatically, but writing it out
> explicitly is probably advantageous for readability, especially since
> we're incrementing.

One note: this trips checkpatch's "do not initialise statics to 0"
error, so I followed your suggestion over the checkpatch rule.


>>   	struct drm_sched_init_args args = {
>>   		.ops		= &drm_mock_scheduler_ops,
>>   		.num_rqs	= DRM_SCHED_PRIORITY_COUNT,
>> @@ -297,11 +300,19 @@ struct drm_mock_scheduler *drm_mock_sched_new(struct kunit *test, long timeout)
>>   		.name		= "drm-mock-scheduler",
>>   	};
>>   	struct drm_mock_scheduler *sched;
>> +	struct device *dev;
>> +	char name[64];
>>   	int ret;
>>   
>>   	sched = kunit_kzalloc(test, sizeof(*sched), GFP_KERNEL);
>>   	KUNIT_ASSERT_NOT_NULL(test, sched);
>>   
>> +	snprintf(name, sizeof(name), "%s-%u", args.name, ++instance);
> Any particular reason why you begin with index 1?

No particular reason -- switched to instance++ so the numbering
starts at 0.

The updated v4 patch will be send later.
Thanks again for your time and for catching these points.

Best regards,
Shixiong Ou

On Thu, 3 Sep 2026 20:15:58 +0800, oushixiong1025@163.com wrote:
> From: Shixiong Ou <oushixiong@kylinos.cn>
> 
> The DRM scheduler KUnit tests pass NULL for the dev field in
> drm_sched_init_args, which NULL-pointer dereferences in the drm_sched_job
> trace event via dev_name() on sched->dev.
> 
> [ ... ]

Acked-by: Maxime Ripard <mripard@kernel.org>

Thanks!
Maxime