Re: [PATCH 2/3] drm/vc4: Reset the binner overflow allocator on GPU reset

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Blindly freeing `vc4->bin_alloc_overflow` during GPU reset causes a Use-After-Free for queued render jobs that still depend on the binner overflow memory.
--

--- Patch [2]: [PATCH 2/3] drm/vc4: Reset the binner overflow allocator on GPU reset ---
commit 74342beb01de4148c8046f07cd05468691648692
Author: Maíra Canal <mcanal@igalia.com>

drm/vc4: Reset the binner overflow allocator on GPU reset

This commit resets the binner overflow allocator during a GPU reset to
prevent leaking overflow slots. It frees the pending overflow slot and
clears the hardware overflow registers so the re-queued bin job starts
from a clean state.

> diff --git a/drivers/gpu/drm/vc4/vc4_irq.c b/drivers/gpu/drm/vc4/vc4_irq.c
> index 7877d493d80e6..9fac1b39e8b98 100644
> --- a/drivers/gpu/drm/vc4/vc4_irq.c
> +++ b/drivers/gpu/drm/vc4/vc4_irq.c

[ ... ]

> @@ -344,6 +344,18 @@ void vc4_irq_reset(struct drm_device *dev)
>  	V3D_WRITE(V3D_INTENA, V3D_DRIVER_IRQS);
>  
>  	spin_lock_irqsave(&vc4->job_lock, irqflags);
> +
> +	/*
> +	 * The reset wiped the binner's hardware state, and the job that may
> +	 * have been reading overflow memory is torn down just below. Free the
> +	 * current overflow slot and clear the overflow registers so the
> +	 * re-queued BIN job restarts from a clean OOM state.
> +	 */
> +	vc4->bin_alloc_used &= ~vc4->bin_alloc_overflow;
> +	vc4->bin_alloc_overflow = 0;

[Severity: High]
Does clearing the overflow slot here create a use-after-free for render jobs
that have already completed binning and are waiting in the render queue?

If we have the following sequence:
1. Job A is executing on the render thread.
2. Job B finishes binning, using an overflow slot (tracked in
   vc4->bin_alloc_overflow), and is placed in the render queue.
3. Job C starts binning, hangs, and triggers a GPU reset.

When vc4_irq_reset() runs, it frees the overflow slot used by Job B. Then
vc4_irq_finish_render_job() completes the active render job (Job A) and
submits Job B to the hardware.

Since Job B's overflow memory was just freed, could a subsequent binning job
encounter an out-of-memory condition, allocate this exact same slot, and
overwrite it while Job B is actively reading from it?

> +	V3D_WRITE(V3D_BPOA, 0);
> +	V3D_WRITE(V3D_BPOS, 0);
> +
>  	vc4_cancel_bin_job(dev);
>  	vc4_irq_finish_render_job(dev);
>  	spin_unlock_irqrestore(&vc4->job_lock, irqflags);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260718-vc4-bin-oom-fixes-v1-0-8cba09558c33@igalia.com?part=2