1 files changed, 12 insertions, 4 deletions

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
index 5839fab374bf..7297ca3a0ba7 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
@@ -69,7 +69,8 @@ int amdgpu_gem_object_create(struct amdgpu_device *adev, unsigned long size,
                 }
         }
 retry:
-        r = amdgpu_bo_create(adev, size, alignment, kernel, initial_domain, flags, NULL, &robj);
+        r = amdgpu_bo_create(adev, size, alignment, kernel, initial_domain,
+                             flags, NULL, NULL, &robj);
         if (r) {
                 if (r != -ERESTARTSYS) {
                         if (initial_domain == AMDGPU_GEM_DOMAIN_VRAM) {
@@ -426,6 +427,10 @@ int amdgpu_gem_metadata_ioctl(struct drm_device *dev, void *data,
                                            &args->data.data_size_bytes,
                                            &args->data.flags);
         } else if (args->op == AMDGPU_GEM_METADATA_OP_SET_METADATA) {
+                if (args->data.data_size_bytes > sizeof(args->data.data)) {
+                        r = -EINVAL;
+                        goto unreserve;
+                }
                 r = amdgpu_bo_set_tiling_flags(robj, args->data.tiling_info);
                 if (!r)
                         r = amdgpu_bo_set_metadata(robj, args->data.data,
@@ -433,6 +438,7 @@ int amdgpu_gem_metadata_ioctl(struct drm_device *dev, void *data,
                                                    args->data.flags);
         }
 
+unreserve:
         amdgpu_bo_unreserve(robj);
 out:
         drm_gem_object_unreference_unlocked(gobj);
@@ -454,11 +460,12 @@ static void amdgpu_gem_va_update_vm(struct amdgpu_device *adev,
         struct ttm_validate_buffer tv, *entry;
         struct amdgpu_bo_list_entry *vm_bos;
         struct ww_acquire_ctx ticket;
-        struct list_head list;
+        struct list_head list, duplicates;
         unsigned domain;
         int r;
 
         INIT_LIST_HEAD(&list);
+        INIT_LIST_HEAD(&duplicates);
 
         tv.bo = &bo_va->bo->tbo;
         tv.shared = true;
@@ -468,7 +475,8 @@ static void amdgpu_gem_va_update_vm(struct amdgpu_device *adev,
         if (!vm_bos)
                 return;
 
-        r = ttm_eu_reserve_buffers(&ticket, &list, true, NULL);
+        /* Provide duplicates to avoid -EALREADY */
+        r = ttm_eu_reserve_buffers(&ticket, &list, true, &duplicates);
         if (r)
                 goto error_free;
 
@@ -651,7 +659,7 @@ int amdgpu_mode_dumb_create(struct drm_file *file_priv,
         int r;
 
         args->pitch = amdgpu_align_pitch(adev, args->width, args->bpp, 0) * ((args->bpp + 1) / 8);
-        args->size = args->pitch * args->height;
+        args->size = (u64)args->pitch * args->height;
         args->size = ALIGN(args->size, PAGE_SIZE);
 
         r = amdgpu_gem_object_create(adev, args->size, 0,