1 files changed, 47 insertions, 33 deletions

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
index 2cf6c6b06e3b..d0312364d950 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
@@ -156,7 +156,7 @@ int amdgpu_uvd_sw_init(struct amdgpu_device *adev)
         r = amdgpu_bo_create(adev, bo_size, PAGE_SIZE, true,
                              AMDGPU_GEM_DOMAIN_VRAM,
                              AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED,
-                             NULL, &adev->uvd.vcpu_bo);
+                             NULL, NULL, &adev->uvd.vcpu_bo);
         if (r) {
                 dev_err(adev->dev, "(%d) failed to allocate UVD bo\n", r);
                 return r;
@@ -543,46 +543,60 @@ static int amdgpu_uvd_cs_msg(struct amdgpu_uvd_cs_ctx *ctx,
                 return -EINVAL;
         }
 
-        if (msg_type == 1) {
+        switch (msg_type) {
+        case 0:
+                /* it's a create msg, calc image size (width * height) */
+                amdgpu_bo_kunmap(bo);
+
+                /* try to alloc a new handle */
+                for (i = 0; i < AMDGPU_MAX_UVD_HANDLES; ++i) {
+                        if (atomic_read(&adev->uvd.handles[i]) == handle) {
+                                DRM_ERROR("Handle 0x%x already in use!\n", handle);
+                                return -EINVAL;
+                        }
+
+                        if (!atomic_cmpxchg(&adev->uvd.handles[i], 0, handle)) {
+                                adev->uvd.filp[i] = ctx->parser->filp;
+                                return 0;
+                        }
+                }
+
+                DRM_ERROR("No more free UVD handles!\n");
+                return -EINVAL;
+
+        case 1:
                 /* it's a decode msg, calc buffer sizes */
                 r = amdgpu_uvd_cs_msg_decode(msg, ctx->buf_sizes);
                 amdgpu_bo_kunmap(bo);
                 if (r)
                         return r;
 
-        } else if (msg_type == 2) {
+                /* validate the handle */
+                for (i = 0; i < AMDGPU_MAX_UVD_HANDLES; ++i) {
+                        if (atomic_read(&adev->uvd.handles[i]) == handle) {
+                                if (adev->uvd.filp[i] != ctx->parser->filp) {
+                                        DRM_ERROR("UVD handle collision detected!\n");
+                                        return -EINVAL;
+                                }
+                                return 0;
+                        }
+                }
+
+                DRM_ERROR("Invalid UVD handle 0x%x!\n", handle);
+                return -ENOENT;
+
+        case 2:
                 /* it's a destroy msg, free the handle */
                 for (i = 0; i < AMDGPU_MAX_UVD_HANDLES; ++i)
                         atomic_cmpxchg(&adev->uvd.handles[i], handle, 0);
                 amdgpu_bo_kunmap(bo);
                 return 0;
-        } else {
-                /* it's a create msg */
-                amdgpu_bo_kunmap(bo);
-
-                if (msg_type != 0) {
-                        DRM_ERROR("Illegal UVD message type (%d)!\n", msg_type);
-                        return -EINVAL;
-                }
-
-                /* it's a create msg, no special handling needed */
-        }
-
-        /* create or decode, validate the handle */
-        for (i = 0; i < AMDGPU_MAX_UVD_HANDLES; ++i) {
-                if (atomic_read(&adev->uvd.handles[i]) == handle)
-                        return 0;
-        }
 
-        /* handle not found try to alloc a new one */
-        for (i = 0; i < AMDGPU_MAX_UVD_HANDLES; ++i) {
-                if (!atomic_cmpxchg(&adev->uvd.handles[i], 0, handle)) {
-                        adev->uvd.filp[i] = ctx->parser->filp;
-                        return 0;
-                }
+        default:
+                DRM_ERROR("Illegal UVD message type (%d)!\n", msg_type);
+                return -EINVAL;
         }
-
-        DRM_ERROR("No more free UVD handles!\n");
+        BUG();
         return -EINVAL;
 }
 
@@ -805,10 +819,10 @@ int amdgpu_uvd_ring_parse_cs(struct amdgpu_cs_parser *parser, uint32_t ib_idx)
 }
 
 static int amdgpu_uvd_free_job(
-        struct amdgpu_job *sched_job)
+        struct amdgpu_job *job)
 {
-        amdgpu_ib_free(sched_job->adev, sched_job->ibs);
-        kfree(sched_job->ibs);
+        amdgpu_ib_free(job->adev, job->ibs);
+        kfree(job->ibs);
         return 0;
 }
 
@@ -905,7 +919,7 @@ int amdgpu_uvd_get_create_msg(struct amdgpu_ring *ring, uint32_t handle,
         r = amdgpu_bo_create(adev, 1024, PAGE_SIZE, true,
                              AMDGPU_GEM_DOMAIN_VRAM,
                              AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED,
-                             NULL, &bo);
+                             NULL, NULL, &bo);
         if (r)
                 return r;
 
@@ -954,7 +968,7 @@ int amdgpu_uvd_get_destroy_msg(struct amdgpu_ring *ring, uint32_t handle,
         r = amdgpu_bo_create(adev, 1024, PAGE_SIZE, true,
                              AMDGPU_GEM_DOMAIN_VRAM,
                              AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED,
-                             NULL, &bo);
+                             NULL, NULL, &bo);
         if (r)
                 return r;