Skip to content

Commit d52cdfa

Browse files
ChristianKoenigAMDalexdeucher
authored andcommitted
drm/radeon: more strictly validate the UVD codec
MPEG 2/4 are only supported since UVD3. Signed-off-by: Christian König <christian.koenig@amd.com> CC: stable@vger.kernel.org Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
1 parent a1b403d commit d52cdfa

File tree

1 file changed

+31
-2
lines changed

1 file changed

+31
-2
lines changed

drivers/gpu/drm/radeon/radeon_uvd.c

Lines changed: 31 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -396,6 +396,29 @@ static int radeon_uvd_cs_msg_decode(uint32_t *msg, unsigned buf_sizes[])
396396
return 0;
397397
}
398398

399+
static int radeon_uvd_validate_codec(struct radeon_cs_parser *p,
400+
unsigned stream_type)
401+
{
402+
switch (stream_type) {
403+
case 0: /* H264 */
404+
case 1: /* VC1 */
405+
/* always supported */
406+
return 0;
407+
408+
case 3: /* MPEG2 */
409+
case 4: /* MPEG4 */
410+
/* only since UVD 3 */
411+
if (p->rdev->family >= CHIP_PALM)
412+
return 0;
413+
414+
/* fall through */
415+
default:
416+
DRM_ERROR("UVD codec not supported by hardware %d!\n",
417+
stream_type);
418+
return -EINVAL;
419+
}
420+
}
421+
399422
static int radeon_uvd_cs_msg(struct radeon_cs_parser *p, struct radeon_bo *bo,
400423
unsigned offset, unsigned buf_sizes[])
401424
{
@@ -440,7 +463,11 @@ static int radeon_uvd_cs_msg(struct radeon_cs_parser *p, struct radeon_bo *bo,
440463
case 0:
441464
/* it's a create msg, calc image size (width * height) */
442465
img_size = msg[7] * msg[8];
466+
467+
r = radeon_uvd_validate_codec(p, msg[4]);
443468
radeon_bo_kunmap(bo);
469+
if (r)
470+
return r;
444471

445472
/* try to alloc a new handle */
446473
for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i) {
@@ -460,8 +487,10 @@ static int radeon_uvd_cs_msg(struct radeon_cs_parser *p, struct radeon_bo *bo,
460487
return -EINVAL;
461488

462489
case 1:
463-
/* it's a decode msg, calc buffer sizes */
464-
r = radeon_uvd_cs_msg_decode(msg, buf_sizes);
490+
/* it's a decode msg, validate codec and calc buffer sizes */
491+
r = radeon_uvd_validate_codec(p, msg[4]);
492+
if (!r)
493+
r = radeon_uvd_cs_msg_decode(msg, buf_sizes);
465494
radeon_bo_kunmap(bo);
466495
if (r)
467496
return r;

0 commit comments

Comments
 (0)