drm/amdkfd: Check bounds on allocate_doorbell

allocated_doorbell has an option to set the doorbell id
to a specific value (used by CRIU). This value was not
bounds checked.

Check to confirm it's less than KFD_MAX_NUM_OF_QUEUES_PER_PROCESS.

Signed-off-by: David Francis <David.Francis@amd.com>
Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index 5043b74b56ae1d34d752e59f805dd1987df98915..40517cb8b16403d0163f8ebfba1dae255a42ab4d 100644 (file)
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -612,6 +612,9 @@ static int allocate_doorbell(struct qcm_process_device *qpd,
        } else {
                /* For CP queues on SOC15 */
                if (restore_id) {
+                       if (*restore_id >= KFD_MAX_NUM_OF_QUEUES_PER_PROCESS)
+                               return -EINVAL;
+
                        /* make sure that ID is free  */
                        if (__test_and_set_bit(*restore_id, qpd->doorbell_bitmap))
                                return -EINVAL;