drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id

allocate_sdma_queue has an option where the sdma queue id can be
specified (used by CRIU). We weren't bounds-checking that
value.

Confirm it's less than the maximum number of queues.

Signed-off-by: David Francis <David.Francis@amd.com>
Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index 40517cb8b16403d0163f8ebfba1dae255a42ab4d..5cba592ba941b23b3fc5f98737c6906f5135154b 100644 (file)
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -1727,6 +1727,9 @@ static int allocate_sdma_queue(struct device_queue_manager *dqm,
                }
 
                if (restore_sdma_id) {
+                       if (*restore_sdma_id >= get_num_sdma_queues(dqm))
+                               return -EINVAL;
+
                        /* Re-use existing sdma_id */
                        if (!test_bit(*restore_sdma_id, dqm->sdma_bitmap)) {
                                dev_err(dev, "SDMA queue already in use\n");
@@ -1753,6 +1756,9 @@ static int allocate_sdma_queue(struct device_queue_manager *dqm,
                        return -ENOMEM;
                }
                if (restore_sdma_id) {
+                       if (*restore_sdma_id >= get_num_xgmi_sdma_queues(dqm))
+                               return -EINVAL;
+
                        /* Re-use existing sdma_id */
                        if (!test_bit(*restore_sdma_id, dqm->xgmi_sdma_bitmap)) {
                                dev_err(dev, "SDMA queue already in use\n");