drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id

allocate_sdma_queue has an option where the sdma queue id can be
specified (used by CRIU). We weren't bounds-checking that
value.

Confirm it's less than the maximum number of queues.

Signed-off-by: David Francis <David.Francis@amd.com>
Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit bfe9a7545b2a7be1c543f1741e16f2d5ec4116ae)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index c9239728afd6fc3d58b2dde874e0d85a02bb8df3..e0a31e11f0ff76ff368ba15a2eb2dc5a8d13ab9d 100644 (file)
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -1590,6 +1590,9 @@ static int allocate_sdma_queue(struct device_queue_manager *dqm,
                }
 
                if (restore_sdma_id) {
+                       if (*restore_sdma_id >= get_num_sdma_queues(dqm))
+                               return -EINVAL;
+
                        /* Re-use existing sdma_id */
                        if (!test_bit(*restore_sdma_id, dqm->sdma_bitmap)) {
                                dev_err(dev, "SDMA queue already in use\n");
@@ -1616,6 +1619,9 @@ static int allocate_sdma_queue(struct device_queue_manager *dqm,
                        return -ENOMEM;
                }
                if (restore_sdma_id) {
+                       if (*restore_sdma_id >= get_num_xgmi_sdma_queues(dqm))
+                               return -EINVAL;
+
                        /* Re-use existing sdma_id */
                        if (!test_bit(*restore_sdma_id, dqm->xgmi_sdma_bitmap)) {
                                dev_err(dev, "SDMA queue already in use\n");