drm/amdgpu: validate doorbell_offset in user queue creation

amdgpu_userq_get_doorbell_index() passes the user-provided
doorbell_offset to amdgpu_doorbell_index_on_bar() without bounds
checking. An arbitrarily large doorbell_offset can cause the
calculated doorbell index to fall outside the allocated doorbell BO,
potentially corrupting kernel doorbell space.

Validate that doorbell_offset falls within the doorbell BO before
computing the BAR index, using u64 arithmetic to prevent overflow.

Fixes: f09c1e6077ab ("drm/amdgpu: generate doorbell index for userqueue")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit de1ef4ffd70e1d15f0bf584fd22b1f28cbd5e2ec)
Cc: stable@vger.kernel.org

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
index 7c450350847d6a0f6148ab8b641dd7c95e6d6c65..0a1b93259887ab48f3337af0c510df8db01e2289 100644 (file)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
@@ -600,6 +600,13 @@ amdgpu_userq_get_doorbell_index(struct amdgpu_userq_mgr *uq_mgr,
                goto unpin_bo;
        }
 
+       /* Validate doorbell_offset is within the doorbell BO */
+       if ((u64)db_info->doorbell_offset * db_size + db_size >
+           amdgpu_bo_size(db_obj->obj)) {
+               r = -EINVAL;
+               goto unpin_bo;
+       }
+
        index = amdgpu_doorbell_index_on_bar(uq_mgr->adev, db_obj->obj,
                                             db_info->doorbell_offset, db_size);
        drm_dbg_driver(adev_to_drm(uq_mgr->adev),