drm/amdkfd: Check bounds on allocate_doorbell

allocated_doorbell has an option to set the doorbell id
to a specific value (used by CRIU). This value was not
bounds checked.

Check to confirm it's less than KFD_MAX_NUM_OF_QUEUES_PER_PROCESS.

Signed-off-by: David Francis <David.Francis@amd.com>
Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 1f087bb8cf9e8797633da35c85435e557ef74d06)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index 9185ebe4c079a802dd259025ab1d588d28952634..c9239728afd6fc3d58b2dde874e0d85a02bb8df3 100644 (file)
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -475,6 +475,9 @@ static int allocate_doorbell(struct qcm_process_device *qpd,
        } else {
                /* For CP queues on SOC15 */
                if (restore_id) {
+                       if (*restore_id >= KFD_MAX_NUM_OF_QUEUES_PER_PROCESS)
+                               return -EINVAL;
+
                        /* make sure that ID is free  */
                        if (__test_and_set_bit(*restore_id, qpd->doorbell_bitmap))
                                return -EINVAL;