drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger

get_queue_ids() computes array_size = num_queues * sizeof(uint32_t),
which could overflow on 32-bit size_t build. using array_size()
instead, it saturates to SIZE_MAX on overflow.

Signed-off-by: Eric Huang <jinhuieric.huang@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index 5cba592ba941b23b3fc5f98737c6906f5135154b..cbd6fe8340f7b60651d8c71a097a03311c00942e 100644 (file)
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -3477,12 +3477,14 @@ static void copy_context_work_handler(struct work_struct *work)
 
 static uint32_t *get_queue_ids(uint32_t num_queues, uint32_t *usr_queue_id_array)
 {
-       size_t array_size = num_queues * sizeof(uint32_t);
-
        if (!usr_queue_id_array)
                return NULL;
 
-       return memdup_user(usr_queue_id_array, array_size);
+       if (num_queues > KFD_MAX_NUM_OF_QUEUES_PER_PROCESS)
+               return ERR_PTR(-EINVAL);
+
+       return memdup_user(usr_queue_id_array,
+                          array_size(num_queues, sizeof(uint32_t)));
 }
 
 int resume_queues(struct kfd_process *p,