Commit 6dc2c49a authored by David Francis's avatar David Francis Committed by Alex Deucher
Browse files

drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id 



allocate_sdma_queue has an option where the sdma queue id can be
specified (used by CRIU). We weren't bounds-checking that
value.

Confirm it's less than the maximum number of queues.

Signed-off-by: default avatarDavid Francis <David.Francis@amd.com>
Reviewed-by: default avatarHarish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
(cherry picked from commit bfe9a7545b2a7be1c543f1741e16f2d5ec4116ae)
parent 09784062

drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c

+6 −0
Original line number Diff line number Diff line
@@ -1590,6 +1590,9 @@ static int allocate_sdma_queue(struct device_queue_manager *dqm, 
		}



		if (restore_sdma_id) {

			if (*restore_sdma_id >= get_num_sdma_queues(dqm))

				return -EINVAL;



			/* Re-use existing sdma_id */

			if (!test_bit(*restore_sdma_id, dqm->sdma_bitmap)) {

				dev_err(dev, "SDMA queue already in use\n");
@@ -1616,6 +1619,9 @@ static int allocate_sdma_queue(struct device_queue_manager *dqm, 
			return -ENOMEM;

		}

		if (restore_sdma_id) {

			if (*restore_sdma_id >= get_num_xgmi_sdma_queues(dqm))

				return -EINVAL;



			/* Re-use existing sdma_id */

			if (!test_bit(*restore_sdma_id, dqm->xgmi_sdma_bitmap)) {

				dev_err(dev, "SDMA queue already in use\n");