Commit a1d4b228 authored by David Francis's avatar David Francis Committed by Alex Deucher
Browse files

drm/amdkfd: Check bounds on allocate_doorbell 



allocated_doorbell has an option to set the doorbell id
to a specific value (used by CRIU). This value was not
bounds checked.

Check to confirm it's less than KFD_MAX_NUM_OF_QUEUES_PER_PROCESS.

Signed-off-by: default avatarDavid Francis <David.Francis@amd.com>
Reviewed-by: default avatarHarish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 1f087bb8cf9e8797633da35c85435e557ef74d06)
parent 0c61a973

drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c

+3 −0
Original line number Diff line number Diff line
@@ -475,6 +475,9 @@ static int allocate_doorbell(struct qcm_process_device *qpd, 
	} else {

		/* For CP queues on SOC15 */

		if (restore_id) {

			if (*restore_id >= KFD_MAX_NUM_OF_QUEUES_PER_PROCESS)

				return -EINVAL;



			/* make sure that ID is free  */

			if (__test_and_set_bit(*restore_id, qpd->doorbell_bitmap))

				return -EINVAL;