Executive brief
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id
allocate_sdma_queue has an option where the sdma queue id can be specified (used by CRIU). We weren't bounds-checking that value.
Confirm it's less than the maximum number of queues.