Claude review: drm/amdkfd: fix NULL dereference in get_queue_ids()

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**Correctness: Good**

The original code:
```c
size_t array_size = num_queues * sizeof(uint32_t);
```
computes `array_size` with a bare multiplication that can wrap on 32-bit kernels (where `size_t` is 32 bits). With `num_queues = 0x40000001`, the product `0x100000004` truncates to `0x4`, and `memdup_user()` allocates 4 bytes. `q_array_invalidate()` then writes `num_queues` entries into that 4-byte buffer — heap overflow.

The fix:
```c
size_t array_size;
...
if (check_mul_overflow((size_t)num_queues, sizeof(uint32_t), &array_size))
    return ERR_PTR(-EINVAL);
```
is correct. The `(size_t)` cast on `num_queues` ensures all three arguments to `check_mul_overflow()` share the same type, avoiding implicit-type issues with compiler builtins. The `#include <linux/overflow.h>` is appropriate rather than relying on transitive includes.

**Callers handle the error correctly**: Both `suspend_queues()` (`kfd_device_queue_manager.c:3607`) and `resume_queues()` (`kfd_device_queue_manager.c:3503`) check `IS_ERR(queue_ids)` and propagate via `PTR_ERR()`.

**Note on the `copy_to_user()` calls**: The commit message correctly observes that the `num_queues * sizeof(uint32_t)` in `copy_to_user()` (lines 3588, 3704) is safe because it's only reachable after `get_queue_ids()` succeeded with the same `num_queues`, meaning the multiplication was already validated. This is sound reasoning.

**No issues found.**

---
Generated by Claude Code Patch Reviewer