Claude review: drm/amdkfd: fix integer overflow in get_queue_ids()

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**Correctness: Good**

The fix changes:
```c
if (!usr_queue_id_array)
    return NULL;
```
to:
```c
if (!usr_queue_id_array)
    return num_queues ? ERR_PTR(-EINVAL) : NULL;
```

This addresses a real bug: in `suspend_queues()` (line 3603), `get_queue_ids()` is called unconditionally. If userspace supplies `num_queues > 0` with `queue_array_ptr == 0`, `get_queue_ids()` previously returned NULL. Since `IS_ERR(NULL) == false`, execution continued to `q_array_invalidate(num_queues, NULL)` at line 3611, which dereferences NULL in a loop — kernel panic.

The `num_queues == 0` case correctly still returns NULL, preserving the existing no-op behavior. In `suspend_queues()`, this means `q_array_invalidate(0, NULL)` is called but doesn't iterate (loop bound is 0), the `q_array_get_index` calls also use `num_queues == 0` so they don't iterate, and `copy_to_user(NULL, NULL, 0)` is a no-op. `kfree(NULL)` is also a no-op. So the NULL return path in `suspend_queues` is safe, though it's a pre-existing asymmetry with `resume_queues` which guards the tail behind `if (queue_ids)`.

In `resume_queues()` (line 3500), there's already a `if (usr_queue_id_array)` guard before calling `get_queue_ids()`, so the NULL dereference path was only exploitable via `suspend_queues()`. The fix is still correct for both callers.

**Minor observation (pre-existing, not introduced by this patch)**: `suspend_queues()` at lines 3704-3708 does not guard `copy_to_user()` and `kfree()` with a NULL check on `queue_ids`, unlike `resume_queues()` at line 3586. When `get_queue_ids()` returns NULL (the `num_queues == 0` no-op case), `copy_to_user(NULL, NULL, 0)` happens to be benign on all current architectures, but wrapping those calls in `if (queue_ids)` for consistency with `resume_queues` would be a small improvement. Not a bug, not a blocker, and out of scope for this fix.

**No issues found with the patch itself.**

---
Generated by Claude Code Patch Reviewer