amdgpu: validate offset_in_bo of drm_amdgpu_gem_va

stable inclusion
from stable-v5.10.188
commit 968e27fd037ec4732068820a9b9836eccc0e0a12
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9J3KG
CVE: CVE-2024-26922

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=968e27fd037ec4732068820a9b9836eccc0e0a12



--------------------------------

[ Upstream commit 9f0bcf49 ]

This is motivated by OOB access in amdgpu_vm_update_range when
offset_in_bo+map_size overflows.

v2: keep the validations in amdgpu_vm_bo_map
v3: add the validations to amdgpu_vm_bo_map/amdgpu_vm_bo_replace_map
    rather than to amdgpu_gem_va_ioctl

Fixes: 9f7eb536 ("drm/amdgpu: actually use the VM map parameters")
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Chia-I Wu <olvaffe@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Signed-off-by: Guo Mengqi <guomengqi3@huawei.com>