drm/amdgpu: validate doorbell_offset in user queue creation

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: validate doorbell_offset in user queue creation

amdgpu_userq_get_doorbell_index() passes the user-provided

doorbell_offset to amdgpu_doorbell_index_on_bar() without bounds

checking. An arbitrarily large doorbell_offset can cause the

calculated doorbell index to fall outside the allocated doorbell BO,

potentially corrupting kernel doorbell space.

Validate that doorbell_offset falls within the doorbell BO before

computing the BAR index, using u64 arithmetic to prevent overflow.

(cherry picked from commit de1ef4ffd70e1d15f0bf584fd22b1f28cbd5e2ec)