From mboxrd@z Thu Jan 1 00:00:00 1970 From: Claude Code Review Bot To: dri-devel-reviews@example.com Subject: Claude review: fbdev: defio: Protect against device/module removal Date: Fri, 27 Feb 2026 15:29:25 +1000 Message-ID: In-Reply-To: <20260224082657.207284-1-tzimmermann@suse.de> References: <20260224082657.207284-1-tzimmermann@suse.de> X-Mailer: Claude Code Patch Reviewer Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit MIME-Version: 1.0 Overall Series Review Subject: fbdev: defio: Protect against device/module removal Author: Thomas Zimmermann Patches: 6 Reviewed: 2026-02-27T15:29:25.927899 --- This is a well-structured 4-patch series by Thomas Zimmermann that addresses a long-standing use-after-free bug in the fbdev deferred I/O subsystem. The core problem: when a framebuffer device is hot-unplugged (and struct fb_info freed) while userspace still holds mmap'd VMAs, subsequent page faults would access freed memory. The approach is sound: introduce a reference-counted `struct fb_deferred_io_state` that outlives `fb_info`, with a NULL `info` pointer signaling device removal (returning SIGBUS to userspace). Patches 1-2 are the bug fixes; patches 3-4 are clean follow-up refactoring to move internal state out of driver-visible structures. **Overall assessment: Good series with one race concern worth discussing.** The architecture is correct and the code is clean. The main concern is a narrow race window between `schedule_delayed_work` (called after dropping the state lock in `fb_deferred_io_track_page`) and `cancel_delayed_work_sync` in cleanup. This is discussed in detail in the Patch 1 review below. This race is arguably pre-existing, and the series is a significant net improvement. --- --- Generated by Claude Code Patch Reviewer