Claude review: drm/amdgpu: fix use-after-free in userq signal/wait IOCTLs

[Claude Code Review Bot <claude-review@example.com>]

Overall Series Review

Subject: drm/amdgpu: fix use-after-free in userq signal/wait IOCTLs
Author: Chenyuan Mi <chenyuan_mi@163.com>
Patches: 5
Reviewed: 2026-03-10T12:44:42.922557

---

This 2-patch series aims to fix use-after-free bugs in the amdgpu userqueue signal and wait IOCTLs by adding mutex protection around queue lookups. The identified race conditions are real: without lifetime protection, a concurrent `AMDGPU_USERQ_OP_FREE` can destroy a queue between `xa_load()` and subsequent dereferences.

**However, these patches are based on an older version of the code and are already superseded by changes in the current drm-next tree.** The current tree (as seen at `amdgpu_userq_fence.c:522` and `:866`) has replaced the raw `xa_load()` calls with `amdgpu_userq_get()`/`amdgpu_userq_put()`, which use `kref` refcounting to protect the queue lifetime. This refcounting approach is a better fix — it takes a reference under the xa_lock, preventing the queue from being freed while in use, without needing to hold `userq_mutex` across the entire operation.

**Recommendation: NAK — these patches are not needed against current drm-next.**

---
Generated by Claude Code Patch Reviewer