Claude review: drm/i915/gem: Don't use VMA from wrong VM in EXECBUF

[Claude Code Review Bot <claude-review@example.com>]

Overall Series Review

Subject: drm/i915/gem: Don't use VMA from wrong VM in EXECBUF
Author: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Patches: 1
Reviewed: 2026-04-12T12:37:22.647331

---

This is a single-patch fix for a bug in the i915 GEM execbuffer VMA lookup fast path. The issue is straightforward: when `radix_tree_lookup` returns a VMA that belongs to a different VM (ppGTT), the code skips the `i915_vma_tryget()` reference acquisition but still falls through with a non-NULL `vma` pointer. This results in returning a VMA from the wrong VM **without** a reference — both a correctness bug and a potential use-after-free.

As the commit message thoroughly explains (with Simona's analysis), this race window was introduced by the runtime VM-change feature in 2019 and was effectively closed in 2021 by making `gem_ctx->vm` invariant via proto-contexts. So the bug is not exploitable on any remotely modern kernel, but the fix is still the right thing to do for code hygiene and for stable backports to older kernels where the window was open.

The fix is minimal, correct, and appropriate for stable backport. **No objections to merging.**

---
Generated by Claude Code Patch Reviewer