Claude review: accel/rocket: Fix drm_mm UAF on close vs in-flight job

[Claude Code Review Bot <claude-review@example.com>]

Overall Series Review

Subject: accel/rocket: Fix drm_mm UAF on close vs in-flight job
Author: gyeyoung baek <gye976@gmail.com>
Patches: 1
Reviewed: 2026-04-28T15:18:19.348685

---

This is a single-patch fix for a real use-after-free bug in the `accel/rocket` NPU driver. The core insight is correct: `drm_mm` and its mutex were embedded in `rocket_file_priv`, which is freed in `rocket_postclose()` on fd close — but BO destructors running from the scheduler's `free_job` worker still need to call `drm_mm_remove_node()` against that same allocator, causing a UAF. Moving these into the kref-managed `rocket_vm` struct (which jobs and BOs hold references to) is the right fix.

The rename from `rocket_iommu_domain` to `rocket_vm` is clean and improves clarity. The mechanical changes are consistent across all six files.

However, there are two pre-existing bugs that this patch carries forward without fixing, and one of them interacts with the new code. These should be addressed either here or in follow-up patches.

**Verdict**: Correct fix for the stated UAF, but needs at least the `drm_mm_insert_node_generic` error-handling issue fixed before merging.

---

---
Generated by Claude Code Patch Reviewer