Claude review: fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info

[Claude Code Review Bot <claude-review@example.com>]

Overall Series Review

Subject: fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info
Author: Sasha Levin <sashal@kernel.org>
Patches: 1
Reviewed: 2026-05-05T08:15:16.910081

---

This is a single patch being backported to 6.18.y stable from upstream commit `9ded47ad003f`. It introduces a reference-counted `struct fb_deferred_io_state` to decouple the lifetime of deferred I/O state from `struct fb_info`, fixing a long-standing use-after-free on device hot-unplug while userspace still holds active framebuffer mappings.

The design is sound: a kref-managed state object is allocated at `fb_deferred_io_init()`, each VMA takes a reference via `vm_ops->open/close`, and the info pointer is NULLed under mutex during cleanup so that subsequent fault/mkwrite accesses return `VM_FAULT_SIGBUS` instead of accessing freed memory.

The stable backport adaptation (`kzalloc_obj` → `kzalloc(sizeof(*fbdefio_state), GFP_KERNEL)`) is correctly noted. The pagereflist, open_count, and mapping remain in their original locations (`fb_deferred_io` / `fb_info`), which is appropriate for a minimal backport — drm-next has since moved those into the state struct in follow-up commits.

**Recommendation: Acceptable for stable.** The patch is a faithful minimal backport of an important fix. The concerns noted below are either pre-existing in the upstream code or relate to follow-up work not included in this backport.

---

---
Generated by Claude Code Patch Reviewer