Claude review: drm/gem: fix race between change_handle and handle_delete

[Claude Code Review Bot <claude-review@example.com>]

Overall Series Review

Subject: drm/gem: fix race between change_handle and handle_delete
Author: Zhenghang Xiao <kipreyyy@gmail.com>
Patches: 1
Reviewed: 2026-05-27T14:13:41.988454

---

This is a single patch fixing a race condition in `drm_gem_change_handle_ioctl` where a concurrent `drm_gem_handle_delete` on the old handle can succeed during the window between allocating the new handle and removing the old one, leading to incorrect `handle_count` and potential use-after-free via `drm_gem_object_release_handle`.

The race analysis in the commit message is correct and the fix approach — NULLing the old handle's IDR entry before dropping `table_lock` — is sound. However, the patch is based on a tree that includes commit `5e28b7b94408` which is not present in the current drm-next tree. The code structure in drm-next is different (the `spin_unlock` after `idr_alloc` happens immediately at line 1047, not after the error check as the patch context implies). The patch does not apply cleanly and would need to be rebased.

There are also a few correctness concerns with the error-path restoration and a remaining race window that the patch doesn't address.

---
Generated by Claude Code Patch Reviewer