From mboxrd@z Thu Jan 1 00:00:00 1970 From: Claude Code Review Bot To: dri-devel-reviews@example.com Subject: Claude review: drm/gem: fix race between change_handle and handle_delete Date: Wed, 27 May 2026 14:13:41 +1000 Message-ID: In-Reply-To: <20260526085313.26791-1-kipreyyy@gmail.com> References: <20260526085313.26791-1-kipreyyy@gmail.com> X-Mailer: Claude Code Patch Reviewer Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Overall Series Review Subject: drm/gem: fix race between change_handle and handle_delete Author: Zhenghang Xiao Patches: 1 Reviewed: 2026-05-27T14:13:41.988454 --- This is a single patch fixing a race condition in `drm_gem_change_handle_io= ctl` where a concurrent `drm_gem_handle_delete` on the old handle can succe= ed during the window between allocating the new handle and removing the old= one, leading to incorrect `handle_count` and potential use-after-free via = `drm_gem_object_release_handle`. The race analysis in the commit message is correct and the fix approach =E2= =80=94 NULLing the old handle's IDR entry before dropping `table_lock` =E2= =80=94 is sound. However, the patch is based on a tree that includes commit= `5e28b7b94408` which is not present in the current drm-next tree. The code= structure in drm-next is different (the `spin_unlock` after `idr_alloc` ha= ppens immediately at line 1047, not after the error check as the patch cont= ext implies). The patch does not apply cleanly and would need to be rebased. There are also a few correctness concerns with the error-path restoration a= nd a remaining race window that the patch doesn't address. --- Generated by Claude Code Patch Reviewer