Claude review: fbdev: omap2: fix use-after-free in omapfb_mmap

[Claude Code Review Bot <claude-review@example.com>]

Overall Series Review

Subject: fbdev: omap2: fix use-after-free in omapfb_mmap
Author: Hongling Zeng <zenghongling@kylinos.cn>
Patches: 1
Reviewed: 2026-06-04T13:04:18.710868

---

This is a single-patch series fixing a race condition between `omapfb_mmap()` and `OMAPFB_SETUP_PLANE` ioctl in the omap2 fbdev driver. The race analysis in the commit message is sound — `ofbi->region` can be reassigned concurrently, causing `omapfb_get_region_paddr()` to read from the new region while `map_count` is incremented on the old one, enabling a use-after-free.

However, the patch has a **critical bug**: it adds a new `atomic_inc(&rg->map_count)` before `vm_iomap_memory()` without removing the original increment after it. This double-increments `map_count` on the success path, leaking a reference and preventing the region from ever being freed.

Additionally, the commit message claims to fix the race on both `start` and `len`, but `len` is still read from the raceable `fix->smem_len`.

**Recommendation: Needs revision.** The double-increment must be fixed before this can be applied.

---

---
Generated by Claude Code Patch Reviewer