From mboxrd@z Thu Jan  1 00:00:00 1970
From: Claude Code Review Bot <claude-review@example.com>
To: dri-devel-reviews@example.com
Subject: Claude review: drm/msm: Fix dma_free_attrs() buffer size
Date: Fri, 27 Feb 2026 12:28:53 +1000
Message-ID: <review-patch1-20260226095714.12126-2-fourier.thomas@gmail.com>
In-Reply-To: <20260226095714.12126-2-fourier.thomas@gmail.com>
References: <20260226095714.12126-2-fourier.thomas@gmail.com> <20260226095714.12126-2-fourier.thomas@gmail.com>
X-Mailer: Claude Code Patch Reviewer
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0

Patch Review

**Verdict: Correct fix, minor style suggestion.**

The bug is clear and verified by reading the full file:

**Allocation** at `a2xx_gpummu_new()` (line 102):
```c
gpummu->table = dma_alloc_attrs(dev, TABLE_SIZE + 32, &gpummu->pt_base,
    GFP_KERNEL | __GFP_ZERO, DMA_ATTR_FORCE_CONTIGUOUS);
```

**Free** (before fix) at `a2xx_gpummu_destroy()` (line 81):
```c
dma_free_attrs(mmu->dev, TABLE_SIZE, gpummu->table, gpummu->pt_base,
    DMA_ATTR_FORCE_CONTIGUOUS);
```

The extra 32 bytes exist to hold a "translation error" address, as shown in `a2xx_gpummu_params()` (line 121):
```c
*tran_error = base + TABLE_SIZE; /* 32-byte aligned */
```

The fix correctly changes the free to `TABLE_SIZE + 32` to match the allocation.

**Minor nit (not blocking):** The magic number `32` is repeated in three places (alloc, free, and implicitly in `a2xx_gpummu_params`). Defining something like `#define TRAN_ERROR_SIZE 32` and using `TABLE_SIZE + TRAN_ERROR_SIZE` would make the relationship clearer and prevent future mismatches. But that's a cleanup suggestion, not something that should hold up this bugfix.

**Reviewed-by worthy.** The Fixes tag and Cc: stable are appropriate.

---
Generated by Claude Code Patch Reviewer