Claude review: drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()'

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**The fix is correct in principle** — it moves the bounds check before the array write, preventing OOB access. However, there is a subtle behavioral difference from the upstream version:

**Issue 1: `ip->revision &= ~0xc0` moved outside the bounds check**

In the original (pre-fix) code:
```c
adev->vcn.vcn_config[adev->vcn.num_vcn_inst] =
    ip->revision & 0xc0;
ip->revision &= ~0xc0;
if (adev->vcn.num_vcn_inst < AMDGPU_MAX_VCN_INSTANCES)
    adev->vcn.num_vcn_inst++;
```

The `ip->revision &= ~0xc0` clearing always happened regardless of bounds. In the patched code:
```c
if (adev->vcn.num_vcn_inst < AMDGPU_MAX_VCN_INSTANCES) {
    adev->vcn.vcn_config[adev->vcn.num_vcn_inst] =
        ip->revision & 0xc0;
    adev->vcn.num_vcn_inst++;
} else
    ...
ip->revision &= ~0xc0;
```

The `ip->revision &= ~0xc0` is placed **after** the if/else, so it still executes unconditionally in both paths. This is correct and preserves the original semantics.

**Issue 2: Missing `inst_mask` updates compared to upstream**

Looking at the current upstream code (drm-next), the fix there also sets `adev->vcn.inst_mask` and `adev->jpeg.inst_mask` inside the bounds-checked block, and the field was refactored from `adev->vcn.vcn_config[]` to `adev->vcn.inst[].vcn_config`. These differences are expected since this is a 6.1.y backport targeting an older kernel with a different data structure, so this is fine.

**Issue 3: Style nit — asymmetric braces**

```c
if (adev->vcn.num_vcn_inst < AMDGPU_MAX_VCN_INSTANCES) {
    ...
} else
    dev_err(...);
```

Per kernel coding style, when one branch of an if/else uses braces, both should. This should be:
```c
} else {
    dev_err(...);
}
```

This is a minor style issue that was actually present in the original code too (the `else` branch had no braces), so it's not a regression from this patch.

**Verdict**: The backport is functionally correct and appropriate for 6.1.y stable. The OOB fix is sound — the array write is now properly guarded. The conflict resolution appears to have been done correctly, preserving the original semantics of always clearing the revision bits. No functional concerns.

---
Generated by Claude Code Patch Reviewer