Claude review: drm/xe: use krealloc_array to prevent integer overflow

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**xe_configfs.c change:**

```c
-	tmp = krealloc(wa_bb[0].cs, count * sizeof(u32), GFP_KERNEL);
+	tmp = krealloc_array(wa_bb[0].cs, count, sizeof(u32), GFP_KERNEL);
```

Correct transformation. `count` is `ssize_t` (line 755), so the original `count * sizeof(u32)` is a `size_t` multiplication that could theoretically wrap. `krealloc_array()` handles this safely. One observation: `count` can be 0 here (there's an explicit `if (!count)` check at line 776 after the allocation), and `krealloc_array` with count=0 will behave as `ZERO_SIZE_PTR` or free — the existing code handles this path correctly since `!tmp` is checked and the `!count` case returns early anyway.

**xe_vm_madvise.c change:**

```c
-		__vmas = krealloc(madvise_range->vmas,
-				  max_vmas * sizeof(*madvise_range->vmas),
-				  GFP_KERNEL);
+		__vmas = krealloc_array(madvise_range->vmas,
+					max_vmas,
+					sizeof(*madvise_range->vmas),
+					GFP_KERNEL);
```

Correct transformation. `max_vmas` is `int` starting at 8 and doubling (`max_vmas <<= 1`). The overflow risk is theoretical (would need ~2^31 VMAs), but using the safe API is the right pattern. The continuation-line alignment matches the opening parenthesis, which is the expected kernel style.

**Nit (non-blocking):** The Signed-off-by chain has `Junxiao.Chang` as a second signoff but there's no `Co-developed-by` tag, nor is there a `Reviewed-by` or `Suggested-by`. If Junxiao co-developed this, kernel convention requires a `Co-developed-by` tag immediately before their `Signed-off-by`. If they only reviewed it, it should be `Reviewed-by` instead.

**Overall: Reviewed-by worthy.** Straightforward, correct, mechanical improvement.

---
Generated by Claude Code Patch Reviewer