Claude review: drm/panthor: Avoid potential UAF due to memory reclaim

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**The Bug:**
When the shrinker evicts a BO, all CPU and GPU mappings are invalidated and `vm_bo->evicted` is set to `true`. If a *new* GPU mapping is subsequently created for that BO, the `vm_bo` ends up in a "partially evicted" state — it's back on a reclaim list but `vm_bo->evicted` is still `true`. On the next shrinker invocation, the old code would skip this `vm_bo` entirely:

```c
/* Skip already evicted GPU mappings. */
if (vm_bo->evicted)
    continue;
```

This means the newly created mapping is never torn down, so its backing pages can be reclaimed and reused while still mapped to the GPU — a classic use-after-free.

**The Fix:**
The patch replaces the early `continue` with a conditional guard on `drm_gpuvm_bo_evict()`, while always walking the VAs to tear down any non-evicted mappings:

```c
if (!vm_bo->evicted)
    drm_gpuvm_bo_evict(vm_bo, true);

drm_gpuvm_bo_for_each_va(va, vm_bo) {
```

This is correct — it ensures every VA on the `vm_bo` is checked for invalidation regardless of the evicted flag.

**Minor observation on the comment:** The comment states that calling `drm_gpuvm_bo_evict()` again "would mess up with the internal gpuvm lists." Looking at the underlying `__drm_gpuvm_bo_list_add()` in `drivers/gpu/drm/drm_gpuvm.c`:

```c
static void
__drm_gpuvm_bo_list_add(struct drm_gpuvm *gpuvm, spinlock_t *lock,
			struct list_head *entry, struct list_head *list)
{
	cond_spin_lock(lock, !!lock);
	if (list_empty(entry))
		list_add_tail(entry, list);
	cond_spin_unlock(lock, !!lock);
}
```

The `list_empty()` guard actually protects against double-adds, so a duplicate `drm_gpuvm_bo_evict(vm_bo, true)` call wouldn't corrupt the list — it would just be a redundant no-op. The guard `if (!vm_bo->evicted)` is still good practice (avoids pointless locking and makes the intent clear), but the comment slightly overstates the danger. This is very minor and not worth holding up the patch.

**Verdict:** The fix is correct, minimal, has proper `Fixes:` tag targeting the right commit, and is already reviewed by the relevant maintainer. No issues blocking merge.

---
Generated by Claude Code Patch Reviewer