Claude review: drm/vmwgfx: Break ABBA deadlock in vblank disable path

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**Status: Superseded by upstream refactoring**

**The bug analysis is correct.** The commit message accurately describes the ABBA deadlock: `drm_crtc_vblank_off()` holds `dev->vbl_lock` and calls `disable_vblank()`, which called blocking `hrtimer_cancel()`, while the timer callback calls `drm_crtc_handle_vblank()` which tries to acquire `dev->vbl_lock`. This is a legitimate deadlock scenario.

**The fix approach has a correctness gap.** In `vmw_vkms_disable_vblank()`:

```c
-	hrtimer_cancel(&du->vkms.timer);
+	hrtimer_try_to_cancel(&du->vkms.timer);
 	du->vkms.surface = NULL;
```

`hrtimer_try_to_cancel()` returns `-1` if the timer callback is currently executing, meaning the cancel did not happen. The patch then sets `du->vkms.surface = NULL` regardless, so a still-running timer callback could race against the surface being cleared. The follow-up `hrtimer_cancel()` in `vmw_vkms_crtc_atomic_disable()` would eventually synchronize, but between the `try_to_cancel` and the later `hrtimer_cancel`, the timer callback may fire again and access the now-NULL surface pointer.

**The upstream fix is superior.** In drm-next, the entire vblank timer has been moved into the DRM core (`struct drm_vblank_crtc_timer`). The `vmw_vkms_disable_vblank()` now calls `drm_crtc_vblank_cancel_timer(crtc)` which internally uses `hrtimer_try_to_cancel()` with proper interval-zeroing under a spinlock, and the old `du->vkms.timer` field no longer exists. The `vmw_vkms_crtc_atomic_disable()` function no longer needs a separate `hrtimer_cancel()` call.

**Minor style issues (moot given NAK):**
- The `period_ns` line (`du->vkms.period_ns = ktime_set(0, 0)`) was removed in the diff context but this field no longer exists upstream either.
- The added comments, while accurate, are somewhat verbose for kernel style.

**Recommendation:** This patch should be rejected. The underlying bug was real but has been fixed by the vblank timer infrastructure refactoring already in drm-next. If the submitter is targeting a stable kernel that predates that refactoring, they should note the target branch and add a `Fixes:` tag identifying the commit that introduced the original `hrtimer_cancel()` call, along with a `Cc: stable@vger.kernel.org` tag.

---
Generated by Claude Code Patch Reviewer