Claude review: accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**Overflow check — correct:**

```c
+	if (check_add_overflow(job->in_bo_count, job->out_bo_count, &bo_count))
+		return -EINVAL;
```

All three operands are `u32`, so `check_add_overflow()` will correctly detect wrap. Returning `-EINVAL` is appropriate for invalid userspace input.

**NULL check — correct:**

```c
+	bos = kvmalloc_array(bo_count, sizeof(*bos), GFP_KERNEL);
+	if (!bos)
+		return -ENOMEM;
```

This is the standard pattern. Also note the `sizeof(void *)` → `sizeof(*bos)` change is a good improvement (type-safe, follows kernel style).

**Sum replacement in callers — correct:**

The raw `job->in_bo_count + job->out_bo_count` expressions in `drm_gem_lock_reservations()` and `drm_gem_unlock_reservations()` are replaced with the pre-validated `bo_count`. This is both safer and cleaner.

**Minor nit (non-blocking):** The `memcpy` calls on lines 201–202 still use `sizeof(void *)` instead of `sizeof(*bos)`:

```c
	memcpy(bos, job->in_bos, job->in_bo_count * sizeof(void *));
	memcpy(&bos[job->in_bo_count], job->out_bos, job->out_bo_count * sizeof(void *));
```

Since the allocation was changed to `sizeof(*bos)`, it would be more consistent to use `sizeof(*bos)` in the `memcpy` sizes too. Both are equivalent (`bos` is `struct drm_gem_object **`, so `*bos` is a pointer, same size as `void *`), so this is purely cosmetic and not a correctness issue.

**Overall:** Clean, correct fix for two real bugs. Reviewed-by worthy.

---
Generated by Claude Code Patch Reviewer