Claude review: fbdev: omap2: fix use-after-free in omapfb_mmap

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**Correctness: Good.** The patch correctly inlines the logic of `omapfb_get_region_paddr()` using the already-locked `rg` pointer instead of going through `ofbi`:

```c
-	start = omapfb_get_region_paddr(ofbi);
-	len = fix->smem_len;
+	if (ofbi->rotation_type == OMAP_DSS_ROT_VRFB)
+		start = rg->vrfb.paddr[0];
+	else
+		start = rg->paddr;
+	len = rg->size;
```

The original `omapfb_get_region_paddr()` does:
```c
static u32 omapfb_get_region_paddr(const struct omapfb_info *ofbi)
{
	if (ofbi->rotation_type == OMAP_DSS_ROT_VRFB)
		return ofbi->region->vrfb.paddr[0];
	else
		return ofbi->region->paddr;
}
```

The patch correctly replaces `ofbi->region->` with `rg->` for the paddr access, and replaces `fix->smem_len` (which is also updated by `set_fb_fix()` during the ioctl) with `rg->size` — both now derived from the locked region.

**Note on `ofbi->rotation_type`:** The condition still reads `ofbi->rotation_type` without holding a lock that protects it. However, `rotation_type` is set once during probe and is not changed by `OMAPFB_SETUP_PLANE`, so this is safe. It's a property of the fb_info, not of the region.

**Note on `fix->smem_len` vs `rg->size`:** The original code read `fix->smem_len` which gets updated by `set_fb_fix()` inside `omapfb_setup_plane()` to reflect the new region. Switching to `rg->size` is correct — it reads the size of the region we actually locked and will map-count.

**Commit message quality:** Excellent. The step-by-step race scenario is clearly laid out and accurate. The Cc: stable tag is appropriate for a use-after-free fix.

**Minor style observation:** The inlined code duplicates the body of `omapfb_get_region_paddr()`. An alternative would be to refactor that helper to take a `struct omapfb2_mem_region *` parameter instead of `struct omapfb_info *`. However, this is a legacy fbdev driver unlikely to see further development, so the pragmatic inline approach is fine and arguably clearer for a -stable backport.

**Overall: Reviewed-by worthy.** The fix is minimal, correct, and addresses a real race condition.

---
Generated by Claude Code Patch Reviewer