Claude review: misc: fastrpc: Remove buffer from list prior to unmap operation

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**Verdict: Looks good, minor style nit.**

Moving the `list_del` from `fastrpc_req_munmap_impl()` into the caller `fastrpc_req_munmap()` before the unmap call is the correct fix for the race. The rollback on failure is also correct:

```c
+	err = fastrpc_req_munmap_impl(fl, buf);
+	if (err) {
+		spin_lock(&fl->lock);
+		list_add_tail(&buf->node, &fl->mmaps);
+		spin_unlock(&fl->lock);
+	}
```

The `fastrpc_req_mmap()` error path changes are also correct: the new `err_copy` label removes the buffer from the list (it was added in the success path above) before falling through to `err_assign` which calls `fastrpc_req_munmap_impl()`:

```c
+err_copy:
+	spin_lock(&fl->lock);
+	list_del(&buf->node);
+	spin_unlock(&fl->lock);
 err_assign:
 	fastrpc_req_munmap_impl(fl, buf);
```

This is consistent since `fastrpc_req_munmap_impl()` no longer touches the list.

---

---
Generated by Claude Code Patch Reviewer