Claude review: drm/vmwgfx: Reserve ttm object before resv usage

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**vmw_bo_free fix is correct.** Looking at `vmw_resource_mob_detach`, it calls `dma_resv_assert_held(gbo->tbo.base.resv)`, which requires the TTM BO reservation lock to be held. `vmw_resource_reserve` does NOT acquire the BO reservation lock — it only takes the resource off the LRU list and optionally allocates a guest memory buffer. So the added `ttm_bo_reserve`/`ttm_bo_unreserve` around `vmw_resource_mob_detach` in `vmw_bo_free` is necessary:

```c
			(void)vmw_resource_reserve(res, false, true);
+			ttm_bo_reserve(bo, false, false, NULL);
			vmw_resource_mob_detach(res);
+			ttm_bo_unreserve(bo);
```

However, the return value of `ttm_bo_reserve` is not checked. It's called with `interruptible=false` and `no_wait=false`, so it should only fail if the BO is being destroyed — but since we're *in* the BO's free callback, this is the BO being destroyed. This is a potential concern: can you successfully reserve a BO that is in the process of being freed (refcount == 0, as asserted at line 45)? The `vmw_resource_release` path does `BUG_ON(ret)` for the same call, so at minimum the error should not be silently ignored.

**vkms crc_generate_worker fix — goto skips vmw_surface_unreference.** The error path jumps to `done:` which falls through to `vmw_surface_unreference(&surf)`, so the surface reference is properly released. However, the blank line after `done:` is unnecessary style-wise:

```c
+done:
+
 		vmw_surface_unreference(&surf);
```

**The reservation scope is wider than necessary in vkms.** The lock is held across the entire `compute_crc` call. This is functionally correct (the BO must be reserved during access), but worth noting if `compute_crc` is expensive.

---
Generated by Claude Code Patch Reviewer