Claude review: fbdev: defio: Move pageref array to struct fb_deferred_io_state

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

Moves `npagerefs` and `pagerefs` from `struct fb_info` to `struct fb_deferred_io_state`, further reducing driver-visible state.

`fb_deferred_io_state_alloc` now takes a `len` parameter:

```c
static struct fb_deferred_io_state *fb_deferred_io_state_alloc(unsigned long len)
{
	struct fb_deferred_io_state *fbdefio_state;
	struct fb_deferred_io_pageref *pagerefs;
	unsigned long npagerefs;

	fbdefio_state = kzalloc_obj(*fbdefio_state);
	if (!fbdefio_state)
		return NULL;

	npagerefs = DIV_ROUND_UP(len, PAGE_SIZE);

	pagerefs = kvzalloc_objs(*pagerefs, npagerefs);
	if (!pagerefs)
		goto err_kfree;
	fbdefio_state->npagerefs = npagerefs;
	fbdefio_state->pagerefs = pagerefs;

	kref_init(&fbdefio_state->ref);
	mutex_init(&fbdefio_state->lock);

	INIT_LIST_HEAD(&fbdefio_state->pagereflist);

	return fbdefio_state;

err_kfree:
	kfree(fbdefio_state);
	return NULL;
}
```

The error path is correct: `kref_init` and `mutex_init` haven't been called yet at the `err_kfree` label, so a plain `kfree` is sufficient. The `kvfree(fbdefio_state->pagerefs)` is properly placed in `fb_deferred_io_state_release`.

The change to `fb_deferred_io_pageref_lookup` signature:

```c
static struct fb_deferred_io_pageref *
fb_deferred_io_pageref_lookup(struct fb_deferred_io_state *fbdefio_state,
                              unsigned long offset, struct page *page)
{
	struct fb_info *info = fbdefio_state->info;
```

This is safe because all callers hold `fbdefio_state->lock` and have verified `info != NULL`.

The simplification of `fb_deferred_io_init` is a nice cleanup — the separate `err:` label and `ret` variable are no longer needed since the allocation is fully encapsulated in `fb_deferred_io_state_alloc`.

No issues with this patch.

---
Generated by Claude Code Patch Reviewer