Claude review: drm/vmwgfx: Change ttm refs for dumb buffers.

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**The dma_buf leak fix in ttm_prime_fd_to_handle is clearly correct.** The original code returns `-ENOSYS` without calling `dma_buf_put(dma_buf)`, leaking the reference obtained from `dma_buf_get(fd)`:

```c
-	if (dma_buf->ops != &tdev->ops)
-		return -ENOSYS;
+	if (dma_buf->ops != &tdev->ops) {
+		ret = -ENOSYS;
+		goto out;
+	}
```

This is a straightforward and correct fix.

**The vmw_dumb_create change needs careful consideration.** The patch changes the error path to conditionally unref:

```c
-	ttm_ref_object_base_unref(tfile, arg.rep.handle);
+	if (ret)
+		ttm_ref_object_base_unref(tfile, arg.rep.handle);
```

Combined with `usurf->prime.base.refcount_release = NULL`, this preserves the TTM reference for dumb buffers on the success path. The idea is that the GEM object holds the surface alive, and the TTM refcount_release callback is nulled out so that when the TTM ref is eventually dropped, it doesn't try to destroy the surface (since the GEM path handles that). This is a somewhat subtle lifetime management change — the commit message should explain the ownership model more clearly.

**Setting `refcount_release = NULL` is outside the error check.** The line `usurf->prime.base.refcount_release = NULL;` executes before the `err:` label, meaning it only runs on the success path. This is correct, but the code flow would be clearer if there were a comment explaining why.

---
Generated by Claude Code Patch Reviewer