From mboxrd@z Thu Jan 1 00:00:00 1970 From: Claude Code Review Bot To: dri-devel-reviews@example.com Subject: Claude review: drm/vmwgfx: Change ttm refs for dumb buffers. Date: Sat, 16 May 2026 10:17:49 +1000 Message-ID: In-Reply-To: <20260514224819.3631763-5-maaz.mombasawala@broadcom.com> References: <20260514224819.3631763-1-maaz.mombasawala@broadcom.com> <20260514224819.3631763-5-maaz.mombasawala@broadcom.com> X-Mailer: Claude Code Patch Reviewer Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Patch Review **dma_buf leak fix is correct and important:** ```c - if (dma_buf->ops !=3D &tdev->ops) - return -ENOSYS; + if (dma_buf->ops !=3D &tdev->ops) { + ret =3D -ENOSYS; + goto out; + } ``` The original code returns `-ENOSYS` without calling `dma_buf_put(dma_buf)`,= leaking the dma_buf reference acquired by `dma_buf_get(fd)`. The fix is st= raightforward and correct. **Dumb buffer TTM ref preservation:** ```c - ttm_ref_object_base_unref(tfile, arg.rep.handle); + if (ret) + ttm_ref_object_base_unref(tfile, arg.rep.handle); ``` Previously, the TTM base object reference was unconditionally dropped after= dumb buffer creation. This patch preserves it on the success path. The com= mit message says this keeps the dumb buffer valid for framebuffer usage. Th= is makes sense if the TTM object reference was the only thing preventing th= e surface from being destroyed while still in use. However, this changes th= e cleanup responsibility =E2=80=94 whoever destroys the dumb buffer must no= w handle this reference. The `refcount_release =3D NULL` set just above (`u= surf->prime.base.refcount_release =3D NULL`) disables the normal TTM releas= e callback, so the GEM object destruction path must handle this. This inter= action should be documented or verified to avoid future leaks. --- Generated by Claude Code Patch Reviewer