Claude review: drm/panthor: Support sparse mappings

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

This is the core patch. Several observations:

**Bug: Use-after-free in `panthor_vm_pool_create()` error path**

```c
pfile->vms->dummy = panthor_dummy_bo_create(pfile->ptdev);
if (IS_ERR(pfile->vms->dummy)) {
    kfree(pfile->vms);
    return PTR_ERR(pfile->vms->dummy);
}
```

After `kfree(pfile->vms)`, the `return PTR_ERR(pfile->vms->dummy)` dereferences freed memory. Additionally, `pfile->vms` is left as a dangling pointer (not set to NULL), which could cause a double-free or crash if `panthor_vm_pool_destroy()` is called during file cleanup — it checks `if (!pfile->vms)` which would pass on a dangling pointer. Fix:

```c
if (IS_ERR(pfile->vms->dummy)) {
    int ret = PTR_ERR(pfile->vms->dummy);
    kfree(pfile->vms);
    pfile->vms = NULL;
    return ret;
}
```

**Minor: `chunk_size` type in `panthor_vm_map_sparse()`**

```c
u32 chunk_size = min(size - mapped, SZ_2M - (addr & (SZ_2M - 1)));
```

Both operands to `min()` are `u64`, so the result is `u64`. Assigning to `u32` could trigger a truncation warning on some compilers. The value is always ≤ SZ_2M so it's safe, but using `u64 chunk_size` would be cleaner and avoids any potential `min()` type-checking issues with the kernel's strict `min()` macro.

**Nit: uAPI documentation field names**

```c
 * This flag being set means drm_panthor_vm_bind_op:offset and
 * drm_panthor_vm_bind_op::handle must both be set to 0.
```

The field names are wrong — the struct fields are `bo_offset` and `bo_handle`, not `offset` and `handle`. Also inconsistent colon style (`:offset` vs `::handle`). Should be:

```
 * drm_panthor_vm_bind_op::bo_offset and drm_panthor_vm_bind_op::bo_handle
```

**Design observation: remap path and sparse offset semantics**

The comment in the remap path correctly notes that `remap::unmap::offset` and `remap::unmap::keep` from the gpuvm core are unreliable for sparse mappings (since the VA range can exceed the dummy BO size). The code handles this by routing through `panthor_vm_exec_map_op()`, which for sparse mappings ignores the gem offset and calls `panthor_vm_map_sparse()` instead. The added `size > 0` guard in the remap branches is a reasonable defensive check.

**Lifetime management looks correct**: the dummy BO reference is taken per-VM in `panthor_vm_pool_create_vm()` and dropped in `panthor_vm_free()`, with the pool holding its own reference dropped in `panthor_vm_pool_destroy()`. The `if (vm->dummy)` NULL check in `panthor_vm_free()` correctly handles VMs that were never assigned a dummy BO (e.g., MCU VMs or VMs created before the pool dummy was initialized).

---
Generated by Claude Code Patch Reviewer