Claude review: drm/amdgpu: Fix resource leaks

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**The Smatch warning is valid.** There are real `ioremap()` leaks on early error returns in `amdgpu_device_init()`. However, `devm_ioremap()` is the wrong fix for the following reasons:

**1. Use-after-free via DRM device release path**

The PCI removal sequence is:

```
amdgpu_pci_remove()
  → drm_dev_unplug()
  → amdgpu_driver_unload_kms() → amdgpu_device_fini_hw()
  return
devres_release_all()    ← devm_ioremap mapping freed HERE
...
[later, when last DRM fd is closed]
amdgpu_driver_release_kms()
  → amdgpu_device_fini_sw()
    → amdgpu_device_ip_fini()   ← uses stale adev->rmmio!
```

`amdgpu_device_fini_sw()` is called from the DRM `.release` callback (`amdgpu_driver_release_kms` at `amdgpu_kms.c:1615`), which fires when the last DRM fd reference drops. If userspace still has the device open, this runs **after** `devres_release_all()` has already freed the `devm_ioremap` mapping. At that point `adev->rmmio` is a dangling pointer.

**2. Removal of `adev->rmmio = NULL` breaks guards**

The patch removes both:
```c
-	iounmap(adev->rmmio);
-	adev->rmmio = NULL;
```

But `adev->rmmio == NULL` is used as a validity check elsewhere, e.g., in `amdgpu_kms.c:91`:
```c
if (adev->rmmio == NULL)
    return;
```

After this patch, `adev->rmmio` is never NULLed, so this guard becomes ineffective even though the mapping may already have been freed by devm.

**3. Removal of `drm_dev_enter()` guard breaks hotplug coordination**

The removed code in `amdgpu_device_fini_sw()`:
```c
-	if (drm_dev_enter(adev_to_drm(adev), &idx)) {
-		iounmap(adev->rmmio);
-		adev->rmmio = NULL;
-		drm_dev_exit(idx);
-	}
```

This `drm_dev_enter()` guard coordinates with `amdgpu_device_unmap_mmio()` (the hotplug path). When the device is unplugged, `drm_dev_enter()` fails and the `iounmap` is skipped because `amdgpu_device_unmap_mmio()` already handled it. This careful coordination is lost with the patch.

**Suggested fix:** Instead of `devm_ioremap()`, the error paths in `amdgpu_device_init()` should be fixed with proper `goto` cleanup labels that call `iounmap(adev->rmmio)`. This addresses the Smatch warning without changing the resource lifetime semantics. Alternatively, if `devm_ioremap` is desired, the entire teardown logic across `fini_hw` / `fini_sw` / `unmap_mmio` needs to be reworked to ensure `adev->rmmio` is never accessed after the PCI driver unbinds, and `adev->rmmio` must be set to NULL when devm will handle the unmap.

---
Generated by Claude Code Patch Reviewer