Claude review: drm/ras: Fix memory leak in doit_reply_value() error path

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**Bug identification is correct.** The original code at the `get_node_error_counter()` failure path:

```c
ret = get_node_error_counter(node_id, error_id,
                             &error_name, &value);
if (ret)
    return ret;
```

This leaks `msg` (allocated earlier via `genlmsg_new()`) and also fails to call `genlmsg_cancel()` to undo the `genlmsg_iput()`.

**The fix is correct and follows kernel conventions:**

1. The `err_cancel_msg` label properly calls `genlmsg_cancel(msg, hdr)` before falling through to `err_free_msg`, which calls `nlmsg_free(msg)`. This ordering is correct — cancel the genl message header first, then free the underlying skb.

2. The `err_free_msg` label (used when `genlmsg_iput()` fails) correctly only frees the msg without calling `genlmsg_cancel()`, since there's no valid `hdr` to cancel at that point.

3. The `msg_reply_value()` error path, which previously had its own inline `genlmsg_cancel()` + `nlmsg_free()`, now correctly shares the `err_cancel_msg` goto target, eliminating code duplication.

**Minor observation:** The `Fixes:` tag references `c36218dc49f5`, which is appropriate as it targets the commit that introduced the buggy code.

**No issues found.** The patch is clean, minimal, and correct.

---
Generated by Claude Code Patch Reviewer