From mboxrd@z Thu Jan  1 00:00:00 1970
From: Claude Code Review Bot <claude-review@example.com>
To: dri-devel-reviews@example.com
Subject: Claude review: drm/ras: Fix memory leak in doit_reply_value() error path
Date: Mon, 09 Mar 2026 08:03:42 +1000
Message-ID: <review-patch1-20260307184541.257941-1-shuicheng.lin@intel.com>
In-Reply-To: <20260307184541.257941-1-shuicheng.lin@intel.com>
References: <20260307184541.257941-1-shuicheng.lin@intel.com> <20260307184541.257941-1-shuicheng.lin@intel.com>
X-Mailer: Claude Code Patch Reviewer
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0

Patch Review

**Bug identification is correct.** The original code at the `get_node_error=
_counter()` failure path:

```c
ret =3D get_node_error_counter(node_id, error_id,
                             &error_name, &value);
if (ret)
    return ret;
```

This leaks `msg` (allocated earlier via `genlmsg_new()`) and also fails to =
call `genlmsg_cancel()` to undo the `genlmsg_iput()`.

**The fix is correct and follows kernel conventions:**

1. The `err_cancel_msg` label properly calls `genlmsg_cancel(msg, hdr)` bef=
ore falling through to `err_free_msg`, which calls `nlmsg_free(msg)`. This =
ordering is correct =E2=80=94 cancel the genl message header first, then fr=
ee the underlying skb.

2. The `err_free_msg` label (used when `genlmsg_iput()` fails) correctly on=
ly frees the msg without calling `genlmsg_cancel()`, since there's no valid=
 `hdr` to cancel at that point.

3. The `msg_reply_value()` error path, which previously had its own inline =
`genlmsg_cancel()` + `nlmsg_free()`, now correctly shares the `err_cancel_m=
sg` goto target, eliminating code duplication.

**Minor observation:** The `Fixes:` tag references `c36218dc49f5`, which is=
 appropriate as it targets the commit that introduced the buggy code.

**No issues found.** The patch is clean, minimal, and correct.

---
Generated by Claude Code Patch Reviewer