Claude review: gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**Correctness: Good.** The commit message accurately describes the problem. After `device_initialize()` at `bus.c:466`, the embedded `struct device` holds a reference count of 1. Using `kfree()` directly bypasses the device core's lifetime management. Switching to `put_device()` is the right fix — it will decrement the refcount to 0 and invoke the `host1x_device_release` callback set at `bus.c:479`, which calls `__host1x_device_del()` followed by `kfree()`.

**Release callback safety:** The `__host1x_device_del()` function (`bus.c:398`) is safe to call in this early failure state:
- `device->active` — empty, since no subdevices have been registered with clients. The loop at line 406 is a no-op.
- `device->subdevs` — may have entries from the partially-completed `host1x_device_parse_dt()`. These are properly cleaned up by `host1x_subdev_del()` at line 427-428, which does `list_del()`, `of_node_put()`, and `kfree()`. This is actually a secondary fix: the old `kfree(device)` code would also leak any subdevices that were added before `host1x_device_parse_dt()` failed.
- `device->clients` — empty, loop at line 436 is a no-op.
- `list_del_init(&device->list)` at line 443 — safe because `INIT_LIST_HEAD(&device->list)` was called at line 473. Calling `list_del_init` on a self-linked list node is a no-op.

**Pre-existing issue worth noting:** `host1x_device_parse_dt()` (`bus.c:88`) and `host1x_subdev_add()` (`bus.c:39`) have their own cleanup gap — when `host1x_subdev_add()` fails mid-recursion at line 62-64 (note the `/* XXX cleanup? */` comment), already-added subdevices from earlier iterations are left on the list without cleanup. However, with this patch applied, those orphaned subdevices are now properly freed through the `put_device()` → `host1x_device_release()` → `__host1x_device_del()` path, which iterates and frees all entries on `device->subdevs`. So this patch incidentally fixes that leak too.

**Minor nits:**
- The commit message title says "in host1x_device_parse_dt() error path" — it would be slightly more precise as "in host1x_device_add() error path" since the fix is in `host1x_device_add()`, not in `host1x_device_parse_dt()` itself. But this is a cosmetic quibble.
- The Fixes tag references `f4c5cf88fbd50`, which introduced `device_initialize()` usage. This is appropriate.

**Reviewed-by recommendation:** This patch is straightforward, correct, and appropriate for stable backport.

---
Generated by Claude Code Patch Reviewer