Claude review: gpu/buddy: Fix use-after-free in split_block() call sites

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**Assessment: Correct and well-explained fix.**

The commit message clearly describes the two distinct failure modes: (1) use-after-free when the buddy is also free and coalescing frees a block whose `rb` is still linked, and (2) rbtree corruption when `mark_free()` → `rbtree_insert()` is called on a block that's already in the tree.

The root cause is that `split_block()` only calls `mark_split()` (which does `rbtree_remove()`) **after** both child allocations succeed (line 514 of the current tree). On failure, the block remains FREE and linked in the rbtree.

All four err_undo sites are fixed consistently:

```c
+		rbtree_remove(mm, block);
 		__gpu_buddy_free(mm, block, false);
```

This matches the existing pattern in `__force_merge()` (current tree line 337):
```c
				rbtree_remove(mm, block);
				...
				order = __gpu_buddy_free(mm, block, true);
```

**Nit:** The `alloc_from_freetree` err_undo path has no buddy guard — it unconditionally calls `__gpu_buddy_free` when `tmp != order`. This is fine because the block IS free (failed split left it free) and `__gpu_buddy_free` handles unmerge-able blocks correctly by just calling `mark_free()` at the bottom. But a brief comment like the other three sites' "make sure we merge everything back" would make the asymmetry less surprising.

**Tag concern:** `Assisted-by: GitHub Copilot:claude-sonnet-4.6` — this is not a recognized kernel tag. The kernel community generally uses `Reported-by`, `Suggested-by`, `Reviewed-by`, etc. Some maintainers may object to this. Consider whether this needs a different format or should be a `Link:` or trailer note instead.

**Cc: stable?** This is a real use-after-free bug. If it can be triggered from userspace (large alloc that forces split_block to fail due to memory pressure), it likely warrants a `Cc: stable@vger.kernel.org` tag and a `Fixes:` tag pointing to the commit that introduced the err_undo paths.

---
Generated by Claude Code Patch Reviewer