Claude review: fbdev: fbcon: fix memory leak in error path of fbcon_do_set_font()

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**Bug Analysis: Correct**

The commit message clearly explains the root cause — the `p->userfont = old_userfont` assignment is inside the `if (userfont)` block in `err_out`, so when a builtin font set (`userfont == 0`) fails, the old userfont state is never restored. The kmemleak backtrace and the Fixes tag to `a5a923038d70` are appropriate.

**Code Change: Correct (for old code)**

```diff
+	/* Unconditionally restore the previous userfont state */
+	p->userfont = old_userfont;
+
 	if (userfont) {
-		p->userfont = old_userfont;
 		if (--REFCOUNT(data) == 0)
 			kfree(data - FONT_EXTRA_WORDS * sizeof(int));
 	}
```

Moving `p->userfont = old_userfont` outside the `if (userfont)` block is the right fix. The restore should be unconditional regardless of the type of font that was being set, because the error path's job is to fully roll back state. The `if (userfont)` block that remains correctly handles freeing the *new* font data (which only needs freeing if it was a user-allocated font), so that conditional stays correct.

**Issues:**

1. **Not applicable to mainline.** The `[PATCH 7.0]` tag in the subject and the note in the commit message acknowledge this, but the patch was sent to dri-devel rather than stable@vger.kernel.org. It should target the 7.0.y stable tree directly. Mainline's `fbcon_do_set_font()` now uses `font_data_t` with reference counting and has no `userfont` field at all.

2. **Comment is unnecessary.** The added `/* Unconditionally restore the previous userfont state */` comment just restates what the code does. In the kernel style, this would typically be omitted — the variable name `old_userfont` already makes the intent clear. Minor nit.

3. **Subject tag `[PATCH 7.0]` is non-standard.** For stable submissions, the standard practice is to send the patch with `Cc: stable@vger.kernel.org` and optionally note the affected versions in the commit message body, not use a version tag in the subject bracket.

**Summary:** The fix itself is sound and addresses a real bug. It just needs to go through the correct stable-tree submission process rather than being sent as a mainline patch to dri-devel.

---
Generated by Claude Code Patch Reviewer