From mboxrd@z Thu Jan  1 00:00:00 1970
From: Claude Code Review Bot <claude-review@example.com>
To: dri-devel-reviews@example.com
Subject: Claude review: drm/qxl: fix local_gobj leak in qxl_gem_object_create_with_handle
Date: Thu, 04 Jun 2026 14:38:32 +1000
Message-ID: <review-patch1-20260601064932.227375-1-lihongtao@kylinos.cn>
In-Reply-To: <20260601064932.227375-1-lihongtao@kylinos.cn>
References: <20260601064932.227375-1-lihongtao@kylinos.cn> <20260601064932.227375-1-lihongtao@kylinos.cn>
X-Mailer: Claude Code Patch Reviewer
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0

Patch Review

**Bug analysis is correct.** Looking at the function in `drivers/gpu/drm/qx=
l/qxl_gem.c:82-114`:

1. `qxl_gem_object_create()` (line 95) creates a GEM object and returns it =
via `local_gobj` with a reference held.
2. `drm_gem_handle_create()` (line 101) takes its own reference on the obje=
ct if it succeeds.
3. If `drm_gem_handle_create()` fails, the original code returned `r` immed=
iately without dropping the reference from step 1 =E2=80=94 leaking the obj=
ect.

**The fix is correct:**
```c
r =3D drm_gem_handle_create(file_priv, local_gobj, handle);
if (r) {
    drm_gem_object_put(local_gobj);
    return r;
}
```

Adding `drm_gem_object_put(local_gobj)` in the error path properly releases=
 the reference obtained from `qxl_gem_object_create()`.

**Note the existing code on the success path** (lines 107-111) already demo=
nstrates the correct pattern =E2=80=94 when `gobj` is NULL, it drops the al=
locate reference since the handle holds one. The error path was simply miss=
ing the same cleanup.

**Minor nit on the Fixes tag format:** The tag reads `Fixes: f64122c1f6ad("=
drm: add new QXL driver. (v1.4)")` but the standard kernel format has a spa=
ce before the parenthesis: `Fixes: f64122c1f6ad ("drm: add new QXL driver. =
(v1.4)")`. This is cosmetic but worth fixing for consistency with `gitlint`=
 and kernel conventions.

**No other issues.** The patch is minimal, correctly scoped, and addresses =
a real resource leak that has existed since the driver was introduced.

---
Generated by Claude Code Patch Reviewer