Claude review: drm/amdgpu/userq: clean up VA state on create failure

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**Commit message quality:** Good. The commit message clearly explains the bug: the short-circuit OR in `amdgpu_userq_input_va_validate()` calls means earlier successful validations leak state when later ones fail. The Fixes tag references the right commit.

**Correctness issues in the patch itself (against its target base):**

1. **Missing unwind for `xa_store_irq` into `userq_doorbell_xa`:** After the `xa_store_irq` at the original line ~865, if `xa_alloc` fails, the patch's `free_queue` label skips straight to `amdgpu_userq_buffer_vas_list_cleanup` + `kfree` without erasing the doorbell xarray entry. The old code also didn't do this, but since the patch is reorganizing error handling, it should have been caught.

2. **Missing unwind for `mqd_create`:** The patch adds `free_mqd` and `free_fence_driver` labels but **never jumps to them**. Looking at the diff:
   - After `amdgpu_userq_fence_driver_alloc` fails (line 847), it goes to `free_queue` — correct, fence driver wasn't allocated.
   - After `mqd_create` fails (line 854), it calls `amdgpu_userq_fence_driver_free` inline then goes to `free_queue` — this bypasses the new `free_fence_driver` label but works. However it does NOT go to `free_mqd`, which is correct since mqd_create failed.
   - After `xa_store_irq` fails (line 866), it goes to `free_queue` — but at this point both the fence driver AND the MQD have been successfully created, so `free_mqd` and `free_fence_driver` should be invoked. **This is a resource leak bug introduced by the patch.**
   - After `xa_alloc` fails (line 876), same problem — goes to `free_queue` without cleaning up MQD or fence driver.
   - After `amdgpu_userq_map_helper` fails (line 891), goes to `free_queue` — same issue, plus the doorbell xarray entry isn't erased.

   The `free_mqd` and `free_fence_driver` labels are dead code — nothing jumps to them.

3. **Inconsistent fence driver cleanup:** In the `mqd_create` failure path (line 856), the patch keeps the inline `amdgpu_userq_fence_driver_free(queue)` call before `goto free_queue`. But later failure paths that also need fence driver cleanup (post xa_store_irq, post xa_alloc, post map_helper) go directly to `free_queue` and skip it.

**Summary:** The patch correctly identifies a real bug and the VA cleanup addition is the right idea, but the consolidated error handling has **regression bugs** — several failure paths that previously cleaned up the MQD and fence driver now skip that cleanup by jumping to `free_queue` instead of `free_mqd`. The `free_mqd` and `free_fence_driver` labels are dead code. This would need a v2 that properly threads the later error paths through the full unwind chain.

The point is moot for drm-next since the code has been completely refactored and the bug no longer exists in the current tree.

---
Generated by Claude Code Patch Reviewer