Claude review: drm/amdgpu/userq: fix memory leak in MQD creation error paths

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**Bug analysis is correct.** Looking at the current tree (`mes_userqueue.c:309-398`), each branch does:
1. `memdup_user()` → allocates a struct (e.g., `compute_mqd`)
2. `amdgpu_userq_input_va_validate()` → may fail
3. `kfree()` → only reached on the success path

The `free_mqd` label does not free these IP-specific allocations, so the patch correctly adds `kfree()` before each `goto free_mqd`.

**All four error paths are addressed:**
- COMPUTE branch: `kfree(compute_mqd)` at line 192
- GFX branch: `kfree(mqd_gfx_v11)` at lines 204 and 211 (two validation calls)
- SDMA branch: `kfree(mqd_sdma_v11)` at line 223

**Minor observations:**

1. **Correctness concern in COMPUTE branch:** In the current tree at line 334, `userq_props->tmz_queue` and other properties are set *after* the validation call. The patch correctly places the `kfree()` before any of those assignments, so this is fine.

2. **Correctness concern in GFX branch:** At lines 361-364 in the tree, `userq_props->shadow_addr` and `userq_props->csa_addr` are assigned from `mqd_gfx_v11` *before* the validation calls. This means on the error path, `userq_props` contains stale VA values from user input. This isn't a problem introduced by this patch (and `userq_props` itself is freed by `free_mqd`), but it's worth noting.

3. **Style suggestion:** Rather than sprinkling `kfree()` at each validation failure, a cleaner approach would be to use a local `goto` label per branch (e.g., `free_compute_mqd`) or restructure so the `kfree()` is always done before any `goto`. However, this fix is minimal and correct, which is appropriate for a stable-targeted bugfix.

4. **Fixes tag:** The referenced commit `9e46b8bb0539` ("drm/amdgpu: validate userq buffer virtual address and size") is the commit that introduced the validation calls (and thus the leak), so the Fixes tag is correct.

**Overall: The patch is correct and ready to apply.** It fixes a genuine memory leak with minimal, targeted changes. The `Cc: stable` tag is appropriate since this is a straightforward resource leak fix.

---
Generated by Claude Code Patch Reviewer