From mboxrd@z Thu Jan 1 00:00:00 1970 From: Claude Code Review Bot To: dri-devel-reviews@example.com Subject: Claude review: drm/amdgpu/userq: fix memory leak in MQD creation error paths Date: Mon, 16 Mar 2026 11:58:18 +1000 Message-ID: In-Reply-To: References: X-Mailer: Claude Code Patch Reviewer Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Patch Review **Bug analysis is correct.** Looking at the current tree (`mes_userqueue.c:= 309-398`), each branch does: 1. `memdup_user()` =E2=86=92 allocates a struct (e.g., `compute_mqd`) 2. `amdgpu_userq_input_va_validate()` =E2=86=92 may fail 3. `kfree()` =E2=86=92 only reached on the success path The `free_mqd` label does not free these IP-specific allocations, so the pa= tch correctly adds `kfree()` before each `goto free_mqd`. **All four error paths are addressed:** - COMPUTE branch: `kfree(compute_mqd)` at line 192 - GFX branch: `kfree(mqd_gfx_v11)` at lines 204 and 211 (two validation cal= ls) - SDMA branch: `kfree(mqd_sdma_v11)` at line 223 **Minor observations:** 1. **Correctness concern in COMPUTE branch:** In the current tree at line 3= 34, `userq_props->tmz_queue` and other properties are set *after* the valid= ation call. The patch correctly places the `kfree()` before any of those as= signments, so this is fine. 2. **Correctness concern in GFX branch:** At lines 361-364 in the tree, `us= erq_props->shadow_addr` and `userq_props->csa_addr` are assigned from `mqd_= gfx_v11` *before* the validation calls. This means on the error path, `user= q_props` contains stale VA values from user input. This isn't a problem int= roduced by this patch (and `userq_props` itself is freed by `free_mqd`), bu= t it's worth noting. 3. **Style suggestion:** Rather than sprinkling `kfree()` at each validatio= n failure, a cleaner approach would be to use a local `goto` label per bran= ch (e.g., `free_compute_mqd`) or restructure so the `kfree()` is always don= e before any `goto`. However, this fix is minimal and correct, which is app= ropriate for a stable-targeted bugfix. 4. **Fixes tag:** The referenced commit `9e46b8bb0539` ("drm/amdgpu: valida= te userq buffer virtual address and size") is the commit that introduced th= e validation calls (and thus the leak), so the Fixes tag is correct. **Overall: The patch is correct and ready to apply.** It fixes a genuine me= mory leak with minimal, targeted changes. The `Cc: stable` tag is appropria= te since this is a straightforward resource leak fix. --- Generated by Claude Code Patch Reviewer