From mboxrd@z Thu Jan 1 00:00:00 1970 From: Claude Code Review Bot To: dri-devel-reviews@example.com Subject: Claude review: fbdev: nvidia: fix potential memory leak in nvidiafb_probe() Date: Sat, 16 May 2026 11:10:41 +1000 Message-ID: In-Reply-To: <20260514-fbdev-v1-7-b3a2474fa720@cse.iitm.ac.in> References: <20260514-fbdev-v1-0-b3a2474fa720@cse.iitm.ac.in> <20260514-fbdev-v1-7-b3a2474fa720@cse.iitm.ac.in> X-Mailer: Claude Code Patch Reviewer Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Patch Review **Status: Needs revision =E2=80=94 placement concern** ```c err_out_iounmap_fb: iounmap(info->screen_base); + fb_destroy_modelist(&info->modelist); err_out_free_base1: fb_destroy_modedb(info->monspecs.modedb); ``` The modelist is populated inside `nvidia_set_fbinfo()`. From the source tre= e, I confirmed `nvidia_set_fbinfo()` is called at line 1397, and error path= s reaching `err_out_iounmap_fb` are only after that point. So the placement= between `err_out_iounmap_fb` and `err_out_free_base1` is correct. However, there's a subtle issue: `nvidia_set_fbinfo()` itself can fail (ret= urn < 0) and the code does `goto err_out_iounmap_fb`. If `nvidia_set_fbinfo= ()` partially populates the modelist before failing, the cleanup is still c= orrect (iterating an incomplete list is fine). But if `fb_videomode_to_mode= list()` is called early in `nvidia_set_fbinfo()` and a later step in that f= unction fails, the modelist destruction here is needed and correct. Same concern as radeon about the Fixes tag citing `1da177e4c3f4`. --- --- Generated by Claude Code Patch Reviewer