Re: [PATCH] of: unittest: fix node reference leak in of_notify()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] of: unittest: extra of_node_put() in of_notify() causes refcount underflow
--

commit e1e7dd44b042cb6a35f29a5d1cce9e3a35006236
Author: Wentao Liang <vulab@iscas.ac.cn>

of: unittest: fix node reference leak in of_notify()

This commit moves the of_node_put(nd->overlay) call in of_notify() out of
the default switch branch so that it runs after all notifier actions.

> diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
> index e255f54f4d760..3202781998808 100644
> --- a/drivers/of/unittest.c
> +++ b/drivers/of/unittest.c
> @@ -3460,11 +3460,12 @@ static int of_notify(struct notifier_block *nb, unsigned long action,
>  		break;
>  
>  	default:			/* should not happen */
> -		of_node_put(nd->overlay);
>  		ret = -EINVAL;
>  		break;
>  	}
>  
> +	of_node_put(nd->overlay);

[Severity: High]
Does moving of_node_put(nd->overlay) outside the switch statement cause a
reference count underflow on nd->overlay?

Before the switch statement, of_notify() acquires a single reference on
nd->overlay:

drivers/of/unittest.c:of_notify() {
	ret = 0;
	of_node_get(nd->overlay);

	switch (action) {

	case OF_OVERLAY_PRE_APPLY:
		found = of_find_node_by_name(nd->overlay, "test-unittest16");
	...
}

In all four valid action branches (OF_OVERLAY_PRE_APPLY,
OF_OVERLAY_POST_APPLY, OF_OVERLAY_PRE_REMOVE, and OF_OVERLAY_POST_REMOVE),
nd->overlay is passed as the from argument to of_find_node_by_name(), which
unconditionally drops a reference on from via of_node_put(from).

Only the default branch does not call of_find_node_by_name(nd->overlay, ...).
With of_node_put(nd->overlay) moved after the switch statement, every valid
overlay notifier action acquires one reference and drops two references on
nd->overlay, prematurely releasing the node while the overlay changeset is
still using it.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261103104236.1373612-1-vulab@iscas.ac.cn?part=1