Re: [PATCH v5 7/7] clk: tests: Add Kunit testing for nexus nodes

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The `clk_of_find_node_by_name_kunit` test helper introduces a double-free vulnerability if a KUnit-managed device node is passed as the `from` argument.
--

--- Patch [7]: [PATCH v5 7/7] clk: tests: Add Kunit testing for nexus nodes ---
commit 46e51b3734a9b5d623eb4fdcf34b7fd8442c735e
Author: Miquel Raynal (Schneider Electric) <miquel.raynal@bootlin.com>

clk: tests: Add Kunit testing for nexus nodes

This commit adds a nexus node with a child requesting a mapped clock in the
fake DT overlay to verify parsing works correctly. It also introduces a new
KUnit helper similar to of_find_node_by_name() to automatically garbage collect
nodes during testing.

> diff --git a/drivers/clk/clk_kunit_helpers.c b/drivers/clk/clk_kunit_helpers.c
> index 68a28e70bb61c..ab6b2cffcad60 100644
> --- a/drivers/clk/clk_kunit_helpers.c
> +++ b/drivers/clk/clk_kunit_helpers.c

[ ... ]

> +struct device_node *clk_of_find_node_by_name_kunit(struct kunit *test, struct device_node *from,
> +						   const char *name)
> +{
> +	struct device_node *np;
> +	int ret;
> +
> +	np = of_find_node_by_name(from, name);

[Severity: Medium]
Since of_find_node_by_name() drops the reference to the from node, what
happens if a test author chains calls and passes a KUnit-managed node as the
from argument?

Will the underlying function drop the reference while KUnit's deferred
teardown attempts a second of_node_put() on the same node when the test
finishes, leading to a double-free?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260807-schneider-v7-2-rc1-eip201-upstream-v5-0-8785f9531cf0@bootlin.com?part=7