[PATCH] of: unittest: fix node reference leak in of_notify()

[PATCH] of: unittest: fix node reference leak in of_notify()

[Wentao Liang]

of_notify() takes a reference on the overlay node passed to the
notifier, but drops it only for the unexpected action. Every regular
action returns with the reference still held, which keeps the overlay
node alive after the changeset has been removed and its memory freed.

Move the release out of the default branch so that it is performed on
all paths.

Fixes: 992b0dc5c38a ("of: overlay: unittest: add tests for overlay notifiers")
Cc: stable@vger.kernel.org
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/of/unittest.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
index a6ac58b4d883..47da90bc0d3b 100644
--- a/drivers/of/unittest.c
+++ b/drivers/of/unittest.c
@@ -3472,11 +3472,12 @@ static int of_notify(struct notifier_block *nb, unsigned long action,
 		break;
 
 	default:			/* should not happen */
-		of_node_put(nd->overlay);
 		ret = -EINVAL;
 		break;
 	}
 
+	of_node_put(nd->overlay);
+
 	if (ret)
 		return notifier_from_errno(ret);
 
-- 
2.34.1

Re: [PATCH] of: unittest: fix node reference leak in of_notify()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] of: unittest: extra of_node_put() in of_notify() causes refcount underflow
--

commit e1e7dd44b042cb6a35f29a5d1cce9e3a35006236
Author: Wentao Liang <vulab@iscas.ac.cn>

of: unittest: fix node reference leak in of_notify()

This commit moves the of_node_put(nd->overlay) call in of_notify() out of
the default switch branch so that it runs after all notifier actions.

> diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
> index e255f54f4d760..3202781998808 100644
> --- a/drivers/of/unittest.c
> +++ b/drivers/of/unittest.c
> @@ -3460,11 +3460,12 @@ static int of_notify(struct notifier_block *nb, unsigned long action,
>  		break;
>  
>  	default:			/* should not happen */
> -		of_node_put(nd->overlay);
>  		ret = -EINVAL;
>  		break;
>  	}
>  
> +	of_node_put(nd->overlay);

[Severity: High]
Does moving of_node_put(nd->overlay) outside the switch statement cause a
reference count underflow on nd->overlay?

Before the switch statement, of_notify() acquires a single reference on
nd->overlay:

drivers/of/unittest.c:of_notify() {
	ret = 0;
	of_node_get(nd->overlay);

	switch (action) {

	case OF_OVERLAY_PRE_APPLY:
		found = of_find_node_by_name(nd->overlay, "test-unittest16");
	...
}

In all four valid action branches (OF_OVERLAY_PRE_APPLY,
OF_OVERLAY_POST_APPLY, OF_OVERLAY_PRE_REMOVE, and OF_OVERLAY_POST_REMOVE),
nd->overlay is passed as the from argument to of_find_node_by_name(), which
unconditionally drops a reference on from via of_node_put(from).

Only the default branch does not call of_find_node_by_name(nd->overlay, ...).
With of_node_put(nd->overlay) moved after the switch statement, every valid
overlay notifier action acquires one reference and drops two references on
nd->overlay, prematurely releasing the node while the overlay changeset is
still using it.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261103104236.1373612-1-vulab@iscas.ac.cn?part=1

Re: [PATCH] of: unittest: fix node reference leak in of_notify()

[Krzysztof Kozlowski]

On Tue, 03 Nov 2026 10:42:36 +0000, Wentao Liang wrote:
> of_notify() takes a reference on the overlay node passed to the
> notifier, but drops it only for the unexpected action. Every regular
> action returns with the reference still held, which keeps the overlay
> node alive after the changeset has been removed and its memory freed.
> 
> Move the release out of the default branch so that it is performed on
> all paths.
> 
> Fixes: 992b0dc5c38a ("of: overlay: unittest: add tests for overlay notifiers")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/of/unittest.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 

Multiple things here:
1. Your team ignored completely previous feedback. Multiple times.

2. You use multiple identities with this email address, thus I doubt that we
   speak with an actual person.

3. Your bot does not even bother running checkpatch, right?

4. Nothing of this was reproduced nor tested.

5. Finally, the same feedback:
You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem (so a patchset grouping multiple patches with a short cover
letter), how to document the issue discovery method and what was
or was not tested.

Best regards,
Krzysztof