Re: [PATCH] of: overlay: fix device_node leak when attaching node to changeset fails

[Krzysztof Kozlowski]

On Sun, Oct 25, 2026 at 08:02:37PM +0200, Selby Mashiki wrote:
> In add_changeset_node(), when creating a new target child node via
> __of_node_dup(), tchild is initialized with a reference count of 1. If
> of_changeset_attach_node() subsequently fails, add_changeset_node()
> returns the error without calling of_node_put(tchild), leaking the
> allocated device_node.
> 
> Furthermore, because OF_OVERLAY is set on tchild before
> of_changeset_attach_node() is called, calling of_node_put(tchild) when
> tchild was never added to the changeset (and thus never had
> OF_OVERLAY_FREE_CSET set by __of_changeset_entry_destroy()) would cause
> of_node_release() to log a premature refcount zero error and skip
> freeing the node.
> 
> Move of_node_set_flag(tchild, OF_OVERLAY) after
> of_changeset_attach_node() succeeds and call of_node_put(tchild) on the
> failure path, matching of_changeset_create_node().

How did you reproduce it? Looks like LLM written log.

Best regards,
Krzysztof