AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch modifies `of_unittest_parse_phandle_with_args_map()` in `drivers/of/unittest.c` to fix a reference count leak by adding `of_node_put(np)`. This function is marked `__init` and is only executed once during kernel boot via `late_initcall(of_unittest)` for devicetree self-tests (`CONFIG_OF_UNITTEST`). Because its memory is freed before userspace initializes, it cannot be reached or exercised by syzkaller fuzzing.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 43135c867ad53f2571b4f907ac590954a5812dae\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Sat Sep 19 12:00:43 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/of/unittest.c b/drivers/of/unittest.c\nindex e255f54f4d760..b78b5d3d979b3 100644\n--- a/drivers/of/unittest.c\n+++ b/drivers/of/unittest.c\n@@ -578,6 +578,7 @@ static void __init of_unittest_parse_phandle_with_args_map(void)\n \tfor (i = 0; i \u003c ARRAY_SIZE(p); ++i) {\n \t\tif (!p[i]) {\n \t\t\tpr_err(\"missing testcase data\\n\");\n+\t\t\tof_node_put(np);\n \t\t\treturn;\n \t\t}\n \t\tprefs[i] = OF_KREF_READ(p[i]);\n@@ -708,6 +709,8 @@ static void __init of_unittest_parse_phandle_with_args_map(void)\n \t\t\t i, prefs[i], OF_KREF_READ(p[i]));\n \t\tof_node_put(p[i]);\n \t}\n+\n+\tof_node_put(np);\n }\n \n static void __init of_unittest_property_string(void)\n"
}

core

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies `of_unittest_parse_phandle_with_args_map()` in `drivers/of/unittest.c` to fix a reference count leak by adding `of_node_put(np)`. This function is marked `__init` and is only executed once during kernel boot via `late_initcall(of_unittest)` for devicetree self-tests (`CONFIG_OF_UNITTEST`). Because its memory is freed before userspace initializes, it cannot be reached or exercised by syzkaller fuzzing.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.

================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.

- REACHABILITY IS THE PRIMARY GATE:
  Fuzzing can only discover bugs in code that can actually execute in standard virtualized
  environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
  If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
  regardless of whether it adds assertions or complex logic.

- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
  Patch authors routinely label changes as "cleanups", "refactorings", or state
  "No functional change intended". Do NOT take these claims at face value.
  Code refactorings that rearrange logic, introduce helper functions, or alter state management
  in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
  If reachable executable code is modified or refactored, it MUST be fuzzed.

- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
  When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
  BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
  Even if the author believes the invariant always holds, fuzzing is essential to verify whether
  an unusual sequence of operations can violate it.

================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:

- Non-kernel and non-executable changes:
  * Modifications to Documentation/, comments, or spelling fixes.
  * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
    that do not affect the compiled kernel image (vmlinux) or kernel modules.
  * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
    that do not alter control flow or data structures.
  * Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
  * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
    ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
  * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
    physical PCI hot-unplug or manual sysfs driver unbinding.
  * Code paths exclusive to architectures other than the target architecture.

================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
  * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
    BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
  * Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
  * Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
  * Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).

================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:

- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
  Do NOT list generic, ubiquitous functions called by almost every program in the corpus
  (including, but not limited to: general memory allocators and deallocators, page fault
  and trap handlers, or core synchronization primitives; this is not an exhaustive list).
  Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
  which severely dilutes fuzzing effort away from the actual changes.

- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
  List functions that specifically implement the logic being added or altered, or direct API entrypoints
  for the subsystem feature under review.

- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
  Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
  distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
  If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
  functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).

================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit 43135c867ad53f2571b4f907ac590954a5812dae
Author: syz-cluster <triage@syzkaller.com>
Date:   Sat Sep 19 12:00:43 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
index e255f54f4d760..b78b5d3d979b3 100644
--- a/drivers/of/unittest.c
+++ b/drivers/of/unittest.c
@@ -578,6 +578,7 @@ static void __init of_unittest_parse_phandle_with_args_map(void)
 	for (i = 0; i < ARRAY_SIZE(p); ++i) {
 		if (!p[i]) {
 			pr_err("missing testcase data\n");
+			of_node_put(np);
 			return;
 		}
 		prefs[i] = OF_KREF_READ(p[i]);
@@ -708,6 +709,8 @@ static void __init of_unittest_parse_phandle_with_args_map(void)
 			 i, prefs[i], OF_KREF_READ(p[i]));
 		of_node_put(p[i]);
 	}
+
+	of_node_put(np);
 }
 
 static void __init of_unittest_property_string(void)

gemini-3.8-flash

null

null

							input: 2971
							output: 35
							thoughts: 450
						

**Analyzing this Patch for its Implications**

Okay, let's break this down. First, I need to look at this diff logically. The primary modification here seems to be the addition of `of_node_put(np)` within the `of_unittest_parse_phandle_with_args_map` function. It looks like a simple resource management change.

Alright, let's step back a moment and understand the context. This patch touches `drivers/of/unittest.c`. Ah, and the function being modified is named `of_unittest_parse_phandle_with_args_map` and marked with `__init`. This is a unit test that runs during the early boot process, likely part of the Open Firmware (OF) infrastructure. The fact that it's in a unit test *during boot* is key. Now, where am I seeing this? Is this reachable by a fuzzer, like syzkaller, at runtime? That's the real question. I need to understand this better. I'm going to need to inspect the code more carefully, specifically looking at the surrounding code, the Kconfig, and how this file is called to figure out if there's any path for dynamic execution.

{
  "File": "drivers/of/unittest.c",
  "FirstLine": 565,
  "LineCount": 50
}

{
  "Contents": " 565:\t\n 566:\t\tnp = of_find_node_by_path(\"/testcase-data/phandle-tests/consumer-b\");\n 567:\t\tif (!np) {\n 568:\t\t\tpr_err(\"missing testcase data\\n\");\n 569:\t\t\treturn;\n 570:\t\t}\n 571:\t\n 572:\t\tp[0] = of_find_node_by_path(\"/testcase-data/phandle-tests/provider0\");\n 573:\t\tp[1] = of_find_node_by_path(\"/testcase-data/phandle-tests/provider1\");\n 574:\t\tp[2] = of_find_node_by_path(\"/testcase-data/phandle-tests/provider2\");\n 575:\t\tp[3] = of_find_node_by_path(\"/testcase-data/phandle-tests/provider3\");\n 576:\t\tp[4] = of_find_node_by_path(\"/testcase-data/phandle-tests/provider4\");\n 577:\t\tp[5] = of_find_node_by_path(\"/testcase-data/phandle-tests/provider5\");\n 578:\t\tfor (i = 0; i \u003c ARRAY_SIZE(p); ++i) {\n 579:\t\t\tif (!p[i]) {\n 580:\t\t\t\tpr_err(\"missing testcase data\\n\");\n 581:\t\t\t\tof_node_put(np);\n 582:\t\t\t\treturn;\n 583:\t\t\t}\n 584:\t\t\tprefs[i] = OF_KREF_READ(p[i]);\n 585:\t\t}\n 586:\t\n 587:\t\trc = of_count_phandle_with_args(np, \"phandle-list\", \"#phandle-cells\");\n 588:\t\tunittest(rc == 8, \"of_count_phandle_with_args() returned %i, expected 8\\n\", rc);\n 589:\t\n 590:\t\tfor (i = 0; i \u003c 9; i++) {\n 591:\t\t\tbool passed = true;\n 592:\t\n 593:\t\t\tmemset(\u0026args, 0, sizeof(args));\n 594:\t\t\trc = of_parse_phandle_with_args_map(np, \"phandle-list\",\n 595:\t\t\t\t\t\t\t    \"phandle\", i, \u0026args);\n 596:\t\n 597:\t\t\t/* Test the values from tests-phandle.dtsi */\n 598:\t\t\tswitch (i) {\n 599:\t\t\tcase 0:\n 600:\t\t\t\tpassed \u0026= !rc;\n 601:\t\t\t\tpassed \u0026= (args.np == p[1]);\n 602:\t\t\t\tpassed \u0026= (args.args_count == 1);\n 603:\t\t\t\tpassed \u0026= (args.args[0] == 1);\n 604:\t\t\t\tbreak;\n 605:\t\t\tcase 1:\n 606:\t\t\t\tpassed \u0026= !rc;\n 607:\t\t\t\tpassed \u0026= (args.np == p[3]);\n 608:\t\t\t\tpassed \u0026= (args.args_count == 3);\n 609:\t\t\t\tpassed \u0026= (args.args[0] == 2);\n 610:\t\t\t\tpassed \u0026= (args.args[1] == 5);\n 611:\t\t\t\tpassed \u0026= (args.args[2] == 3);\n 612:\t\t\t\tbreak;\n 613:\t\t\tcase 2:\n 614:\t\t\t\tpassed \u0026= (rc == -ENOENT);\n"
}

gemini-3.8-flash

null

null

							input: 4647
							output: 29
							thoughts: 25
						

Here's my take on those thoughts, tailored for an expert audience:

**Analyzing the Call Sites of `of_unittest_parse_phandle_with_args_map`**

Alright, let's trace this function's usage. I need to understand the context and purpose of `of_unittest_parse_phandle_with_args_map`. Knowing where it's called will immediately illuminate its role in the larger testing framework. I'm especially interested in how it's being used – are there any specific data structures it’s interacting with? What kind of arguments are being passed to it? The function's name hints at parsing a phandle with associated arguments, potentially within a unit test environment, which means it should be part of the DT parsing or test infrastructure, probably related to verifying how the device tree handles phandles and their arguments. I'll need to use my usual tools to dig up the call graph and pinpoint the specific locations, and then I can dive into the code at each call site to analyze the surrounding logic. From there, I can get a better sense of any existing issues or potential vulnerabilities.

{
  "Expression": "of_unittest_parse_phandle_with_args_map"
}

{
  "Output": "drivers/of/unittest.c=400=static void __init of_unittest_parse_phandle_with_args(void)\n--\ndrivers/of/unittest.c-558-\ndrivers/of/unittest.c:559:static void __init of_unittest_parse_phandle_with_args_map(void)\ndrivers/of/unittest.c-560-{\n--\ndrivers/of/unittest.c=4509=static int __init of_unittest(void)\n--\ndrivers/of/unittest.c-4537-\tof_unittest_parse_phandle_with_args();\ndrivers/of/unittest.c:4538:\tof_unittest_parse_phandle_with_args_map();\ndrivers/of/unittest.c-4539-\tof_unittest_printf();\n"
}

gemini-3.8-flash

null

null

							input: 5159
							output: 36
							thoughts: 16
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Analyzing the Invocation of `of_unittest`**

Okay, so I'm diving into `of_unittest` now, specifically focusing on its invocation. This isn't just about understanding its purpose, but *how* it's being integrated into the overall testing framework. I need to quickly identify the calling points and the context in which they're made. Are we dealing with direct calls from a specific testing script, or is there some more sophisticated mechanism involved, perhaps through a configuration file or a dynamic test runner?

My immediate focus will be on tracing the function calls. I'll mentally map out the execution flow, watching for any dependencies or conditional logic that impacts `of_unittest`'s behavior. I'll be looking for clues on the test case selection: Are we running all tests, a subset, or are test cases dynamically generated or filtered based on certain criteria?

I also need to quickly verify the arguments being passed in and how they are handled. I'm looking for the essential configuration that is set up before a test or test suite runs. This helps me to get a feel for how test data is being handled and the test environment is configured. I want to have a clear mental model of how `of_unittest` fits into the broader testing ecosystem. Once I've grasped its invocation, I can move on to looking at its internal workings.

{
  "File": "drivers/of/unittest.c",
  "FirstLine": 4500,
  "LineCount": 70
}

{
  "Contents": "4500:\t\t\tpci_dev_put(pdev);\n4501:\t}\n4502:\t#else\n4503:\t\n4504:\tstatic inline __init void of_unittest_overlay_high_level(void) {}\n4505:\tstatic inline __init void of_unittest_pci_node(void) { }\n4506:\t\n4507:\t#endif\n4508:\t\n4509:\tstatic int __init of_unittest(void)\n4510:\t{\n4511:\t\tstruct device_node *np;\n4512:\t\tint res;\n4513:\t\n4514:\t\tpr_info(\"start of unittest - you will see error messages\\n\");\n4515:\t\n4516:\t\t/* Taint the kernel so we know we've run tests. */\n4517:\t\tadd_taint(TAINT_TEST, LOCKDEP_STILL_OK);\n4518:\t\n4519:\t\t/* adding data for unittest */\n4520:\t\tres = unittest_data_add();\n4521:\t\tif (res)\n4522:\t\t\treturn res;\n4523:\t\tif (!of_aliases)\n4524:\t\t\tof_aliases = of_find_node_by_path(\"/aliases\");\n4525:\t\n4526:\t\tnp = of_find_node_by_path(\"/testcase-data/phandle-tests/consumer-a\");\n4527:\t\tif (!np) {\n4528:\t\t\tpr_info(\"No testcase data in device tree; not running tests\\n\");\n4529:\t\t\treturn 0;\n4530:\t\t}\n4531:\t\tof_node_put(np);\n4532:\t\n4533:\t\tof_unittest_check_tree_linkage();\n4534:\t\tof_unittest_check_phandles();\n4535:\t\tof_unittest_find_node_by_name();\n4536:\t\tof_unittest_dynamic();\n4537:\t\tof_unittest_parse_phandle_with_args();\n4538:\t\tof_unittest_parse_phandle_with_args_map();\n4539:\t\tof_unittest_printf();\n4540:\t\tof_unittest_property_string();\n4541:\t\tof_unittest_property_copy();\n4542:\t\tof_unittest_changeset();\n4543:\t\tof_unittest_changeset_prop();\n4544:\t\tof_unittest_parse_interrupts();\n4545:\t\tof_unittest_parse_interrupts_extended();\n4546:\t\tof_unittest_parse_interrupt_map();\n4547:\t\tof_unittest_irq_refcount();\n4548:\t\tof_unittest_dma_get_max_cpu_address();\n4549:\t\tof_unittest_parse_dma_ranges();\n4550:\t\tof_unittest_pci_dma_ranges();\n4551:\t\tof_unittest_pci_empty_dma_ranges();\n4552:\t\tof_unittest_bus_ranges();\n4553:\t\tof_unittest_bus_3cell_ranges();\n4554:\t\tof_unittest_reg();\n4555:\t\tof_unittest_translate_addr();\n4556:\t\tof_unittest_match_node();\n4557:\t\tof_unittest_platform_populate();\n4558:\t\tof_unittest_overlay();\n4559:\t\tof_unittest_lifecycle();\n4560:\t\tof_unittest_pci_node();\n4561:\t\n4562:\t\t/* Double check linkage after removing testcase data */\n4563:\t\tof_unittest_check_tree_linkage();\n4564:\t\n4565:\t\tof_unittest_overlay_high_level();\n4566:\t\n4567:\t\tpr_info(\"end of unittest - %i passed, %i failed\\n\",\n4568:\t\t\tunittest_results.passed, unittest_results.failed);\n4569:\t\n"
}

gemini-3.8-flash

null

null

							input: 6574
							output: 36
							thoughts: 22
						

Here's my take on the thought process, as requested:

**Diving Deeper into `drivers/of/unittest.c`**

Okay, so I'm looking at `drivers/of/unittest.c` and specifically focusing on the area around `of_unittest`. My immediate thought is, "What else is happening in this file, contextually?" I need to see the surrounding code, the functions that call `of_unittest`, and the variables it interacts with. Understanding the broader picture around a function, especially in a testing context, is critical. This will give me clues about its purpose, its expected inputs, the anticipated outputs, and any potential edge cases that the unit tests are designed to cover. I'm thinking I'll start by scrolling up and down a bit to see the function definitions and variable declarations nearby. I need to get a feel for how `of_unittest` fits into the overall scheme of these Open Firmware tests. This whole file is a crucial piece of verifying the Open Firmware integration within the system. Let's see what the surrounding code holds!

{
  "File": "drivers/of/unittest.c",
  "FirstLine": 4570,
  "LineCount": 20
}

{
  "Contents": "4570:\t\treturn 0;\n4571:\t}\n4572:\tlate_initcall(of_unittest);\n"
}

gemini-3.8-flash

null

null

							input: 6906
							output: 27
							thoughts: 576
						

**My Assessment of the `of_unittest` and Syzkaller Fuzzing Potential**

Okay, so I'm looking at this `late_initcall(of_unittest)` thing. That's a `late_initcall`, meaning it gets called during the boot process. Crucially, after it runs, that memory allocated with `__init` gets freed. The big question is: can syzkaller even touch this code?

My first instinct is to immediately check the triage philosophy because I need to make sure I am not wasting my time. The core principle is *reachability*. We can only fuzz code that is actually *executed* within a standard virtualized environment like GCE or QEMU. That means something that works with software-emulated devices.

The triage doc lays out what is *not* worth fuzzing. It's a list of negative criteria. Things like documentation, user-space tools that don't affect the kernel image, and logging statements that don't impact control flow are obvious no-gos. But the relevant section is clearly "unreachable execution paths." This includes driver teardown functions during PCI hot-unplug, or code paths for unsupported architectures.

Now, back to the problem at hand: this `__init` unit test. Syzkaller runs *after* the kernel has booted. *After* the init routines run. Those functions, having done their boot-time magic, are essentially gone from memory. Syzkaller generates syscall sequences in userspace, which *cannot* call `__init` functions. Those functions are not reachable because they are executed exactly once.

So, the next question is if any part of `of_unittest` gets *exposed* to userspace in any way, shape, or form? Does sysfs, debugfs, or any syscall interface trigger this `of_unittest_parse_phandle_with_args_map` function? I have to look deeper to see if something in `drivers/of/unittest.c` has a module reload, debugfs trigger, or syscall interface. If any of the functionality is exposed, I'm wasting my time looking at this.

{
  "Expression": "of_unittest",
  "PathPrefix": "drivers/of/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 643 lines.\nUse more precise expression if possible.\n\ndrivers/of/Kconfig=21=config OF_UNITTEST\n--\ndrivers/of/Kconfig-38-\t  via capturing the console output or via the dmesg command.  Process\ndrivers/of/Kconfig:39:\t  this file with scripts/dtc/of_unittest_expect to reduce the\ndrivers/of/Kconfig-40-\t  verbosity, test whether expected output is present, and to\n--\ndrivers/of/overlay.c=751=static int init_overlay_changeset(struct overlay_changeset *ovcs,\n--\ndrivers/of/overlay.c-767-\t * Warn for some issues.  Can not return -EINVAL for these until\ndrivers/of/overlay.c:768:\t * of_unittest_apply_overlay() is fixed to pass these checks.\ndrivers/of/overlay.c-769-\t */\n--\ndrivers/of/unittest.c=36=static struct unittest_results {\n--\ndrivers/of/unittest.c-79-\ndrivers/of/unittest.c:80:static void __init of_unittest_find_node_by_name(void)\ndrivers/of/unittest.c-81-{\n--\ndrivers/of/unittest.c-187-\ndrivers/of/unittest.c:188:static void __init of_unittest_dynamic(void)\ndrivers/of/unittest.c-189-{\n--\ndrivers/of/unittest.c-248-\ndrivers/of/unittest.c:249:static int __init of_unittest_check_node_linkage(struct device_node *np)\ndrivers/of/unittest.c-250-{\n--\ndrivers/of/unittest.c-259-\ndrivers/of/unittest.c:260:\t\trc = of_unittest_check_node_linkage(child);\ndrivers/of/unittest.c-261-\t\tif (rc \u003c 0)\n--\ndrivers/of/unittest.c-268-\ndrivers/of/unittest.c:269:static void __init of_unittest_check_tree_linkage(void)\ndrivers/of/unittest.c-270-{\n--\ndrivers/of/unittest.c-278-\t\tallnode_count++;\ndrivers/of/unittest.c:279:\tchild_count = of_unittest_check_node_linkage(of_root);\ndrivers/of/unittest.c-280-\n--\ndrivers/of/unittest.c-287-\ndrivers/of/unittest.c:288:static void __init of_unittest_printf_one(struct device_node *np, const char *fmt,\ndrivers/of/unittest.c-289-\t\t\t\t\t  const char *expected)\n--\ndrivers/of/unittest.c-321-\ndrivers/of/unittest.c:322:static void __init of_unittest_printf(void)\ndrivers/of/unittest.c-323-{\n--\ndrivers/of/unittest.c-335-\ndrivers/of/unittest.c:336:\tof_unittest_printf_one(np, \"%pOF\",  full_name);\ndrivers/of/unittest.c:337:\tof_unittest_printf_one(np, \"%pOFf\", full_name);\ndrivers/of/unittest.c:338:\tof_unittest_printf_one(np, \"%pOFn\", \"dev\");\ndrivers/of/unittest.c:339:\tof_unittest_printf_one(np, \"%2pOFn\", \"dev\");\ndrivers/of/unittest.c:340:\tof_unittest_printf_one(np, \"%5pOFn\", \"  dev\");\ndrivers/of/unittest.c:341:\tof_unittest_printf_one(np, \"%pOFnc\", \"dev:test-sub-device\");\ndrivers/of/unittest.c:342:\tof_unittest_printf_one(np, \"%pOFp\", phandle_str);\ndrivers/of/unittest.c:343:\tof_unittest_printf_one(np, \"%pOFP\", \"dev@100\");\ndrivers/of/unittest.c:344:\tof_unittest_printf_one(np, \"ABC %pOFP ABC\", \"ABC dev@100 ABC\");\ndrivers/of/unittest.c:345:\tof_unittest_printf_one(np, \"%10pOFP\", \"   dev@100\");\ndrivers/of/unittest.c:346:\tof_unittest_printf_one(np, \"%-10pOFP\", \"dev@100   \");\ndrivers/of/unittest.c:347:\tof_unittest_printf_one(of_root, \"%pOFP\", \"/\");\ndrivers/of/unittest.c:348:\tof_unittest_printf_one(np, \"%pOFF\", \"----\");\ndrivers/of/unittest.c:349:\tof_unittest_printf_one(np, \"%pOFPF\", \"dev@100:----\");\ndrivers/of/unittest.c:350:\tof_unittest_printf_one(np, \"%pOFPFPc\", \"dev@100:----:dev@100:test-sub-device\");\ndrivers/of/unittest.c:351:\tof_unittest_printf_one(np, \"%pOFc\", \"test-sub-device\");\ndrivers/of/unittest.c:352:\tof_unittest_printf_one(np, \"%pOFC\",\ndrivers/of/unittest.c-353-\t\t\t\"\\\"test-sub-device\\\",\\\"test-compat2\\\",\\\"test-compat3\\\"\");\n--\ndrivers/of/unittest.c=361=static DEFINE_HASHTABLE(phandle_ht, 8);\ndrivers/of/unittest.c:362:static void __init of_unittest_check_phandles(void)\ndrivers/of/unittest.c-363-{\n--\ndrivers/of/unittest.c-399-\ndrivers/of/unittest.c:400:static void __init of_unittest_parse_phandle_with_args(void)\ndrivers/of/unittest.c-401-{\n--\ndrivers/of/unittest.c-558-\ndrivers/of/unittest.c:559:static void __init of_unittest_parse_phandle_with_args_map(void)\ndrivers/of/unittest.c-560-{\n--\ndrivers/of/unittest.c-715-\ndrivers/of/unittest.c:716:static void __init of_unittest_property_string(void)\ndrivers/of/unittest.c-717-{\n--\ndrivers/of/unittest.c-832-\t\t\t!strcmp((p1)-\u003ename, (p2)-\u003ename))\ndrivers/of/unittest.c:833:static void __init of_unittest_property_copy(void)\ndrivers/of/unittest.c-834-{\n--\ndrivers/of/unittest.c-851-\ndrivers/of/unittest.c:852:static void __init of_unittest_changeset(void)\ndrivers/of/unittest.c-853-{\n--\ndrivers/of/unittest.c=1057=static void __init __maybe_unused changeset_check_bool(struct device_node *np,\n--\ndrivers/of/unittest.c-1063-\ndrivers/of/unittest.c:1064:static void __init of_unittest_changeset_prop(void)\ndrivers/of/unittest.c-1065-{\n--\ndrivers/of/unittest.c-1129-\ndrivers/of/unittest.c:1130:static void __init of_unittest_dma_get_max_cpu_address(void)\ndrivers/of/unittest.c-1131-{\n--\ndrivers/of/unittest.c-1149-\ndrivers/of/unittest.c:1150:static void __init of_unittest_dma_ranges_one(const char *path,\ndrivers/of/unittest.c-1151-\t\tu64 expect_dma_addr, u64 expect_paddr)\n--\ndrivers/of/unittest.c-1197-\ndrivers/of/unittest.c:1198:static void __init of_unittest_parse_dma_ranges(void)\ndrivers/of/unittest.c-1199-{\ndrivers/of/unittest.c:1200:\tof_unittest_dma_ranges_one(\"/testcase-data/address-tests/device@70000000\",\ndrivers/of/unittest.c-1201-\t\t0x0, 0x20000000);\ndrivers/of/unittest.c-1202-\tif (IS_ENABLED(CONFIG_ARCH_DMA_ADDR_T_64BIT))\ndrivers/of/unittest.c:1203:\t\tof_unittest_dma_ranges_one(\"/testcase-data/address-tests/bus@80000000/device@1000\",\ndrivers/of/unittest.c-1204-\t\t\t0x100000000, 0x20000000);\ndrivers/of/unittest.c:1205:\tof_unittest_dma_ranges_one(\"/testcase-data/address-tests/pci@90000000\",\ndrivers/of/unittest.c-1206-\t\t0x80000000, 0x20000000);\n--\ndrivers/of/unittest.c-1208-\ndrivers/of/unittest.c:1209:static void __init of_unittest_pci_dma_ranges(void)\ndrivers/of/unittest.c-1210-{\n--\ndrivers/of/unittest.c-1260-\ndrivers/of/unittest.c:1261:static void __init of_unittest_pci_empty_dma_ranges(void)\ndrivers/of/unittest.c-1262-{\n--\ndrivers/of/unittest.c-1298-\ndrivers/of/unittest.c:1299:static void __init of_unittest_bus_ranges(void)\ndrivers/of/unittest.c-1300-{\n--\ndrivers/of/unittest.c-1369-\ndrivers/of/unittest.c:1370:static void __init of_unittest_bus_3cell_ranges(void)\ndrivers/of/unittest.c-1371-{\n--\ndrivers/of/unittest.c-1424-\ndrivers/of/unittest.c:1425:static void __init of_unittest_reg(void)\ndrivers/of/unittest.c-1426-{\n--\ndrivers/of/unittest.c-1459-\ndrivers/of/unittest.c:1460:struct of_unittest_expected_res {\ndrivers/of/unittest.c-1461-\tint index;\n--\ndrivers/of/unittest.c-1464-\ndrivers/of/unittest.c:1465:static void __init of_unittest_check_addr(const char *node_path,\ndrivers/of/unittest.c:1466:\t\t\t\t\t  const struct of_unittest_expected_res *tab_exp,\ndrivers/of/unittest.c-1467-\t\t\t\t\t  unsigned int tab_exp_count)\ndrivers/of/unittest.c-1468-{\ndrivers/of/unittest.c:1469:\tconst struct of_unittest_expected_res *expected;\ndrivers/of/unittest.c-1470-\tstruct device_node *np;\n--\ndrivers/of/unittest.c-1500-\ndrivers/of/unittest.c:1501:static const struct of_unittest_expected_res of_unittest_reg_2cell_expected_res[] = {\ndrivers/of/unittest.c-1502-\t{.index = 0, .res = DEFINE_RES_MEM(0xa0a01000, 0x100) },\n--\ndrivers/of/unittest.c-1507-\ndrivers/of/unittest.c:1508:static const struct of_unittest_expected_res of_unittest_reg_3cell_expected_res[] = {\ndrivers/of/unittest.c-1509-\t{.index = 0, .res = DEFINE_RES_MEM(0xa0a01000, 0x100) },\n--\ndrivers/of/unittest.c-1515-\ndrivers/of/unittest.c:1516:static const struct of_unittest_expected_res of_unittest_reg_pci_expected_res[] = {\ndrivers/of/unittest.c-1517-\t{.index = 0, .res = DEFINE_RES_MEM(0xe8001000, 0x1000) },\n--\ndrivers/of/unittest.c-1520-\ndrivers/of/unittest.c:1521:static void __init of_unittest_translate_addr(void)\ndrivers/of/unittest.c-1522-{\ndrivers/of/unittest.c:1523:\tof_unittest_check_addr(\"/testcase-data/address-tests2/bus-2cell@10000000/device@100000\",\ndrivers/of/unittest.c:1524:\t\t\t       of_unittest_reg_2cell_expected_res,\ndrivers/of/unittest.c:1525:\t\t\t       ARRAY_SIZE(of_unittest_reg_2cell_expected_res));\ndrivers/of/unittest.c-1526-\ndrivers/of/unittest.c:1527:\tof_unittest_check_addr(\"/testcase-data/address-tests2/bus-3cell@20000000/local-bus@100000/device@f1001000\",\ndrivers/of/unittest.c:1528:\t\t\t       of_unittest_reg_3cell_expected_res,\ndrivers/of/unittest.c:1529:\t\t\t       ARRAY_SIZE(of_unittest_reg_3cell_expected_res));\ndrivers/of/unittest.c-1530-\ndrivers/of/unittest.c:1531:\tof_unittest_check_addr(\"/testcase-data/address-tests2/pcie@d1070000/pci@0,0/dev@0,0/local-bus@0/dev@e0000000\",\ndrivers/of/unittest.c:1532:\t\t\t       of_unittest_reg_pci_expected_res,\ndrivers/of/unittest.c:1533:\t\t\t       ARRAY_SIZE(of_unittest_reg_pci_expected_res));\ndrivers/of/unittest.c-1534-}\ndrivers/of/unittest.c-1535-\ndrivers/of/unittest.c:1536:static void __init of_unittest_parse_interrupts(void)\ndrivers/of/unittest.c-1537-{\n--\ndrivers/of/unittest.c-1612-\ndrivers/of/unittest.c:1613:static void __init of_unittest_parse_interrupts_extended(void)\ndrivers/of/unittest.c-1614-{\n--\ndrivers/of/unittest.c-1692-\ndrivers/of/unittest.c:1693:struct of_unittest_expected_imap_item {\ndrivers/of/unittest.c-1694-\tu32 child_imap_count;\n--\ndrivers/of/unittest.c-1700-\ndrivers/of/unittest.c:1701:static const struct of_unittest_expected_imap_item of_unittest_expected_imap_items[] = {\ndrivers/of/unittest.c-1702-\t{\n--\ndrivers/of/unittest.c-1728-\ndrivers/of/unittest.c:1729:static void __init of_unittest_parse_interrupt_map(void)\ndrivers/of/unittest.c-1730-{\ndrivers/of/unittest.c:1731:\tconst struct of_unittest_expected_imap_item *expected_item;\ndrivers/of/unittest.c-1732-\tstruct device_node *imap_np, *expected_parent_np;\n--\ndrivers/of/unittest.c-1750-\ndrivers/of/unittest.c:1751:\texpected_item = of_unittest_expected_imap_items;\ndrivers/of/unittest.c-1752-\tcount = 0;\n--\ndrivers/of/unittest.c-1754-\tfor_each_of_imap_item(\u0026imap_parser, \u0026imap_item) {\ndrivers/of/unittest.c:1755:\t\tif (unittest(count \u003c ARRAY_SIZE(of_unittest_expected_imap_items),\ndrivers/of/unittest.c-1756-\t\t\t     \"imap item number %d not expected. Max number %zu\\n\",\ndrivers/of/unittest.c:1757:\t\t\t     count, ARRAY_SIZE(of_unittest_expected_imap_items) - 1)) {\ndrivers/of/unittest.c-1758-\t\t\tof_node_put(imap_item.parent_args.np);\n--\ndrivers/of/unittest.c-1800-\ndrivers/of/unittest.c:1801:\tunittest(count == ARRAY_SIZE(of_unittest_expected_imap_items),\ndrivers/of/unittest.c-1802-\t\t \"Missing items. %d parsed, expected %zu\\n\",\ndrivers/of/unittest.c:1803:\t\t count, ARRAY_SIZE(of_unittest_expected_imap_items));\ndrivers/of/unittest.c-1804-end:\n--\ndrivers/of/unittest.c-1808-#if IS_ENABLED(CONFIG_OF_DYNAMIC)\ndrivers/of/unittest.c:1809:static void __init of_unittest_irq_refcount(void)\ndrivers/of/unittest.c-1810-{\n--\ndrivers/of/unittest.c-1870-#else\ndrivers/of/unittest.c:1871:static inline void __init of_unittest_irq_refcount(void) { }\ndrivers/of/unittest.c-1872-#endif\n--\ndrivers/of/unittest.c=1891=static struct {\n--\ndrivers/of/unittest.c-1908-\ndrivers/of/unittest.c:1909:static void __init of_unittest_match_node(void)\ndrivers/of/unittest.c-1910-{\n--\ndrivers/of/unittest.c=1941=static const struct platform_device_info test_bus_info = {\n--\ndrivers/of/unittest.c-1943-};\ndrivers/of/unittest.c:1944:static void __init of_unittest_platform_populate(void)\ndrivers/of/unittest.c-1945-{\n--\ndrivers/of/unittest.c=2352=static struct platform_driver unittest_gpio_driver = {\n--\ndrivers/of/unittest.c-2360-\ndrivers/of/unittest.c:2361:static void __init of_unittest_overlay_gpio(void)\ndrivers/of/unittest.c-2362-{\n--\ndrivers/of/unittest.c-2372-\t * The overlays are applied by overlay_data_apply()\ndrivers/of/unittest.c:2373:\t * instead of of_unittest_apply_overlay() so that they\ndrivers/of/unittest.c-2374-\t * will not be tracked.  Thus they will not be removed\ndrivers/of/unittest.c:2375:\t * by of_unittest_remove_tracked_overlays().\ndrivers/of/unittest.c-2376-\t *\n--\ndrivers/of/unittest.c-2486-\ndrivers/of/unittest.c:2487:static void __init of_unittest_overlay_gpio(void)\ndrivers/of/unittest.c-2488-{\n--\ndrivers/of/unittest.c=2546=static const char *unittest_path(int nr, enum overlay_type ovtype)\n--\ndrivers/of/unittest.c-2566-\ndrivers/of/unittest.c:2567:static int of_unittest_device_exists(int unittest_nr, enum overlay_type ovtype)\ndrivers/of/unittest.c-2568-{\n--\ndrivers/of/unittest.c=2599=static int track_ovcs_id_cnt;\ndrivers/of/unittest.c-2600-\ndrivers/of/unittest.c:2601:static void of_unittest_track_overlay(int ovcs_id, int overlay_nr)\ndrivers/of/unittest.c-2602-{\n--\ndrivers/of/unittest.c-2610-\ndrivers/of/unittest.c:2611:static void of_unittest_untrack_overlay(int ovcs_id)\ndrivers/of/unittest.c-2612-{\n--\ndrivers/of/unittest.c-2621-\ndrivers/of/unittest.c:2622:static void of_unittest_remove_tracked_overlays(void)\ndrivers/of/unittest.c-2623-{\n--\ndrivers/of/unittest.c-2637-\t\t}\ndrivers/of/unittest.c:2638:\t\tof_unittest_untrack_overlay(save_ovcs_id);\ndrivers/of/unittest.c-2639-\t}\n--\ndrivers/of/unittest.c-2642-\ndrivers/of/unittest.c:2643:static int __init of_unittest_apply_overlay(int overlay_nr, int *ovcs_id)\ndrivers/of/unittest.c-2644-{\n--\ndrivers/of/unittest.c-2646-\t * The overlay will be tracked, thus it will be removed\ndrivers/of/unittest.c:2647:\t * by of_unittest_remove_tracked_overlays().\ndrivers/of/unittest.c-2648-\t */\n--\ndrivers/of/unittest.c-2657-\t}\ndrivers/of/unittest.c:2658:\tof_unittest_track_overlay(*ovcs_id, overlay_nr);\ndrivers/of/unittest.c-2659-\n--\ndrivers/of/unittest.c-2662-\ndrivers/of/unittest.c:2663:static int __init __of_unittest_apply_overlay_check(int overlay_nr,\ndrivers/of/unittest.c-2664-\t\tint unittest_nr, int before, int after,\n--\ndrivers/of/unittest.c-2669-\t/* unittest device must be in before state */\ndrivers/of/unittest.c:2670:\tif (of_unittest_device_exists(unittest_nr, ovtype) != before) {\ndrivers/of/unittest.c-2671-\t\tunittest(0, \"%s with device @\\\"%s\\\" %s\\n\",\n--\ndrivers/of/unittest.c-2679-\tovcs_id = 0;\ndrivers/of/unittest.c:2680:\tret = of_unittest_apply_overlay(overlay_nr, \u0026ovcs_id);\ndrivers/of/unittest.c-2681-\tif (ret != 0) {\ndrivers/of/unittest.c:2682:\t\t/* of_unittest_apply_overlay already called unittest() */\ndrivers/of/unittest.c-2683-\t\treturn ret;\n--\ndrivers/of/unittest.c-2686-\t/* unittest device must be in after state */\ndrivers/of/unittest.c:2687:\tif (of_unittest_device_exists(unittest_nr, ovtype) != after) {\ndrivers/of/unittest.c-2688-\t\tunittest(0, \"%s with device @\\\"%s\\\" %s\\n\",\n--\ndrivers/of/unittest.c-2698-/* apply an overlay while checking before and after states */\ndrivers/of/unittest.c:2699:static int __init of_unittest_apply_overlay_check(int overlay_nr,\ndrivers/of/unittest.c-2700-\t\tint unittest_nr, int before, int after,\n--\ndrivers/of/unittest.c-2702-{\ndrivers/of/unittest.c:2703:\tint ovcs_id = __of_unittest_apply_overlay_check(overlay_nr,\ndrivers/of/unittest.c-2704-\t\t\t\tunittest_nr, before, after, ovtype);\n--\ndrivers/of/unittest.c-2711-/* apply an overlay and then revert it while checking before, after states */\ndrivers/of/unittest.c:2712:static int __init of_unittest_apply_revert_overlay_check(int overlay_nr,\ndrivers/of/unittest.c-2713-\t\tint unittest_nr, int before, int after,\n--\ndrivers/of/unittest.c-2717-\ndrivers/of/unittest.c:2718:\tovcs_id = __of_unittest_apply_overlay_check(overlay_nr, unittest_nr,\ndrivers/of/unittest.c-2719-\t\t\t\t\t\t    before, after, ovtype);\n--\ndrivers/of/unittest.c-2731-\t}\ndrivers/of/unittest.c:2732:\tof_unittest_untrack_overlay(save_ovcs_id);\ndrivers/of/unittest.c-2733-\ndrivers/of/unittest.c-2734-\t/* unittest device must be again in before state */\ndrivers/of/unittest.c:2735:\tif (of_unittest_device_exists(unittest_nr, ovtype) != before) {\ndrivers/of/unittest.c-2736-\t\tunittest(0, \"%s with device @\\\"%s\\\" %s\\n\",\n--\ndrivers/of/unittest.c-2746-/* test activation of device */\ndrivers/of/unittest.c:2747:static void __init of_unittest_overlay_0(void)\ndrivers/of/unittest.c-2748-{\n--\ndrivers/of/unittest.c-2754-\t/* device should enable */\ndrivers/of/unittest.c:2755:\tret = of_unittest_apply_overlay_check(0, 0, 0, 1, PDEV_OVERLAY);\ndrivers/of/unittest.c-2756-\n--\ndrivers/of/unittest.c-2766-/* test deactivation of device */\ndrivers/of/unittest.c:2767:static void __init of_unittest_overlay_1(void)\ndrivers/of/unittest.c-2768-{\n--\ndrivers/of/unittest.c-2774-\t/* device should disable */\ndrivers/of/unittest.c:2775:\tret = of_unittest_apply_overlay_check(1, 1, 1, 0, PDEV_OVERLAY);\ndrivers/of/unittest.c-2776-\n--\ndrivers/of/unittest.c-2787-/* test activation of device */\ndrivers/of/unittest.c:2788:static void __init of_unittest_overlay_2(void)\ndrivers/of/unittest.c-2789-{\n--\ndrivers/of/unittest.c-2795-\t/* device should enable */\ndrivers/of/unittest.c:2796:\tret = of_unittest_apply_overlay_check(2, 2, 0, 1, PDEV_OVERLAY);\ndrivers/of/unittest.c-2797-\n--\ndrivers/of/unittest.c-2806-/* test deactivation of device */\ndrivers/of/unittest.c:2807:static void __init of_unittest_overlay_3(void)\ndrivers/of/unittest.c-2808-{\n--\ndrivers/of/unittest.c-2814-\t/* device should disable */\ndrivers/of/unittest.c:2815:\tret = of_unittest_apply_overlay_check(3, 3, 1, 0, PDEV_OVERLAY);\ndrivers/of/unittest.c-2816-\n--\ndrivers/of/unittest.c-2826-/* test activation of a full device node */\ndrivers/of/unittest.c:2827:static void __init of_unittest_overlay_4(void)\ndrivers/of/unittest.c-2828-{\ndrivers/of/unittest.c-2829-\t/* device should disable */\ndrivers/of/unittest.c:2830:\tif (of_unittest_apply_overlay_check(4, 4, 0, 1, PDEV_OVERLAY))\ndrivers/of/unittest.c-2831-\t\treturn;\n--\ndrivers/of/unittest.c-2836-/* test overlay apply/revert sequence */\ndrivers/of/unittest.c:2837:static void __init of_unittest_overlay_5(void)\ndrivers/of/unittest.c-2838-{\n--\ndrivers/of/unittest.c-2844-\t/* device should disable */\ndrivers/of/unittest.c:2845:\tret = of_unittest_apply_revert_overlay_check(5, 5, 0, 1, PDEV_OVERLAY);\ndrivers/of/unittest.c-2846-\n--\ndrivers/of/unittest.c-2856-/* test overlay application in sequence */\ndrivers/of/unittest.c:2857:static void __init of_unittest_overlay_6(void)\ndrivers/of/unittest.c-2858-{\n--\ndrivers/of/unittest.c-2867-\tfor (i = 0; i \u003c 2; i++) {\ndrivers/of/unittest.c:2868:\t\tif (of_unittest_device_exists(unittest_nr + i, PDEV_OVERLAY)\ndrivers/of/unittest.c-2869-\t\t\t\t!= before) {\n--\ndrivers/of/unittest.c-2892-\tsave_ovcs_id[0] = ovcs_id;\ndrivers/of/unittest.c:2893:\tof_unittest_track_overlay(ovcs_id, overlay_nr + 0);\ndrivers/of/unittest.c-2894-\n--\ndrivers/of/unittest.c-2909-\tsave_ovcs_id[1] = ovcs_id;\ndrivers/of/unittest.c:2910:\tof_unittest_track_overlay(ovcs_id, overlay_nr + 1);\ndrivers/of/unittest.c-2911-\n--\ndrivers/of/unittest.c-2917-\t\t/* unittest device must be in after state */\ndrivers/of/unittest.c:2918:\t\tif (of_unittest_device_exists(unittest_nr + i, PDEV_OVERLAY)\ndrivers/of/unittest.c-2919-\t\t\t\t!= after) {\n--\ndrivers/of/unittest.c-2937-\t\t}\ndrivers/of/unittest.c:2938:\t\tof_unittest_untrack_overlay(save_ovcs_id[i]);\ndrivers/of/unittest.c-2939-\t}\n--\ndrivers/of/unittest.c-2942-\t\t/* unittest device must be again in before state */\ndrivers/of/unittest.c:2943:\t\tif (of_unittest_device_exists(unittest_nr + i, PDEV_OVERLAY)\ndrivers/of/unittest.c-2944-\t\t\t\t!= before) {\n--\ndrivers/of/unittest.c-2958-/* test overlay application in sequence */\ndrivers/of/unittest.c:2959:static void __init of_unittest_overlay_8(void)\ndrivers/of/unittest.c-2960-{\n--\ndrivers/of/unittest.c-2983-\tsave_ovcs_id[0] = ovcs_id;\ndrivers/of/unittest.c:2984:\tof_unittest_track_overlay(ovcs_id, overlay_nr + 0);\ndrivers/of/unittest.c-2985-\n--\ndrivers/of/unittest.c-3002-\tsave_ovcs_id[1] = ovcs_id;\ndrivers/of/unittest.c:3003:\tof_unittest_track_overlay(ovcs_id, overlay_nr + 1);\ndrivers/of/unittest.c-3004-\n--\ndrivers/of/unittest.c-3043-\t\t}\ndrivers/of/unittest.c:3044:\t\tof_unittest_untrack_overlay(save_ovcs_id[i]);\ndrivers/of/unittest.c-3045-\t}\n--\ndrivers/of/unittest.c-3050-/* test insertion of a bus with parent devices */\ndrivers/of/unittest.c:3051:static void __init of_unittest_overlay_10(void)\ndrivers/of/unittest.c-3052-{\n--\ndrivers/of/unittest.c-3056-\t/* device should disable */\ndrivers/of/unittest.c:3057:\tret = of_unittest_apply_overlay_check(10, 10, 0, 1, PDEV_OVERLAY);\ndrivers/of/unittest.c-3058-\n--\ndrivers/of/unittest.c-3074-/* test insertion of a bus with parent devices (and revert) */\ndrivers/of/unittest.c:3075:static void __init of_unittest_overlay_11(void)\ndrivers/of/unittest.c-3076-{\n--\ndrivers/of/unittest.c-3079-\t/* device should disable */\ndrivers/of/unittest.c:3080:\tret = of_unittest_apply_revert_overlay_check(11, 11, 0, 1,\ndrivers/of/unittest.c-3081-\t\t\tPDEV_OVERLAY);\n--\ndrivers/of/unittest.c=3286=static struct i2c_driver unittest_i2c_mux_driver = {\n--\ndrivers/of/unittest.c-3296-\ndrivers/of/unittest.c:3297:static int of_unittest_overlay_i2c_init(void)\ndrivers/of/unittest.c-3298-{\n--\ndrivers/of/unittest.c-3329-\ndrivers/of/unittest.c:3330:static void of_unittest_overlay_i2c_cleanup(void)\ndrivers/of/unittest.c-3331-{\n--\ndrivers/of/unittest.c-3338-\ndrivers/of/unittest.c:3339:static void __init of_unittest_overlay_i2c_12(void)\ndrivers/of/unittest.c-3340-{\n--\ndrivers/of/unittest.c-3346-\ndrivers/of/unittest.c:3347:\tret = of_unittest_apply_overlay_check(12, 12, 0, 1, I2C_OVERLAY);\ndrivers/of/unittest.c-3348-\n--\ndrivers/of/unittest.c-3358-/* test deactivation of device */\ndrivers/of/unittest.c:3359:static void __init of_unittest_overlay_i2c_13(void)\ndrivers/of/unittest.c-3360-{\n--\ndrivers/of/unittest.c-3366-\t/* device should disable */\ndrivers/of/unittest.c:3367:\tret = of_unittest_apply_overlay_check(13, 13, 1, 0, I2C_OVERLAY);\ndrivers/of/unittest.c-3368-\n--\ndrivers/of/unittest.c-3378-/* just check for i2c mux existence */\ndrivers/of/unittest.c:3379:static void of_unittest_overlay_i2c_14(void)\ndrivers/of/unittest.c-3380-{\n--\ndrivers/of/unittest.c-3382-\ndrivers/of/unittest.c:3383:static void __init of_unittest_overlay_i2c_15(void)\ndrivers/of/unittest.c-3384-{\n--\ndrivers/of/unittest.c-3390-\ndrivers/of/unittest.c:3391:\tret = of_unittest_apply_overlay_check(15, 15, 0, 1, I2C_OVERLAY);\ndrivers/of/unittest.c-3392-\n--\ndrivers/of/unittest.c-3403-\ndrivers/of/unittest.c:3404:static inline void of_unittest_overlay_i2c_14(void) { }\ndrivers/of/unittest.c:3405:static inline void of_unittest_overlay_i2c_15(void) { }\ndrivers/of/unittest.c-3406-\n--\ndrivers/of/unittest.c=3477=static struct notifier_block of_nb = {\n--\ndrivers/of/unittest.c-3480-\ndrivers/of/unittest.c:3481:static void __init of_unittest_overlay_notify(void)\ndrivers/of/unittest.c-3482-{\n--\ndrivers/of/unittest.c-3493-\t * The overlays are applied by overlay_data_apply()\ndrivers/of/unittest.c:3494:\t * instead of of_unittest_apply_overlay() so that they\ndrivers/of/unittest.c-3495-\t * will not be tracked.  Thus they will not be removed\ndrivers/of/unittest.c:3496:\t * by of_unittest_remove_tracked_overlays().\ndrivers/of/unittest.c-3497-\t *\n--\ndrivers/of/unittest.c-3591-\ndrivers/of/unittest.c:3592:static void __init of_unittest_overlay(void)\ndrivers/of/unittest.c-3593-{\n--\ndrivers/of/unittest.c-3612-\ndrivers/of/unittest.c:3613:\tif (!of_unittest_device_exists(100, PDEV_OVERLAY)) {\ndrivers/of/unittest.c-3614-\t\tunittest(0, \"could not find unittest0 @ \\\"%s\\\"\\n\",\n--\ndrivers/of/unittest.c-3618-\ndrivers/of/unittest.c:3619:\tif (of_unittest_device_exists(101, PDEV_OVERLAY)) {\ndrivers/of/unittest.c-3620-\t\tunittest(0, \"unittest1 @ \\\"%s\\\" should not exist\\n\",\n--\ndrivers/of/unittest.c-3627-\t/* tests in sequence */\ndrivers/of/unittest.c:3628:\tof_unittest_overlay_0();\n\n"
}

gemini-3.8-flash

null

null

							input: 17718
							output: 33
							thoughts: 218
						

**Analyzing the Initialization and Lifetime of `of_unittest` Functions**

Okay, let's break this down. `of_unittest_parse_phandle_with_args_map()` is flagged as `__init`, and every function that calls it is also an `__init` function. The function `of_unittest()` itself is called by `late_initcall(of_unittest)`. In the kernel, anything marked `__init` gets squirreled away in the `.init.text` section, which is critical for understanding this. After the boot process completes, the kernel calls `free_initmem()`, which basically reclaims the entire `.init.text` section. It unmaps the memory and makes it unavailable.

Now, here's the kicker: by the time syzkaller, or any userspace process for that matter, kicks off and starts making syscalls, `.init.text` is long gone! Any attempt to execute code that was previously in `.init.text` would result in a page fault or a read from unmapped memory. That means userspace *cannot* directly call `of_unittest` or `of_unittest_parse_phandle_with_args_map`. These functions are designed to be used only during the boot process for testing purposes. They're not intended to be part of the runtime system.

Alright, let me pause here. A quick check of Kconfig for OF_UNITTEST is in order, just to make sure I'm not missing anything.

{
  "File": "drivers/of/Kconfig",
  "FirstLine": 15,
  "LineCount": 40
}

{
  "Contents": "  15:\t\t  It is automatically selected by platforms that need it or can\n  16:\t\t  be enabled manually for unittests, overlays or\n  17:\t\t  compile-coverage.\n  18:\t\n  19:\tif OF\n  20:\t\n  21:\tconfig OF_UNITTEST\n  22:\t\tbool \"Device Tree runtime unit tests\"\n  23:\t\tdepends on OF_EARLY_FLATTREE\n  24:\t\tselect IRQ_DOMAIN\n  25:\t\tselect OF_RESOLVE\n  26:\t\thelp\n  27:\t\t  This option builds in test cases for the device tree infrastructure\n  28:\t\t  that are executed once at boot time, and the results dumped to the\n  29:\t\t  console.\n  30:\t\n  31:\t\t  This option should only be enabled for a development kernel. The tests\n  32:\t\t  will taint the kernel with TAINT_TEST. The tests will cause ERROR and\n  33:\t\t  WARNING messages to print on the console. The tests will cause stack\n  34:\t\t  traces to print on the console.  It is possible that the tests will\n  35:\t\t  leave the devicetree in a corrupted state.\n  36:\t\n  37:\t\t  The unittest output will be verbose.  Copy the output to a file\n  38:\t\t  via capturing the console output or via the dmesg command.  Process\n  39:\t\t  this file with scripts/dtc/of_unittest_expect to reduce the\n  40:\t\t  verbosity, test whether expected output is present, and to\n  41:\t\t  summarize the results.\n  42:\t\n  43:\t\t  If unsure, say N here. This option is not safe to enable.\n  44:\t\n  45:\tconfig OF_KUNIT_TEST\n  46:\t\ttristate \"Devicetree KUnit Test\" if !KUNIT_ALL_TESTS\n  47:\t\tdepends on KUNIT\n  48:\t\tdefault KUNIT_ALL_TESTS\n  49:\t\thelp\n  50:\t\t  This option builds KUnit unit tests for device tree infrastructure.\n  51:\t\n  52:\t\t  If unsure, say N here, but this option is safe to enable.\n  53:\t\n  54:\tconfig OF_ALL_DTBS\n"
}

gemini-3.8-flash

null

null

							input: 18869
							output: 22
							thoughts: 160
						

**Device Tree Test Case Considerations**

Okay, so I'm looking at this `drivers/of/Kconfig` file and trying to figure out if enabling this "Device Tree test cases" option is a good idea. The description makes it sound... pretty rough. It says these tests will run at boot, dump results to the console, and, oh joy, *taint* the kernel with `TAINT_TEST`. Great. They'll also spew errors, warnings, and stack traces. Fantastic for debugging, I guess, but definitely not ideal for a stable environment. The kicker? It *might* corrupt the Device Tree. They're basically saying, "Don't enable this unless you *really* know what you're doing." That's not exactly reassuring.

And the dependencies... it depends on `OF_EARLY_FLATTREE`. Now, that's the key. Does amd64 even *have* `OF_EARLY_FLATTREE`? I need to verify that before I go any further. I'd better double-check the Kconfig options for that architecture before I even *think* about enabling this thing. I need to be sure the test is even applicable to my target before I take the risk.

{
  "Expression": "OF_EARLY_FLATTREE"
}

{
  "Output": "Makefile=1680=dtbs_install:\n--\nMakefile-1682-\nMakefile:1683:ifdef CONFIG_OF_EARLY_FLATTREE\nMakefile-1684-all: dtbs\n--\narch/arc/Kconfig=6=config ARC\n--\narch/arc/Kconfig-51-\tselect OF\narch/arc/Kconfig:52:\tselect OF_EARLY_FLATTREE\narch/arc/Kconfig-53-\tselect PCI_SYSCALL if PCI\n--\narch/arm/Kconfig=2=config ARM\n--\narch/arm/Kconfig-149-\tselect NEED_DMA_MAP_STATE\narch/arm/Kconfig:150:\tselect OF_EARLY_FLATTREE if OF\narch/arm/Kconfig-151-\tselect OLD_SIGACTION\n--\narch/arm64/Kconfig=2=config ARM64\n--\narch/arm64/Kconfig-243-\tselect OF\narch/arm64/Kconfig:244:\tselect OF_EARLY_FLATTREE\narch/arm64/Kconfig-245-\tselect PCI_DOMAINS_GENERIC if PCI\n--\narch/csky/Kconfig=2=config CSKY\n--\narch/csky/Kconfig-101-\tselect OF\narch/csky/Kconfig:102:\tselect OF_EARLY_FLATTREE\narch/csky/Kconfig-103-\tselect PERF_USE_VMALLOC if CPU_CK610\n--\narch/loongarch/Kconfig=2=config LOONGARCH\n--\narch/loongarch/Kconfig-197-\tselect OF\narch/loongarch/Kconfig:198:\tselect OF_EARLY_FLATTREE\narch/loongarch/Kconfig-199-\tselect PCI\n--\narch/loongarch/kernel/setup.c=283=static void __init fdt_setup(void)\narch/loongarch/kernel/setup.c-284-{\narch/loongarch/kernel/setup.c:285:#ifdef CONFIG_OF_EARLY_FLATTREE\narch/loongarch/kernel/setup.c-286-\tvoid *fdt_pointer;\n--\narch/microblaze/Kconfig=2=config MICROBLAZE\n--\narch/microblaze/Kconfig-38-\tselect OF\narch/microblaze/Kconfig:39:\tselect OF_EARLY_FLATTREE\narch/microblaze/Kconfig-40-\tselect PCI_DOMAINS_GENERIC if PCI\n--\narch/mips/Kconfig=2920=config USE_OF\n--\narch/mips/Kconfig-2922-\tselect OF\narch/mips/Kconfig:2923:\tselect OF_EARLY_FLATTREE\narch/mips/Kconfig-2924-\tselect IRQ_DOMAIN\n--\narch/mips/kernel/setup.c=519=static void __init bootcmdline_append(const char *s, size_t max)\n--\narch/mips/kernel/setup.c-529-\narch/mips/kernel/setup.c:530:#ifdef CONFIG_OF_EARLY_FLATTREE\narch/mips/kernel/setup.c-531-\narch/mips/kernel/setup.c=532=static int __init bootcmdline_scan_chosen(unsigned long node, const char *uname,\n--\narch/mips/kernel/setup.c-554-\narch/mips/kernel/setup.c:555:#endif /* CONFIG_OF_EARLY_FLATTREE */\narch/mips/kernel/setup.c-556-\narch/mips/kernel/setup.c=557=static void __init bootcmdline_init(void)\n--\narch/mips/kernel/setup.c-582-\narch/mips/kernel/setup.c:583:#ifdef CONFIG_OF_EARLY_FLATTREE\narch/mips/kernel/setup.c-584-\t/*\n--\narch/nios2/Kconfig=2=config NIOS2\n--\narch/nios2/Kconfig-23-\tselect OF\narch/nios2/Kconfig:24:\tselect OF_EARLY_FLATTREE\narch/nios2/Kconfig-25-\tselect SOC_BUS\n--\narch/openrisc/Kconfig=7=config OPENRISC\n--\narch/openrisc/Kconfig-16-\tselect OF\narch/openrisc/Kconfig:17:\tselect OF_EARLY_FLATTREE\narch/openrisc/Kconfig-18-\tselect IRQ_DOMAIN\n--\narch/powerpc/Kconfig=118=config PPC\n--\narch/powerpc/Kconfig-319-\tselect OF\narch/powerpc/Kconfig:320:\tselect OF_EARLY_FLATTREE\narch/powerpc/Kconfig-321-\tselect OLD_SIGACTION\t\t\tif PPC32\n--\narch/riscv/Kconfig=13=config RISCV\n--\narch/riscv/Kconfig-214-\tselect OF\narch/riscv/Kconfig:215:\tselect OF_EARLY_FLATTREE\narch/riscv/Kconfig-216-\tselect OF_IRQ\n--\narch/sh/Kconfig=162=config CPU_J2\n--\narch/sh/Kconfig-165-\tselect OF\narch/sh/Kconfig:166:\tselect OF_EARLY_FLATTREE\narch/sh/Kconfig-167-\n--\narch/sh/boards/Kconfig=15=config SH_DEVICE_TREE\n--\narch/sh/boards/Kconfig-17-\tselect OF\narch/sh/boards/Kconfig:18:\tselect OF_EARLY_FLATTREE\narch/sh/boards/Kconfig-19-\tselect TIMER_OF\n--\narch/sh/kernel/head_32.S=57=ENTRY(_stext)\n--\narch/sh/kernel/head_32.S-66-\narch/sh/kernel/head_32.S:67:#ifdef CONFIG_OF_EARLY_FLATTREE\narch/sh/kernel/head_32.S-68-\tmov\tr4, r12\t\t! Store device tree blob pointer in r12\n--\narch/sh/kernel/head_32.S-317-\narch/sh/kernel/head_32.S:318:#ifdef CONFIG_OF_EARLY_FLATTREE\narch/sh/kernel/head_32.S-319-\tmov.l\t8f, r0\t\t! Make flat device tree available early.\n--\narch/sh/kernel/head_32.S=342=ENTRY(stack_start)\n--\narch/sh/kernel/head_32.S-348-7:\t.long\tinit_thread_union\narch/sh/kernel/head_32.S:349:#if defined(CONFIG_OF_EARLY_FLATTREE)\narch/sh/kernel/head_32.S-350-8:\t.long\tsh_fdt_init\n--\narch/sh/kernel/setup.c=239=void __init __weak plat_early_device_setup(void)\n--\narch/sh/kernel/setup.c-242-\narch/sh/kernel/setup.c:243:#ifdef CONFIG_OF_EARLY_FLATTREE\narch/sh/kernel/setup.c-244-void __ref sh_fdt_init(phys_addr_t dt_phys)\n--\narch/sh/kernel/setup.c=270=void __init setup_arch(char **cmdline_p)\n--\narch/sh/kernel/setup.c-324-\narch/sh/kernel/setup.c:325:#ifdef CONFIG_OF_EARLY_FLATTREE\narch/sh/kernel/setup.c-326-#ifdef CONFIG_BUILTIN_DTB\n--\narch/um/Kconfig=5=config UML\n--\narch/um/Kconfig-30-\tselect NO_DMA if !UML_DMA_EMULATION\narch/um/Kconfig:31:\tselect OF_EARLY_FLATTREE if OF\narch/um/Kconfig-32-\tselect GENERIC_IRQ_SHOW\n--\narch/x86/Kconfig=669=config X86_INTEL_CE\n--\narch/x86/Kconfig-677-\tselect OF\narch/x86/Kconfig:678:\tselect OF_EARLY_FLATTREE\narch/x86/Kconfig-679-\thelp\n--\narch/x86/kernel/devicetree.c=339=void __init x86_flattree_get_config(void)\narch/x86/kernel/devicetree.c-340-{\narch/x86/kernel/devicetree.c:341:#ifdef CONFIG_OF_EARLY_FLATTREE\narch/x86/kernel/devicetree.c-342-\tu32 size, map_len;\n--\narch/xtensa/Kconfig=459=config USE_OF\n--\narch/xtensa/Kconfig-461-\tselect OF\narch/xtensa/Kconfig:462:\tselect OF_EARLY_FLATTREE\narch/xtensa/Kconfig-463-\thelp\n--\ndrivers/clk/x86/Kconfig=2=config CLK_LGM_CGU\n--\ndrivers/clk/x86/Kconfig-4-\tselect MFD_SYSCON\ndrivers/clk/x86/Kconfig:5:\tselect OF_EARLY_FLATTREE\ndrivers/clk/x86/Kconfig-6-\tbool \"Clock driver for Lightning Mountain(LGM) platform\"\n--\ndrivers/hv/Kconfig=5=config HYPERV\n--\ndrivers/hv/Kconfig-10-\tselect X86_HV_CALLBACK_VECTOR if X86\ndrivers/hv/Kconfig:11:\tselect OF_EARLY_FLATTREE if OF\ndrivers/hv/Kconfig-12-\tselect IRQ_MSI_LIB if X86\n--\ndrivers/of/Kconfig=21=config OF_UNITTEST\ndrivers/of/Kconfig-22-\tbool \"Device Tree runtime unit tests\"\ndrivers/of/Kconfig:23:\tdepends on OF_EARLY_FLATTREE\ndrivers/of/Kconfig-24-\tselect IRQ_DOMAIN\n--\ndrivers/of/Kconfig=64=config OF_FLATTREE\n--\ndrivers/of/Kconfig-69-\ndrivers/of/Kconfig:70:config OF_EARLY_FLATTREE\ndrivers/of/Kconfig-71-\tdef_bool OF \u0026\u0026 !(SPARC || ALPHA || HEXAGON || M68K || PARISC || S390)\n--\ndrivers/of/Kconfig=99=config OF_RESERVED_MEM\ndrivers/of/Kconfig:100:\tdef_bool OF_EARLY_FLATTREE\ndrivers/of/Kconfig-101-\n--\ndrivers/of/Makefile=5=obj-$(CONFIG_OF_FLATTREE) += fdt.o empty_root.dtb.o\ndrivers/of/Makefile:6:obj-$(CONFIG_OF_EARLY_FLATTREE) += fdt_address.o\ndrivers/of/Makefile-7-obj-$(CONFIG_OF_PROMTREE) += pdt.o\n--\ndrivers/of/fdt.c=458=phys_addr_t initial_boot_params_pa __ro_after_init;\ndrivers/of/fdt.c-459-\ndrivers/of/fdt.c:460:#ifdef CONFIG_OF_EARLY_FLATTREE\ndrivers/of/fdt.c-461-\n--\ndrivers/of/fdt.c=1347=late_initcall(of_fdt_raw_init);\n--\ndrivers/of/fdt.c-1349-\ndrivers/of/fdt.c:1350:#endif /* CONFIG_OF_EARLY_FLATTREE */\n--\ndrivers/of/of_kunit_helpers.c=25=EXPORT_SYMBOL_GPL(of_root_kunit_skip);\ndrivers/of/of_kunit_helpers.c-26-\ndrivers/of/of_kunit_helpers.c:27:#if defined(CONFIG_OF_OVERLAY) \u0026\u0026 defined(CONFIG_OF_EARLY_FLATTREE)\ndrivers/of/of_kunit_helpers.c-28-\n--\ndrivers/of/of_test.c=40=static int of_dtb_test_init(struct kunit *test)\n--\ndrivers/of/of_test.c-42-\tof_root_kunit_skip(test);\ndrivers/of/of_test.c:43:\tif (!IS_ENABLED(CONFIG_OF_EARLY_FLATTREE))\ndrivers/of/of_test.c:44:\t\tkunit_skip(test, \"requires CONFIG_OF_EARLY_FLATTREE\");\ndrivers/of/of_test.c-45-\n--\ndrivers/of/overlay_test.c=60=static void of_overlay_apply_kunit_cleanup(struct kunit *test)\n--\ndrivers/of/overlay_test.c-69-\t\tkunit_skip(test, \"requires CONFIG_OF_OVERLAY to apply overlay\");\ndrivers/of/overlay_test.c:70:\tif (!IS_ENABLED(CONFIG_OF_EARLY_FLATTREE))\ndrivers/of/overlay_test.c:71:\t\tkunit_skip(test, \"requires CONFIG_OF_EARLY_FLATTREE for root node\");\ndrivers/of/overlay_test.c-72-\n--\ndrivers/tty/serial/earlycon.c=265=early_param(\"console\", param_setup_earlycon_console_alias);\ndrivers/tty/serial/earlycon.c-266-\ndrivers/tty/serial/earlycon.c:267:#ifdef CONFIG_OF_EARLY_FLATTREE\ndrivers/tty/serial/earlycon.c-268-\ndrivers/tty/serial/earlycon.c=269=int __init of_setup_earlycon(const struct earlycon_id *match,\n--\ndrivers/tty/serial/earlycon.c-345-\ndrivers/tty/serial/earlycon.c:346:#endif /* CONFIG_OF_EARLY_FLATTREE */\n--\ninclude/kunit/of.h=16=void of_node_put_kunit(struct kunit *test, struct device_node *node)\n--\ninclude/kunit/of.h-22-\ninclude/kunit/of.h:23:#if defined(CONFIG_OF) \u0026\u0026 defined(CONFIG_OF_OVERLAY) \u0026\u0026 defined(CONFIG_OF_EARLY_FLATTREE)\ninclude/kunit/of.h-24-\n--\ninclude/kunit/of.h=30=of_overlay_fdt_apply_kunit(struct kunit *test, void *overlay_fdt,\n--\ninclude/kunit/of.h-32-{\ninclude/kunit/of.h:33:\tkunit_skip(test, \"requires CONFIG_OF and CONFIG_OF_OVERLAY and CONFIG_OF_EARLY_FLATTREE for root node\");\ninclude/kunit/of.h-34-\treturn -EINVAL;\n--\ninclude/linux/of_fdt.h=41=extern void of_fdt_limit_memory(int limit);\n--\ninclude/linux/of_fdt.h-43-\ninclude/linux/of_fdt.h:44:#ifdef CONFIG_OF_EARLY_FLATTREE\ninclude/linux/of_fdt.h-45-/* For scanning the flat device-tree at boot time */\n--\ninclude/linux/of_fdt.h=95=extern void early_get_first_memblock_info(void *, phys_addr_t *);\ninclude/linux/of_fdt.h:96:#else /* CONFIG_OF_EARLY_FLATTREE */\ninclude/linux/of_fdt.h-97-static inline void early_init_dt_check_for_usable_mem_range(void) {}\n--\ninclude/linux/of_fdt.h=103=static inline void unflatten_and_copy_device_tree(void) {}\ninclude/linux/of_fdt.h:104:#endif /* CONFIG_OF_EARLY_FLATTREE */\ninclude/linux/of_fdt.h-105-\n--\nscripts/package/builddeb=29=install_linux_image () {\n--\nscripts/package/builddeb-33-\t# Only some architectures with OF support have this target\nscripts/package/builddeb:34:\tif is_enabled CONFIG_OF_EARLY_FLATTREE \u0026\u0026 [ -d \"${srctree}/arch/${SRCARCH}/boot/dts\" ]; then\nscripts/package/builddeb-35-\t\t${MAKE} -f ${srctree}/Makefile INSTALL_DTBS_PATH=\"${pdir}/usr/lib/linux-image-${KERNELRELEASE}\" dtbs_install\n--\nscripts/package/buildtar=25=mkdir -p -- \"${tmpdir}/boot\"\n--\nscripts/package/buildtar-30-#\nscripts/package/buildtar:31:if grep -q '^CONFIG_OF_EARLY_FLATTREE=y' include/config/auto.conf; then\nscripts/package/buildtar-32-\t# Only some architectures with OF support have this target\n"
}

gemini-3.8-flash

null

null

							input: 23683
							output: 39
							thoughts: 825
						

**Fuzzing Applicability of `drivers/of/unittest.c`**

Okay, so I'm looking at `drivers/of/unittest.c`, which, as the name suggests, is kernel unit test code related to the Devicetree. My immediate thought is, "Can we fuzz this?" I need to quickly apply the negative criteria for determining if something is worth fuzzing. The key question is always about reachability. I need to make sure this code can actually be executed in a standard virtualized environment like QEMU, since Syzkaller is the fuzzer of choice.

Let's break it down: Are there any unreachable execution paths or self-tests involved? The triage philosophy explicitly states that code paths exclusive to architectures other than the target architecture, or code triggered only during hardware hot-unplug, are not fuzzed. And this makes sense.

Now I'm thinking about those unit tests. They're in the kernel, so that's good in terms of initial relevance. But the reachability gate is the primary thing. Can syzkaller trigger them? The triage guidance is super clear on this. Syzkaller is a coverage-guided fuzzer that works from userspace, exercising the kernel through syscall sequences. This unit test code, however, is activated through `late_initcall(of_unittest)` and is `__init` meaning its functionality executes *only* at kernel boot. Once the kernel finishes booting, that memory is discarded. Syzkaller won't even be running! These tests are running hardcoded, static testcases through `unittest_data_add()` before the fuzzer is even initialized.

So, `of_unittest_parse_phandle_with_args_map` and the entire file are inaccessible to Syzkaller after boot, so I need to check the build configuration options. Let's make sure it's not a module. I see in the `drivers/of/Kconfig` that `OF_UNITTEST` is a `bool`, which means it can't be built as a module. It's either built into the kernel or not at all. It's also static and `__init`, making it even clearer that its functionality is *only* ever accessible at boot.

Therefore, because `drivers/of/unittest.c` is boot-time unit test code executed during initialization, and because it is inaccessible after the boot process completes, it's a "no go" for fuzzing with Syzkaller. It falls under the "Unreachable Execution Paths" negative criteria.

{
  "Expression": "of_unittest_parse_phandle_with_args_map",
  "PathPrefix": "drivers/of/"
}

{
  "Output": "drivers/of/unittest.c=400=static void __init of_unittest_parse_phandle_with_args(void)\n--\ndrivers/of/unittest.c-558-\ndrivers/of/unittest.c:559:static void __init of_unittest_parse_phandle_with_args_map(void)\ndrivers/of/unittest.c-560-{\n--\ndrivers/of/unittest.c=4509=static int __init of_unittest(void)\n--\ndrivers/of/unittest.c-4537-\tof_unittest_parse_phandle_with_args();\ndrivers/of/unittest.c:4538:\tof_unittest_parse_phandle_with_args_map();\ndrivers/of/unittest.c-4539-\tof_unittest_printf();\n"
}

gemini-3.8-flash

null

null

							input: 25308
							output: 145
							thoughts: 952
						

**Analysis of the `of_unittest_parse_phandle_with_args_map` Patch**

Okay, let's break this down. That `of_unittest_parse_phandle_with_args_map` function, it's only called by `of_unittest`, which itself is `late_initcall`-ed. And it's marked as `__init`, meaning it's only executed during kernel initialization. Now, given that this patch targets `arch/x86` specifically (amd64, my focus), I'm checking if `OF_EARLY_FLATTREE` is even enabled by default for that architecture. A quick check in `arch/x86/Kconfig` reveals that only `X86_INTEL_CE` selects both `OF` and `OF_EARLY_FLATTREE`, and `drivers/hv/Kconfig` selects `OF_EARLY_FLATTREE if OF`. `OF` is not selected unless `X86_INTEL_CE` or `OF_UNITTEST` are manually enabled. Crucially, the function is `static void __init of_unittest_parse_phandle_with_args_map(void)`. That screams "boot-time only."

Now, the important question: Is this `__init` code reachable by syzkaller fuzzing? Absolutely not. Syzkaller cannot fuzz `__init` functions. By definition, syzkaller operates in userspace *after* the kernel has finished initializing. All that `__init` memory is long gone ("Freeing unused kernel image (initmem) memory..."). Therefore, runtime coverage-guided fuzzing can't touch it.

I'm double-checking the fuzzing guidelines to be sure. "REACHABILITY IS THE PRIMARY GATE": Fuzzing is only valid for code that *actually* executes in standard virtualized environments. If the code is structurally unreachable, it MUST NOT be fuzzed. Unreachable paths include driver teardown callbacks and code exclusive to other architectures.

So, this patch? It adds `of_node_put(np);` at two error/exit points within `of_unittest_parse_phandle_with_args_map`. This fixes a device_node reference count leak. It's in `drivers/of/unittest.c`, and, as I've established, that function only runs once during boot if `CONFIG_OF_UNITTEST` is enabled. It's unreachable from userspace.

Therefore, WorthFuzzing: false. FocusSymbols: []. EnableConfigs: []. The reasoning is that the patch modifies a static `__init` function called during boot (via `late_initcall(of_unittest)`) as part of the devicetree unit test suite. Since that memory is freed before userspace execution begins, it cannot be fuzzed.
This is clear and consistent. Time to call `set-results`.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies `of_unittest_parse_phandle_with_args_map()` in `drivers/of/unittest.c` to fix a reference count leak by adding `of_node_put(np)`. This function is marked `__init` and is only executed once during kernel boot via `late_initcall(of_unittest)` for devicetree self-tests (`CONFIG_OF_UNITTEST`). Because its memory is freed before userspace initializes, it cannot be reached or exercised by syzkaller fuzzing.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies `of_unittest_parse_phandle_with_args_map()` in `drivers/of/unittest.c` to fix a reference count leak by adding `of_node_put(np)`. This function is marked `__init` and is only executed once during kernel boot via `late_initcall(of_unittest)` for devicetree self-tests (`CONFIG_OF_UNITTEST`). Because its memory is freed before userspace initializes, it cannot be reached or exercised by syzkaller fuzzing.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null