Re: [PATCH] RDMA/uverbs: Fix radix tree node leak in uapi_add_elm()

[Jason Gunthorpe <jgg@ziepe.ca>]

On Fri, Nov 06, 2026 at 07:09:08AM +0530, Deepanshu Kartikey wrote:
> syzbot reported a memory leak of radix_tree_node objects allocated
> while registering a siw device:
> 
>   unreferenced object 0xffff88810d78f488 (size 576):
>     radix_tree_node_alloc+0x81/0x1a0 lib/radix-tree.c:276
>     radix_tree_insert+0x140/0x390 lib/radix-tree.c:712
>     uapi_add_elm+0x61/0x140 drivers/infiniband/core/uverbs_uapi.c:41
>     uverbs_alloc_api+0x85/0xc50 drivers/infiniband/core/uverbs_uapi.c:659
>     ib_uverbs_add_one+0x1b1/0x350 drivers/infiniband/core/uverbs_main.c:1196
>     ib_register_device+0x4fe/0x7f0 drivers/infiniband/core/device.c:1503
>     siw_newlink+0x36a/0x3f0 drivers/infiniband/sw/siw/siw_main.c:433
> 
> radix_tree_insert() can fail with -ENOMEM after __radix_tree_create()
> has already linked intermediate nodes into the tree, leaving them with
> no entries. uapi_add_elm() frees the element on failure, but nothing
> frees these empty nodes: uverbs_destroy_api() only removes populated
> slots, and radix tree nodes are freed only as a side effect of
> deleting an entry. The nodes are therefore leaked when the uapi is
> destroyed.
> 
> On -ENOMEM, populate the same key with a dummy entry and delete it
> again so that radix_tree_delete() reclaims the empty node chain.

That seems like an absurd thing to do, can we fix
uverbs_destroy_api() to free the entire tree rather just populated
slots somehow?

Jason