Re: [PATCH] RDMA/uverbs: Fix radix tree node leak in uapi_add_elm()

[Leon Romanovsky <leon@kernel.org>]

On Sun, Nov 15, 2026 at 08:00:25PM +0530, Deepanshu Kartikey wrote:
> On Tue, Nov 10, 2026 at 6:15 AM Jason Gunthorpe <jgg@ziepe.ca> wrote:
> >
> > On Fri, Nov 06, 2026 at 07:09:08AM +0530, Deepanshu Kartikey wrote:
> > > syzbot reported a memory leak of radix_tree_node objects allocated
> > > while registering a siw device:
> > >
> > >   unreferenced object 0xffff88810d78f488 (size 576):
> > >     radix_tree_node_alloc+0x81/0x1a0 lib/radix-tree.c:276
> > >     radix_tree_insert+0x140/0x390 lib/radix-tree.c:712
> > >     uapi_add_elm+0x61/0x140 drivers/infiniband/core/uverbs_uapi.c:41
> > >     uverbs_alloc_api+0x85/0xc50 drivers/infiniband/core/uverbs_uapi.c:659
> > >     ib_uverbs_add_one+0x1b1/0x350 drivers/infiniband/core/uverbs_main.c:1196
> > >     ib_register_device+0x4fe/0x7f0 drivers/infiniband/core/device.c:1503
> > >     siw_newlink+0x36a/0x3f0 drivers/infiniband/sw/siw/siw_main.c:433
> > >
> > > radix_tree_insert() can fail with -ENOMEM after __radix_tree_create()
> > > has already linked intermediate nodes into the tree, leaving them with
> > > no entries. uapi_add_elm() frees the element on failure, but nothing
> > > frees these empty nodes: uverbs_destroy_api() only removes populated
> > > slots, and radix tree nodes are freed only as a side effect of
> > > deleting an entry. The nodes are therefore leaked when the uapi is
> > > destroyed.
> > >
> > > On -ENOMEM, populate the same key with a dummy entry and delete it
> > > again so that radix_tree_delete() reclaims the empty node chain.
> >
> > That seems like an absurd thing to do, can we fix
> > uverbs_destroy_api() to free the entire tree rather just populated
> > slots somehow?
> >
> > Jason
> 
> Hi Jason,
> 
> Agreed. Since radix_tree_root is now an alias for struct xarray,
> uverbs_destroy_api() can call xa_destroy() after removing the
> populated slots, which frees all remaining nodes. I'll send a v2
> with that and drop the dummy insert/delete.

Can you please elaborate more about this sentence "which frees all
remaining nodes"?

Thanks

> 
> Thanks,
> Deepanshu